returnofdisasterclasshero.com Open in urlscan Pro
2606:4700:3035::ac43:da9c Public Scan

Go To Rescan
Add Verdict Report

URL:
https://returnofdisasterclasshero.com/
Submission: On January 25 via api (January 25th 2023, 12:03:44 pm UTC) from DO — Scanned from DE

Summary HTTP 450 Redirects Behaviour Indicators

Summary

This website contacted 53 IPs in 8 countries across 40 domains to perform 450 HTTP transactions. The main IP is 2606:4700:3035::ac43:da9c, located in United States and belongs to CLOUDFLARENET, US. The main domain is returnofdisasterclasshero.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 12th 2022. Valid for: a year.

This is the only time returnofdisasterclasshero.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
21	2606:4700:303... 2606:4700:3035::ac43:da9c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
3	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
63	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	13.224.189.16 13.224.189.16	16509 (AMAZON-02) (AMAZON-02)
1	146.75.120.193 146.75.120.193	54113 (FASTLY) (FASTLY)
5	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1178:1:4... 2a00:1178:1:4b::1a	35415 (WEBZILLA) (WEBZILLA)
6	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
18	18.204.127.105 18.204.127.105	14618 (AMAZON-AES) (AMAZON-AES)
19	2a00:1450:400... 2a00:1450:400d:80d::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:e134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:400d:806::2002	15169 (GOOGLE) (GOOGLE)
2	205.185.216.42 205.185.216.42	20446 (STACKPATH...) (STACKPATH-CDN)
4	2606:4700:20:... 2606:4700:20::681a:9a9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.107.148.139 34.107.148.139	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a02:2638:1::1a 2a02:2638:1::1a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS)
2 5	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
2	147.75.85.234 147.75.85.234	54825 (PACKET) (PACKET)
2	52.211.92.106 52.211.92.106	16509 (AMAZON-02) (AMAZON-02)
2	2a06:98c1:3123:: 2a06:98c1:3123::	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	51.75.86.98 51.75.86.98	16276 (OVH) (OVH)
3	2a02:2638:1::4 2a02:2638:1::4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
37	2a00:1450:400... 2a00:1450:400d:80a::2001	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
2	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
41	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	178.250.2.148 178.250.2.148	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	85.14.248.91 85.14.248.91	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
12	2a00:1450:400... 2a00:1450:400d:807::2002	15169 (GOOGLE) (GOOGLE)
7	2a02:2638:1::17 2a02:2638:1::17	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
8	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
57	2a02:2638::c 2a02:2638::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	185.29.134.248 185.29.134.248	30419 (MEDIAMATH...) (MEDIAMATH-INC)
8 23	142.251.39.66 142.251.39.66	15169 (GOOGLE) (GOOGLE)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 2	213.155.156.165 213.155.156.165	1299 (TWELVE99 ...) (TWELVE99 Arelion)
1	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
1 1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
3 3	213.19.147.44 213.19.147.44	26120 (RHYTHMONE) (RHYTHMONE)
1 6	23.35.237.56 23.35.237.56	16625 (AKAMAI-AS) (AKAMAI-AS)
6	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
24	217.79.188.59 217.79.188.59	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2	217.79.188.46 217.79.188.46	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 4	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
4	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
2	217.79.188.21 217.79.188.21	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
27	2a00:1450:400... 2a00:1450:400d:806::2006	15169 (GOOGLE) (GOOGLE)
2 3	2620:116:800d... 2620:116:800d:21:c5a4:625:6563:a5bb	16509 (AMAZON-02) (AMAZON-02)
3 3	2a05:d018:d29... 2a05:d018:d29:3605:675d:6b7d:32db:18ea	16509 (AMAZON-02) (AMAZON-02)
4	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
450	53

21 2606:4700:3035::ac43:da9c (United States)

ASN13335 (CLOUDFLARENET, US)

returnofdisasterclasshero.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

63 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-16.fra2.r.cloudfront.net

cdn.purpleads.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1178:1:4b::1a (Netherlands)

ASN35415 (WEBZILLA, NL)

silentinevitable.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 18.204.127.105 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-204-127-105.compute-1.amazonaws.com

api.purpleads.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:400d:80d::2002 (Ireland)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)

onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:400d:806::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 205.185.216.42 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map2.hwcdn.net

cdn.psdn.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:20::681a:9a9 (United States)

ASN13335 (CLOUDFLARENET, US)

script.4dex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::1a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net

prebid-eu.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.89.210.46 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 147.75.85.234 (Schiphol, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.211.92.106 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-211-92-106.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3123:: (United States)

ASN13335 (CLOUDFLARENET, US)

mp.4dex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.75.86.98 (France)

ASN16276 (OVH, FR)
PTR: ip98.ip-51-75-86.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:1::4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 2a00:1450:400d:80a::2001 (Ireland)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 85.14.248.91 (Kamp-Lintfort, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

m.exactag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:400d:807::2002 (Ireland)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:2638:1::17 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2a02:2638::c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.134.248 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 142.251.39.66 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: bud02s39-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.165 (Sweden) 2 redirects

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)
PTR: 213-155-156-165.teliacarrier-cust.com

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.19.147.44 (United Kingdom) 3 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.35.237.56 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-56.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 217.79.188.59 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: imagesrv.adition.com

imagesrv.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.79.188.46 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: ad4.adfarm1.adition.com

ad4.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.80.39.216 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.79.188.21 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: ad2.adfarm1.adition.com

ad2.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 2a00:1450:400d:806::2006 (Ireland)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:c5a4:625:6563:a5bb (United States) 2 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a05:d018:d29:3605:675d:6b7d:32db:18ea (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
106	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 108 tpc.googlesyndication.com — Cisco Umbrella Rank: 156 e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com	761 KB
105	criteo.net static.criteo.net — Cisco Umbrella Rank: 637 csm.eu.criteo.net — Cisco Umbrella Rank: 7994 pix.eu.criteo.net — Cisco Umbrella Rank: 7928	647 KB
55	doubleclick.net 8 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 190 cm.g.doubleclick.net — Cisco Umbrella Rank: 216 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 321	659 KB
29	adition.com 1 redirects dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1442 imagesrv.adition.com — Cisco Umbrella Rank: 17733 ad4.adfarm1.adition.com — Cisco Umbrella Rank: 50658 ad2.adfarm1.adition.com — Cisco Umbrella Rank: 53115	107 KB
27	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 280	574 KB
21	returnofdisasterclasshero.com returnofdisasterclasshero.com	537 KB
19	purpleads.io cdn.purpleads.io — Cisco Umbrella Rank: 45500 api.purpleads.io — Cisco Umbrella Rank: 28104	29 KB
13	google.com adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2	4 KB
11	criteo.com bidder.criteo.com — Cisco Umbrella Rank: 698 ads.eu.criteo.com — Cisco Umbrella Rank: 7924 rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 14074 cat.nl.eu.criteo.com — Cisco Umbrella Rank: 9895 rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 12744	176 KB
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 185	335 KB
7	gstatic.com fonts.gstatic.com www.gstatic.com	153 KB
6	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1223	1 KB
6	4dex.io script.4dex.io — Cisco Umbrella Rank: 1862 mp.4dex.io — Cisco Umbrella Rank: 1893	50 KB
6	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3300 onesignal.com — Cisco Umbrella Rank: 1332 img.onesignal.com — Cisco Umbrella Rank: 7708	180 KB
5	openx.net rtb.openx.net — Cisco Umbrella Rank: 1592 us-u.openx.net — Cisco Umbrella Rank: 420	949 B
5	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 207	5 KB
5	google.de adservice.google.de — Cisco Umbrella Rank: 8470	1 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 528	3 KB
3	yahoo.com 3 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 417	2 KB
3	quantserve.com 2 redirects cms.quantserve.com — Cisco Umbrella Rank: 636	1 KB
3	exactag.com m.exactag.com — Cisco Umbrella Rank: 10884	4 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	3 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 521	2 KB
2	de17a.com 2 redirects d5p.de17a.com — Cisco Umbrella Rank: 4845	653 B
2	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 691	753 B
2	servenobid.com ads.servenobid.com — Cisco Umbrella Rank: 1645	1 KB
2	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 838	199 B
2	creativecdn.com prebid-eu.creativecdn.com — Cisco Umbrella Rank: 5807	383 B
2	media.net prebid.media.net — Cisco Umbrella Rank: 1038	2 KB
2	psdn.xyz cdn.psdn.xyz — Cisco Umbrella Rank: 65443	234 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 22	20 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 199	23 KB
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 954	577 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 306	459 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 453	864 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 813	619 B
1	silentinevitable.com silentinevitable.com	450 B
1	imgur.com i.imgur.com — Cisco Umbrella Rank: 6006	55 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 672	33 KB
0	o2online.de Failed portal.o2online.de Failed
450	40

	Domain	Requested by
63	pagead2.googlesyndication.com	returnofdisasterclasshero.com pagead2.googlesyndication.com googleads.g.doubleclick.net securepubads.g.doubleclick.net tpc.googlesyndication.com e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com www.googletagservices.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com s0.2mdn.net
57	pix.eu.criteo.net	ads.eu.criteo.com returnofdisasterclasshero.com
41	static.criteo.net	ads.eu.criteo.com static.criteo.net returnofdisasterclasshero.com
37	tpc.googlesyndication.com	googleads.g.doubleclick.net securepubads.g.doubleclick.net tpc.googlesyndication.com e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com returnofdisasterclasshero.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com s0.2mdn.net pagead2.googlesyndication.com
27	s0.2mdn.net	returnofdisasterclasshero.com imagesrv.adition.com s0.2mdn.net
24	imagesrv.adition.com	e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com returnofdisasterclasshero.com imagesrv.adition.com
23	cm.g.doubleclick.net	8 redirects returnofdisasterclasshero.com googleads.g.doubleclick.net e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
21	returnofdisasterclasshero.com	returnofdisasterclasshero.com
18	api.purpleads.io	cdn.purpleads.io
16	googleads.g.doubleclick.net	pagead2.googlesyndication.com returnofdisasterclasshero.com googleads.g.doubleclick.net e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
12	securepubads.g.doubleclick.net	cdn.purpleads.io securepubads.g.doubleclick.net
8	www.google.com	googleads.g.doubleclick.net tpc.googlesyndication.com e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
7	csm.eu.criteo.net	ads.eu.criteo.com
7	www.googletagservices.com	googleads.g.doubleclick.net e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
6	sync.teads.tv	1 redirects returnofdisasterclasshero.com googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com
5	ib.adnxs.com	2 redirects cdn.psdn.xyz googleads.g.doubleclick.net
5	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
5	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
4	googleads4.g.doubleclick.net	returnofdisasterclasshero.com
4	us-u.openx.net	googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	script.4dex.io	cdn.psdn.xyz script.4dex.io
3	pr-bh.ybp.yahoo.com	3 redirects
3	cms.quantserve.com	2 redirects e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
3	m.exactag.com	ads.eu.criteo.com
3	cat.nl.eu.criteo.com	ads.eu.criteo.com
3	ads.eu.criteo.com	googleads.g.doubleclick.net
3	onesignal.com	cdn.onesignal.com
3	fonts.googleapis.com	returnofdisasterclasshero.com googleads.g.doubleclick.net imagesrv.adition.com
2	ad2.adfarm1.adition.com	ad4.adfarm1.adition.com ad2.adfarm1.adition.com
2	ad4.adfarm1.adition.com	e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com ad4.adfarm1.adition.com
2	cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	sync.1rx.io	2 redirects
2	d5p.de17a.com	2 redirects
2	rtb.fr.eu.criteo.com	returnofdisasterclasshero.com
2	onetag-sys.com	cdn.psdn.xyz
2	mp.4dex.io	cdn.psdn.xyz
2	ads.servenobid.com	cdn.psdn.xyz
2	prebid.a-mo.net	cdn.psdn.xyz
2	prebid-eu.creativecdn.com	cdn.psdn.xyz
2	bidder.criteo.com	cdn.psdn.xyz
2	prebid.media.net	cdn.psdn.xyz
2	cdn.psdn.xyz	cdn.purpleads.io
2	www.google-analytics.com	returnofdisasterclasshero.com www.google-analytics.com
2	cdn.onesignal.com	returnofdisasterclasshero.com cdn.onesignal.com
1	cdnjs.cloudflare.com	s0.2mdn.net
1	sync.targeting.unrulymedia.com	1 redirects
1	pixel.rubiconproject.com	1 redirects
1	rtb.openx.net	googleads.g.doubleclick.net
1	dsp.adfarm1.adition.com	1 redirects
1	sync.mathtag.com	1 redirects
1	rtb.nl.eu.criteo.com	returnofdisasterclasshero.com
1	www.gstatic.com	googleads.g.doubleclick.net
1	img.onesignal.com	returnofdisasterclasshero.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	silentinevitable.com	returnofdisasterclasshero.com
1	i.imgur.com	returnofdisasterclasshero.com
1	cdn.purpleads.io	returnofdisasterclasshero.com
1	code.jquery.com	returnofdisasterclasshero.com
0	portal.o2online.de Failed
450	63

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-12` - `2023-03-11`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.purpleads.io Amazon	`2022-10-31` - `2023-11-29`	a year	crt.sh
*.imgur.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-03-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
silentinevitable.com R3	`2023-01-15` - `2023-04-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
psdn.xyz E1	`2022-12-29` - `2023-03-29`	3 months	crt.sh
script.4dex.io Cloudflare Inc ECC CA-3	`2022-11-23` - `2023-11-22`	a year	crt.sh
*.media.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-06` - `2023-05-04`	a year	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-04` - `2023-03-31`	3 months	crt.sh
*.creativecdn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-17` - `2023-04-12`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.a-mo.net R3	`2022-12-04` - `2023-03-04`	3 months	crt.sh
ads.servenobid.com Amazon	`2022-05-29` - `2023-06-27`	a year	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-28` - `2024-01-28`	a year	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-22` - `2023-03-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-07` - `2023-03-12`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-15`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-19` - `2023-03-24`	3 months	crt.sh
*.exactag.com Sectigo RSA Organization Validation Secure Server CA	`2022-04-01` - `2023-05-02`	a year	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-17`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.adition.com AlphaSSL CA - SHA256 - G2	`2022-04-26` - `2023-05-28`	a year	crt.sh
*.adfarm1.adition.com AlphaSSL CA - SHA256 - G2	`2022-06-01` - `2023-07-03`	a year	crt.sh
teads.tv R3	`2023-01-20` - `2023-04-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh

This page contains 45 frames:

Primary Page: https://returnofdisasterclasshero.com/
Frame ID: 81661776F4ED5E3FFF0728B0B411185D
Requests: 59 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20190131/zrt_lookup.html
Frame ID: 2A56BD4E03BAEC261DE8AE52C5352743
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&adk=1812271804&adf=3025194257&lmt=1674631548&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&plas=140x945_l%7C140x945_r&format=0x0&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648213875&bpp=5&bdt=423&idt=257&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=932973055409&frm=20&pv=2&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=286
Frame ID: 55E4E73674DBA9F65F08DCDA655B6122
Requests: 1 HTTP requests in this frame

Frame: https://cdn.psdn.xyz/prebid-2023-01-25.js
Frame ID: 3CA492FD597346D14ADE45A3F13F2C68
Requests: 11 HTTP requests in this frame

Frame: https://cdn.psdn.xyz/prebid-2023-01-25.js
Frame ID: A2D534A71870A2404E52AA1D2E9E0614
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&h=280&adk=3903388278&adf=3964591440&pi=t.aa~a.422568436~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1674631548&rafmt=1&to=qs&pwprc=6017413186&format=960x280&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648214615&bpp=3&bdt=1163&idt=3&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&prev_fmts=0x0&nras=2&correlator=932973055409&frm=20&pv=1&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=160&ady=2943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qh7MhSu5xX&p=https%3A//returnofdisasterclasshero.com&dtd=14
Frame ID: 0565C070502DF5A3D11E99CD42B0E0C7
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1
Frame ID: 74A36840BE77B6D7E5611BE6FE8964D6
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1
Frame ID: 7E6C90892D7E3772D39AA44FF3094522
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1
Frame ID: B3BAA4396CE4CE6629A6968BE1028007
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOAKsoeEAAfVH2wt0E5nzLk0QWLXjg&u=%7C7Pm5Wog6nkd9ubvoX2mZ1k8LFVpcNs11oeOwnWOytEg%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_T4U3ERXQAMafMI0At8H8tIXNA50hUfvRil2-hkb2Ar4coqfQCEAQm2spJolaDNE5lmk0EEJ3MUbxgIkPC1hCBA1qM7pKHyI_ohDk5kdQdwZs6ysSONcre-NLWTAEN3IuiDYek4iVIWgjh-Cr5v6h-F4K-Bp7NbGKHX44NoRt1WGq53DJKD5q50xqfKt9tF0qlscuaqXeEOPwv5QXX_-KFMND5rkq5dsNmL6uTQA88E544zIA4BrTDxqJSY6cBHFsugCazH8_VcMwtpDHvrO8J3pGdmXBGHdj3flw6q01oTqsxy8NXDUu1urX5Cw0KqNduO49L2LuGbSRrWLD1UpGpDDOqEWs77yHoOKFZ1iGkKfgr9o4TfV2pow4hP9X3UUJHQ4b_2k66h6Ma6K9kRImTneFFdEnse3Q2YeGlNQkK478Huq7Yiy-_p3xunYcBbAd-iF6XNKNpIcMDgcXlBL4db9zxX6EP_BnWkKQu51dGkFvp-WO2FXfhfRmPDkPY8MjxLSLVZW0VIs33yeXsstqMMDlZy-ZQMiHSxu1QsNX3ekUMVYSkGeBbYo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCF53flhrRY-CxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIUCT9CeEwX-7V3OFufZN23rBjYBmHGfQXIzUpnX9hjQMZ53UvPHEl6FnN3cR-DwqS-fcuX2mwpNI2x5AanlfRzStrIo5B9y74pjRBvxofskxkAq2S9xyfL0oSNGZhWehJxSVmUiNFp3YLLMGCQHmD_lw7xCfy78QXbOIAWGBS3F62Wh7P9VqiNyxQmY-sAfz4k3NtrLw8ExdLyvafAoibw9tvYy5gPoYzeqpIPo5MyMIeWHYbg_sZ-XoS9KdNBGCHqDXopN2xsPUPVpG3rmxf0D_MGFY12yu1NhBm4J3vpeT9PeFP7e_-43OoObx15ydPeakcVL8IKy0ZE073CZa8GDThcNYyNEgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_38JjKuZrd0EzH7Mvw_ME-wX24KaQ%26client%3Dca-pub-3190457468549923%26adurl%3D
Frame ID: EFCB470A51C836C49943B573309D59F5
Requests: 34 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOEKsoeEAAfVH7Mfo04rJJyxvcS-Ag&u=%7C7Pm5Wog6nkfeR4%2BUjrrYPOD6RDhcvKl%2FXgQNUA4AotI%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_T4U3ERXQAMafMI0At8H8tIW92GoAMeffWC3JrvEAWlaL-NPREbmAU35de88Lx7J0Bcs-dmICAOIPQnYgOItglIGxvtJS1LNW-IvqDFcGowJFYHFBv6ZoVIEhDXC0mn2QuPwZVbP3TR7iJXmgu-cmMP8_y1zHgZvgmMydhXPRZQhetwM-f6VLghMuoM14P75AhnM2K7YQpwtHPdz3ScVnn4Gy4UxMgT02KQRwTVzKrnK8Gh19eM_Mos0Q7KW9STgaW6Q5vpmnGYKNKTko9rVhtymhuA_7VQkQOXuEW06ittiTMqXuuNYybRrY48t81JZW82wGS1kv6jMn0VO7ez22bKKbxI4GRHL9LrSskHZ5yVt8qtF2MUen6zIVZd8xy0xHN4XVQm4UEBBGhg-w_n4a5t-owRMZE4Ip5FED1b872cI41eNhSIlFiPxAv96wH76dAYcOR3U5dsou2mYmF0wKOhiR5X_oFy9GVUpBLD8aFbNyUWnht7p_kBjXm6Ja9grdEGqtiJZIsuhkL2Q4Z3yFIRNAi9OkxIX0FgrlrzHkNOGj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCjSyklhrRY-GxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIUCT9A28WQ6uRHciRF4MflPvwnI-SYNs5wHfs4ganTcHXCN7DHy31jBYTpe62G-T1lTF8Gtewlxssdvn2gvduqIOIcujJTzlVPOijNjsfuX5J-wq0WgOkYeeFw40qNjJS46dRruCyndy-deeviJBEG3G1h_Hqlvm-JtJQCyJ62Umm3HKqNKVAmN0ef2vq7c6noPDBE0kwmr1qYSKRfmEzBm91CZ-Jijc6BPHFR9MvQJjklzObdxXACxprkU4Cfhbc4u6D-Q_DJ6yhWv_jKBwl5NYpoYeEnaIlsp9_srp4KYn4NSVt0loyLUQAJeAFKbS9Ubo6o8AcQ4bD6cOwAFlFAyehwOGEsbgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0Jz8JN2-qSIZh_4jYa8efwLIIcjg%26client%3Dca-pub-3190457468549923%26adurl%3D
Frame ID: 893EB6B0D3E2FA5A1E80C06ECC52C897
Requests: 52 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOIKsoeEAAfVH3YxRbdrgjbncMJmIQ&u=%7C7Pm5Wog6nkfKm3SFGlVVxBNfcHtNaywMCBLcSpcpm1M%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANdxyL-B-DE_nbHS1sNQA-aOVQmAntDJMysO1XrhquT5j_SLJ3R5pEb6iKUnd8aG0jHZ76twftxEGnnMRA48l51yNKE6afRMjzdnB47qvozLxbVwA21-K0OUSBxOjAfQWWaOPOR5LysUFOp9NSxI2IVkyvoEnCa4sob4byNtrrVuGbihky_Ln8rZtQofSw0XFivhPilGsRr0hGAGRLVL1UEARHIz7cw_CSS7Ie0SVExoRmUsVY68e-0ZbfzE2Bfwr9TlxcJKONIohidjjuYP62WYmVCSQEJA31EA3Lna0_zYwyMMlnYC7tKtL09VhulqRdhOlknJ45i-y6QW6LNVGLM6QfLL0rvB6u_cWfceyjgsIoU5JdQ1MuYUUv1BWOmnXTWebFTBnjezj5xKvNRDSfI6QEQ0fJZUDQJ0Y2JeMawc52HtEQLzAMSSuq7ZyV37Nzhg1e7ZZPtXhpw4JAY1iayaqQGSvKBkbc7sCz5AN8Q9Y_KlSJ9MmN0W2lEswZjPc_kRu4b4ouIJJ14reTOvPCuHUfqvGfYzcGWnLvx_yJ3K8l7JHrpJLT6w&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DClA_4lhrRY-KxDISPygWfqp_AAsme0rFczfHi3YgBwI23ARABIABgldqIgpgHggEXY2EtcHViLTMxOTA0NTc0Njg1NDk5MjPIAQmpAtSmKH7oSLI-qAMBqgSGAk_QWqPzjjh428E1-At6DqISbWGT5f_WS0IBA4tCYMHvU3T9j-bJ1nOW6l2VMQIjEplTv4gFTecI_eMNEMFSWRHteqY_7jDH4qcgjJa3Tr5cpEtRoR6XJKl3YMFs_fjm5jXCQd-Nof1iEeK8OYZk3kJ5RhuIs-ZwgPNWTpyT5laIemXLH-NxFMw3yfLr3QKHWVZrudnkpPHQqFYIr3tDXEuufCXpVlHLzbJz5qfSASLbc0iklkPmvtNZMy7NvOXfxmwpn_xn29Ab_hYkuVyP0mO3NcKeemfS4-n_C7sGpBQDC_CvhybvGi2HEAwRxaZi_QsLsEGlOHAkEWn2mMiAljXgcKLNaNKABrCan5zrkfS3swGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3WBY5XHI61aA7Z9DNADxDzSoXV0Q%26client%3Dca-pub-3190457468549923%26adurl%3D
Frame ID: 1231B0A2ADD0404CBCC51E9FCDB56B9F
Requests: 28 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 3A28ACAEEFB110027FA449068598494B
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 456CE31C532ADFE4256A742CFB575994
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: C1302479E22F22DD3E3C366D98E7F1A6
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: A90EDF36E5802F22EB14095C4F0C88B4
Requests: 9 HTTP requests in this frame

Frame: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: F347AA57E3A0649572B45814942FFB10
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js
Frame ID: FF3A5531FCCC354F32F6B3D3479BAD07
Requests: 1 HTTP requests in this frame

Frame: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: F02728A897A0989254990C07FC3405A5
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 04F716DBD088F20BDC021190FC11711A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8F091CA921064941CC26991C53C5C8E9
Requests: 2 HTTP requests in this frame

Frame: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 87DB5BE8437FDF15FD73DD9691AE5823
Requests: 1 HTTP requests in this frame

Frame: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: CD555F37103FB907DF34C7C75B1B807D
Requests: 25 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDW4pWXBBjjodDdATAB&v=APEucNWlfhPAGqXGzleTUJnEuqhc18fIKGjLz2iB07ZdAUzEQwL80yn9obL9nMvSuu-34P70Wnjf6p3FA5Nw2wLyTKlOVq_3u7sEo-kS7vhvzdBP1bv31xhXK7s6Hk4fUqjS1ij3bY46jTRWnlBHwwYxv7tGXs9urHXFMG5rMmBaRHAbzjrJXYs
Frame ID: 7FD64E70EF5944B7DBB2715F57BCAE8A
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 03798FDA3B2A31AFE9F2D8ED5EA38953
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: AB9324DCFDEBF824F61CBA3F1152566D
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 4CE928F991D23DAE57E774B60A8F2A9A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: B528D656512A34101920D02A58AFAD8E
Requests: 2 HTTP requests in this frame

Frame: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: C30DA90ACA00D56869EA919282425EDB
Requests: 22 HTTP requests in this frame

Frame: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: FC6DB42B76263AD008E7131D90D8FF12
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQj_jnAhiZuPTcATAB&v=APEucNWhJrYl8zayGX6Ce3mwSDqiVntniDczLIw8iPZ4eRRpuGpoLARXy7IZDJQ2qAIObp4lxCqqGBraBpHUCTJoA_F20WnXDSYvPHBZvRV70B9aGk-DbSYMgsA9pK3TDbJlj_mOEY8ZXsVRVMYGcxzrmujd3OivCL_VC718d4JaTv1Ed4Kvgps
Frame ID: DA3510FD6AF54DDDC361FA0BCD0CC92F
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjG8_zbATAB&v=APEucNXg4LLDbFn4SefwSrscBejaC2SOJSnuYd0LG9Zpwz6319a6OiRuP7EiPt3KguUsZYBTgSJy068KiaiUKQy1iah3ycp3yDuwWfs6OJJZdymo840HYHMCjmoI1LahfuDrPxv237YiNWuBquApNdwAg9uH1G4zSQfEdrAaBDMErcK3g_bWapU
Frame ID: 02F7F214A72E00158D53466FDE09E0CB
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 05983831213FD7208AB11E42118D151E
Requests: 3 HTTP requests in this frame

Frame: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Frame ID: B08444D4F1C6A3CFED970B778676E488
Requests: 22 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 9C9B5505DA3AA980C9DF0AABAFCA676A
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C9037194B4E03B216D74F96980C34B2F
Requests: 4 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
Frame ID: 5F6FC0798605363214FAE7FDB3B5578A
Requests: 16 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
Frame ID: 19E25D31840823F377528666150C49E9
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 89D3BF1D8D4F66518C8D314D62F76350
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A3E33F319740B32FBD7923E0F771B40D
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: ABA827B70A33E455EA207A6E3C25C1CE
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js
Frame ID: B484A523B64BC30113D0492B0469539D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1859D372D1D58B4DC35B34F5F73FC203
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E9BFC15246AD2462D4065AFBDB5C661C
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js
Frame ID: DF9F5E8406E6389868550DC83111626F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Return of the Disaster-Class Hero Manga - [All Chapters]

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

450
Requests

96 %
HTTPS

55 %
IPv6

40
Domains

63
Subdomains

53
IPs

8
Countries

4598 kB
Transfer

10498 kB
Size

26
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 184

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEAGRtgV127Mlk978wTBsDQk&google_cver=1&google_push=Aa02lx_fIp0KTlcd5Td8unzqL5yMC5jl3UpLpsJjM1BLpFKmmlBS7fDBfatxxMe_UFy5GEZH6AzZFVewuFevHiRsucVzECRBftB-g-Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aa02lx_fIp0KTlcd5Td8unzqL5yMC5jl3UpLpsJjM1BLpFKmmlBS7fDBfatxxMe_UFy5GEZH6AzZFVewuFevHiRsucVzECRBftB-g-Q

Request Chain 185

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEN_1EIJ0SOiVIa6iKtb1F8M&google_cver=1&google_push=Aa02lx9QLw4FpmvZMTPEYr3I2h7lcdnrVxj_hspudaL6BErNN6WVn8umAU1uO037B1Q-vm5Aqu4JD6wpF3mQ4fp_QVsCaLdEuEXOYsg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE5MjU1OTMxNTc0ODcxNDY1MA%3D%3D&google_push=Aa02lx9QLw4FpmvZMTPEYr3I2h7lcdnrVxj_hspudaL6BErNN6WVn8umAU1uO037B1Q-vm5Aqu4JD6wpF3mQ4fp_QVsCaLdEuEXOYsg

Request Chain 186

https://d5p.de17a.com/cookies/google?google_gid=CAESEAGCmTmN50j371xGOBpbm34&google_cver=1&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se_rhGMl1Y HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEAGCmTmN50j371xGOBpbm34&google_cver=1&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se_rhGMl1Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se_rhGMl1Y

Request Chain 188

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKFzeTmf1fCBBhQL1XX265M&google_cver=1&google_push=Aa02lx_eL1QF2ejXTMXbXBj3yFqUJf-nJ3jR2zMD2YMtd5l0ARo9Yuj5DkymglsrPmbUoLjKhPDztOijtteh_stMGn0Cvecum4xuIw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TERCTUI0WlktVS1NQlo3&google_push=Aa02lx_eL1QF2ejXTMXbXBj3yFqUJf-nJ3jR2zMD2YMtd5l0ARo9Yuj5DkymglsrPmbUoLjKhPDztOijtteh_stMGn0Cvecum4xuIw

Request Chain 189

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESELPNVN78JZh_pxcyg5ctW24&google_cver=1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1674648215600 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-f41f8c48-9cc6-4627-aa0c-4edcd39376b8-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y%26google_hm%3DA_QfjEicxkYnqgxO3NOTdrg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y&google_hm=A_QfjEicxkYnqgxO3NOTdrg

Request Chain 190

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESENpqSFFbZ8_TWM2lf0pOFhA&google_cver=1&google_push=Aa02lx9Gm5HsNaC5_cYdmsrEz-HfEJrnHStSx3_EhUgSXonUSt9TliWLBtYPiV0dSIMUYspmmmgT0s2gwsPgTBTr1oOwh06iDkSMYtRv HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=Aa02lx9Gm5HsNaC5_cYdmsrEz-HfEJrnHStSx3_EhUgSXonUSt9TliWLBtYPiV0dSIMUYspmmmgT0s2gwsPgTBTr1oOwh06iDkSMYtRv HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 281

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1

Request Chain 282

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y9EamNcM3V8Avk1UwdegBQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1

Request Chain 283

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEKIS9mwx-HS-702BVlviMsU&google_cver=1

Request Chain 284

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTUxMDgwOTIxNTE0NDE2MjM3MQ%3D%3D

Request Chain 324

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1

Request Chain 326

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1

Request Chain 328

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1

Request Chain 330

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1

Request Chain 374

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJv4WDDigq8qet7tGguut0Y&google_cver=1&google_push=Aa02lx9ljnTR-wweU8-NA1MUQlYPuSl7rTXMgUF1K4RmERK8lN_35-27FId1Y6pQYh-U1IVi5cA738QxSw_GpXLTfw4xNZ7ADfM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx9ljnTR-wweU8-NA1MUQlYPuSl7rTXMgUF1K4RmERK8lN_35-27FId1Y6pQYh-U1IVi5cA738QxSw_GpXLTfw4xNZ7ADfM&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B

Request Chain 404

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF0tqKAGbjf7UCDUKpjxIes&google_cver=1&google_push=Aa02lx_nEuSmc0NoQaFutjq-V-iqisJ-aDOySWx_7LBDV1_HIoWUthD905XZROwQOS7mbHpWPr8AspN2NhzPSC6DSVfMiF7I8T0v HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx_nEuSmc0NoQaFutjq-V-iqisJ-aDOySWx_7LBDV1_HIoWUthD905XZROwQOS7mbHpWPr8AspN2NhzPSC6DSVfMiF7I8T0v&google_hm=gmYAOU-6n_nWlrnDUo9bjA

Request Chain 405

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJv4WDDigq8qet7tGguut0Y&google_cver=1&google_push=Aa02lx-LV8TRkdwy3BWizWKmGDKuBuApo5vEz2rJxupH8U8A2OTRbxGGgQkYXx_Jya8nZPIFsNMolStd2kLsPbojT9TyPQb3QCnR HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-LV8TRkdwy3BWizWKmGDKuBuApo5vEz2rJxupH8U8A2OTRbxGGgQkYXx_Jya8nZPIFsNMolStd2kLsPbojT9TyPQb3QCnR&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B

Request Chain 412

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF0tqKAGbjf7UCDUKpjxIes&google_cver=1&google_push=Aa02lx9W5dF-8cr6kCHkysf5d2Qz8Q6TdywoFZcGREHugmRrSkD-x_sW1fTZLXv0Zp0FIT2ASdapB5-p5xWj-vm7eZmn249qLDIM HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx9W5dF-8cr6kCHkysf5d2Qz8Q6TdywoFZcGREHugmRrSkD-x_sW1fTZLXv0Zp0FIT2ASdapB5-p5xWj-vm7eZmn249qLDIM&google_hm=gmYAOU-6n_nWlrnDUo9bjA

Request Chain 413

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJv4WDDigq8qet7tGguut0Y&google_cver=1&google_push=Aa02lx8tVlage-TUVJbyKMNhH6McISIXodPC0XcKWOURvf2gnZ1vE2dSJno8hPKEWF5Y8Jj3HrjHBYI5IsgZrZBrXK3NkK78rEJ4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8tVlage-TUVJbyKMNhH6McISIXodPC0XcKWOURvf2gnZ1vE2dSJno8hPKEWF5Y8Jj3HrjHBYI5IsgZrZBrXK3NkK78rEJ4&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B

450 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
returnofdisasterclasshero.com/ 154 KB
50 KB 158ms
86ms Document
text/html 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5cb702383dd5a7554ab4492cbcd649280b04c792ec2046a805f026eca3083558

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 78f0ddc58a372c00-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 25 Jan 2023 12:03:33 GMT
last-modified: Wed, 25 Jan 2023 07:25:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nZFyX4CEhKST5JyFpZalByLW6%2BxFvm6S3wtQoPr3WqZQusIY3Im4ZA0M5mxhphFA%2BoSvntHhJIXb9iUF8ucEIYqqXdiVHqUb2deuXLa2kPXN8Qh5p9LE3jAjfOP8NLjHJfANG8ddkyKYMlRUgNMV1PQ9v7HQl65JYop6IA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 jquery-1.11.3.min.js Show response
code.jquery.com/ 94 KB
33 KB 40ms
11ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.3.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: gzip
x-sp-metadata: HS256.CKXRxJ4GEp8BCiRiNmVmMWQzNy1kNDBkLTQ1NWQtYTlhMC1iYWQzYzA2ZDU5YjQQ+OiCoKvU+wIaBgiVtcSeBiIkMmEwMjo2ZWEwOmM3MWI6MDoxMDExOjhlYzU6YjY0ODo3ZDg2KKTBAzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiwIARIkODkxOTMxYTQtMDAxYi00ZWM4LTk2MmEtOGI3YzA3MDcxMGM0GO2DAiIYCAISFGNkczEyNy5mcjguaHdjZG4ubmV0.SbIWYnxo/hELiYt5jYu8q3fgLKGonPayrT6Lx8mKAUI=
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-176d5"
vary: Accept-Encoding
x-hw: 1674648213.dop263.fr8.t,1674648213.cds215.fr8.hn,1674648213.cds127.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 33261

GET
H2 200 style.min.css
returnofdisasterclasshero.com/wp-includes/css/dist/block-library/ 87 KB
12 KB 23ms
21ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-includes/css/dist/block-library/style.min.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 22:15:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3031
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C7sPgAD8b3yuh7sLgxJr9MP5xlBwxaiXtQhVfYRnRkQ8mOP7HMuMjhcsr2I3QagyWOfHgK4hHGMwXDzT28b0h15w1qwQKq3JhYkOuGf48QrZ0mY8bpGLUd%2B5xaOsxgsJXjmMohqAUniTtKI1rQN72ocG5%2BPmL4puMHNl3A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc61afb2c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 frontend.css
returnofdisasterclasshero.com/wp-content/plugins/wp-dark-mode/assets/css/ 28 KB
4 KB 20ms
18ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/wp-dark-mode/assets/css/frontend.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e880c8de639677c2ec0a2759d646fc8a6ff41245d648994176a8f1f22c0dcaf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 11 Aug 2022 22:15:09 GMT
server: cloudflare
age: 3031
cf-polished: origSize=28543
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v9nSn9LxxvVhzBEYuPNRNPreBPHtvGvAWUKN6BNlRD14hHnZe18uA4HTvqBWZPMxFoAyJGO00zndsTlMs8Wqh%2BNgU5D7wZej47V7%2FPuA92eVZ%2F7wNFwn9KCADeeQp%2FRNVrvlc5Ip1BMOi7RVoKpU6DeiRt%2B9f3pJKYCDDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc61afd2c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 bootstrap.css
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/css/ 119 KB
20 KB 26ms
25ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/css/bootstrap.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85651f9563a36aec7d188d222ec08b7fe8c90f982bd29fe69451f0494656f0ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 06 Oct 2021 01:52:34 GMT
server: cloudflare
age: 3031
cf-polished: origSize=124948
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cjqJQUEx4LTGxrUxmQwz3w8DvN4swBRdWXwjLV7ArEDy2PwLj7fHXZQvTvyd9P5lLrPqJ1OVYymSevVhhxvoQfQRfK3c1%2F4ra9gNE2bmtONAOYmrROLp4TCpQwMtmQx0OevLqWOJmhcbXemD5BNldvFr2Kur4qIKQWc5yw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc61afe2c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 style.css
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/ 23 KB
6 KB 21ms
19ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/style.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b177393bb52a27d045184e12b1bde8a164ebf8d12319003fe72cc36a2325f5fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 27 May 2022 16:49:16 GMT
server: cloudflare
age: 3031
cf-polished: origSize=24746
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NGGfF%2FWm3dzMUR20I%2FwNyLc8PFic1IX5hzGXIMjWEuRFx%2FXqNFV02GR9cgnBwKOQHftQpGijB%2BmkuhhICVBdXL7YAYpkfGSfO%2FGtSlOUotStS9kscPY3jZ1IifoBKLhlyXlNS7nqTX0x1bhAQoLDy5MOW0K2g6p%2FIom%2BWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc61aff2c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 font-awesome.min.css
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/font-awesome/css/ 23 KB
6 KB 19ms
17ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/font-awesome/css/font-awesome.min.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Oct 2021 01:52:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3031
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dEPGA%2Foek3PX86kwxZn8vPH%2F8cSyK0rg11d5aDjyGyApCO8YQmQxoIH0cRqi6djf78W6dOKvSsobLP6Ljg8c6JCPUEEKyzddw3EzR4qQEDj5wEuh%2BGWTvrSxD0gYip%2BqlJl7KvOpr7TkIpGor35GvwVVUI94GZ%2FWQLEbKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc61b002c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 46ms
21ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,300italic,700,700i|Source+Sans+Pro:400,400italic

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7d9e1488be90235f9cec4b6690a0184ee3215fb123469bc141b82699abb6bbb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 25 Jan 2023 11:50:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 25 Jan 2023 12:03:33 GMT

GET
H2 200 jquery.min.js Show response
returnofdisasterclasshero.com/wp-includes/js/jquery/ 87 KB
32 KB 24ms
23ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-includes/js/jquery/jquery.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Oct 2021 22:56:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3031
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AoJPCod5SPu1mRaY5VdnBTtoGBhENTP8feQIv46c5CRw%2BgTcIursO%2FmNLCaIHBM6kHB%2Fx4pvdDs2swEOeLjhOsCmjfcczVXeJE4d%2FViDl9J%2BSWp8fZAihMBhdTheaoCjuureTrcZY4Ka1ieWexfJAuhmDP00On2WpyhSTg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc61b012c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 dark-mode.min.js Show response
returnofdisasterclasshero.com/wp-content/plugins/wp-dark-mode/assets/js/ 60 KB
20 KB 22ms
21ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/wp-dark-mode/assets/js/dark-mode.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d230fa6c14bf1f2df177f38c46f0d091f90ea57753e36e035616a381bd43a2db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 22:15:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3031
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XAtPQOh%2FMTR9rF4efHfl60uB2x6WfEa5ArrtOlPhnPdikgAZEbaOM1vmGb0g06iL1RytlsxtjUPROcfwB1HJJ8WmAH%2FW0%2F8FbbWXhQJFCWt64QYxNZbtOBrLR1O%2FJ5KBoSO7XTtC%2BwWOyHEFR4FsM%2FnEZTvEQYWJSRtteQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc61b052c00-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
49 KB 88ms
60ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3190457468549923

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61d967df99ed6106c8a054df228d528cc714fbbb3be380501cd02f01de099cff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49880
x-xss-protection: 0
server: cafe
etag: 9999791609174216310
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 25 Jan 2023 12:03:33 GMT

GET
H2 200 agent.js Show response
cdn.purpleads.io/ 67 KB
20 KB 55ms
8ms Script
application/javascript 13.224.189.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-16.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 12542173538c65a44a029fc4ef9ba03f143e3319db24632336264bd4f50a4cd2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 10:07:11 GMT
content-encoding: gzip
via: 1.1 e0efba8a72628bfc3dc6d4d637b28302.cloudfront.net (CloudFront)
last-modified: Wed, 25 Jan 2023 10:06:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
age: 6983
etag: "3136c16ea19c50c97add868cea861475"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 19611
x-amz-cf-id: mtLNPpYprzX9h76ESOtU0loZ4xoT6caks-I7RunxNeDHX9DzuRVxRA==

GET
H2 200 ugaXQig.jpg
i.imgur.com/ 55 KB
55 KB 35ms
7ms Image
image/jpeg 146.75.120.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/ugaXQig.jpg

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

9e228c9570cf2d38a44e528040f24303e0cf87ba1dc5bfcc2720bcff90fd887a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
age: 2230688
x-cache: HIT, HIT
content-length: 55832
x-served-by: cache-iad-kcgs7200132-IAD, cache-hhn-etou8220085-HHN
last-modified: Sat, 12 Mar 2022 19:23:13 GMT
server: cat factory 1.0
x-timer: S1674648214.559079,VS0,VE0
etag: "1ee354f5adf652f1d57859dc32bdc87b"
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 275, 2

GET
H3 200 icons.css
returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/css/ 37 KB
9 KB 59ms
58ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/css/icons.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96eed42e394f5b00f1e02a12d1ce9557aae7cd751e4a9ae2b3e8fc392b1db945

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: REVALIDATED
cf-bgj: minify
last-modified: Thu, 03 Nov 2022 03:14:22 GMT
server: cloudflare
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=37491
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=odq%2BZKELzHALZrfNFaIQKRPSaIZ7XLmuGSqx826gfq9XT11OrP4WiukniQxqmLGvmvyHA4FJEmHR5n4sA8f4spAiH692FjdVlpb3bsVREcw6tBwknCR5PuC8d0OAibyOZTHlieyWhThp1xoA4SpUNGysFVWOMa9s1zKLBA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc66a2b90ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 shortcodes.css
returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/css/ 44 KB
9 KB 18ms
17ms Stylesheet
text/css 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/css/shortcodes.css
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1690266a4def354da2feda545468781eefe065dab28c28e115ef23160308206b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 03 Nov 2022 03:14:22 GMT
server: cloudflare
age: 7099
cf-polished: origSize=45539
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DnE55Lsmy48kgUVleV1lK1XJWzB7uM%2FTCft%2BP%2Fl9zjDI5qO6lc%2BvtWDrxVBxTI5Dl4iCYaYPmAfZOG9To8MutP%2FdzYvXL%2BOQ9gKquUhR9mMMWTUhb0fwJki%2BTtDHB3oEqmyOMTxGOlYK7rkmjBvOIar4yN6nGADwTLLGCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 78f0ddc66a2e90ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 underscore.min.js Show response
returnofdisasterclasshero.com/wp-includes/js/ 18 KB
8 KB 15ms
14ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-includes/js/underscore.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0da4791b446818516f710c51707081aec7b23a7c5212fc0b2629c973210136a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 22:15:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7099
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NBi2kcpNWJtm0RZUQ8BOdtG%2B3EkFp34qnOjVGDT5Fs3%2BhgsJHAciXGRIIr2mfLoGcajSy5%2BTbZ8cXIoPoTw7hx4vPHxQLf9s%2BwbjbQyyEctxgqKNxbn1kXdseyRHCNwOlu5NGUQUXmbNMMtGuWYtTKqU2eYxD1NA6BtImQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc68a6f90ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 wp-util.min.js Show response
returnofdisasterclasshero.com/wp-includes/js/ 1 KB
1 KB 16ms
13ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-includes/js/wp-util.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8e78b48acc08ce31457aff168d6fb2c814d51a8739a97693cdba585d60f5b35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Oct 2021 22:56:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7099
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1C6faxarFuzecRqhMZVhbanyygFbtfdIVaYV75j4oWCYzJ%2FeXqyINXyN9W1YK4KbmFjXVAANjSVOFdSbTFjadxy7%2FHgbT4dOFKPZ69jlOQv8PxdM10Junrv2M9eNT6xcRs2u7D%2FWc7fbphhFJtQprvG2o%2FZ%2BgGegykyOZw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7490ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 frontend.min.js Show response
returnofdisasterclasshero.com/wp-content/plugins/wp-dark-mode/assets/js/ 5 KB
2 KB 22ms
19ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/wp-dark-mode/assets/js/frontend.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36e5fb48cee849a51910344f29460662f8b5703dfa6102042122b47d081ca73d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 22:15:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7099
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nTXCt7B1hrM%2FhXe00G0lLvJN8YMwuKbj3%2FgVoQeFvLGpvmrO0gbT8MCk61V%2F1eOIIq8yh8drrl9RazOwpBYiSxqDYBDCSu%2FrkoN2ffPuFg5jow9O4ikDp03eXexqbjcqDsoBJTMm6Krw4n%2BEqIBhjT1Aj%2BRWgVf7RlnB3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7690ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 bootstrap.js Show response
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/js/ 36 KB
10 KB 23ms
20ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/js/bootstrap.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 835f79262dd6633b91d8bbfeb62f78afa60dbd0a40072b402c1d3ed2a6d4a410

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 06 Oct 2021 01:52:34 GMT
server: cloudflare
age: 7099
cf-polished: origSize=36790
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LJmxmPU2haeaC58CZcpQnZS3bBwCh0fmGqMLOHkOrw3OCXpvtZMghL7oeeK0anMrbrvfCy96EacpRrQGkqjVEv1%2BLf2UNEB%2BmKCsY90xbO3BxKraXaKEGAo%2B%2BGRFZxq1PbAXTMbC%2Fv5Ofnm6s6oz0I57GJ98G8i1CIzmUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7790ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 skip-link-focus-fix.js Show response
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/js/ 588 B
794 B 24ms
21ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/js/skip-link-focus-fix.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2ff39ccfc80daf66110e4b104956bc70911dec5c51764de1c19422439a34ba5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 06 Oct 2021 01:52:34 GMT
server: cloudflare
age: 7099
cf-polished: origSize=751
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hLEFdLW1s%2BAzHTSV36K9dbU1S6BMkKNuO38mOv5zpl%2FXyfnkHoedB%2B0CG%2FWYHaKATkh2w%2BKNHZF1N8ObAdnZJwJlhrJLC0r19HPzgjEAHFWLPuOfgYLalpsuAs%2Br0fvaz3dlCbauW%2BMkoX7DoaK%2BvW0wVaO5Eh4yrWTfpw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7890ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 lighthouse.js Show response
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/js/ 1010 B
857 B 27ms
24ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/js/lighthouse.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 110c7932b78e1f27d049f7a3718b9099a8aba3fba09a65e7e22d771661c58022

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 06 Oct 2021 01:52:34 GMT
server: cloudflare
age: 7099
cf-polished: origSize=1100
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BFTO09MZpgCVV8iG3297hBLMuFIU18Hos98XPb51TF1tPmgcXsxPigr3bowMQ7VLw6fUyOwJ8jIjadnkQu3gYCOXQk7jl2%2B7wu%2FC%2BAxlJMDzwP2QQXto6RWTxLK2yc0oOhpP4aU2A2T6yD90M0L725QyWnGZCcbOaA%2FUnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7990ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 48ms
29ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1260
etag: W/"ae63ef8ff03da61fffaa7f165729897a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 78f0ddc6a9389bac-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 28 Jan 2023 12:03:33 GMT

GET
H3 200 index.js Show response
returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/js/shortcodes/ 15 KB
5 KB 16ms
13ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/js/shortcodes/index.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 340360366739b1523bc21f969f4a95b9dd94014c07afa9d4789f639b54094d24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 03 Nov 2022 03:14:22 GMT
server: cloudflare
age: 7099
cf-polished: origSize=15792
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rI4Lv%2FbGD4WegK5rl0Xh0Kf3mPL9y6YGbOr%2BvVLctUkP%2FYtC4ccnlkh1FCOkMpKD6Y6vglWAECSod5nrvF87jSw%2FDpRs%2FV1428X8IJlRjS6lvQqggbn9uJvQqm9X%2BsdgOVyx4Vc%2FSrnrQGn6iuvb918Oyzv5dTSUgdQosw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7a90ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 lazyload.min.js Show response
returnofdisasterclasshero.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/ 8 KB
3 KB 24ms
22ms Script
application/javascript 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 06 Oct 2021 01:52:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2660
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rKQBjQR9sY%2FC38drHb31rWrKet3wobiEnB26n0xfDd7syeSXIp9575%2BRohzMlh4ZNr7NEMRgGZfALGXDI9fLHF54HI3sl7qmha8zzIZlCP3ik%2BOwZ4bDiv352pYx9Nj%2FmolM3Ld4MayAZCulL8Cl38CXibq2EvubXAbf4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 78f0ddc69a7b90ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 25 Jan 2023 10:26:10 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 5843
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Wed, 25 Jan 2023 12:26:10 GMT

GET
H2 200 wC Show response
silentinevitable.com/cHDh9L6/b.2N5fl/S/WJQ-9CNlDKYkxzO/TVUG1_OFSb0Y0/NWjSEd5LNITnY/ 0
450 B 91ms
33ms Script
application/javascript 2a00:1178:1:4b::1a
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

https://silentinevitable.com/cHDh9L6/b.2N5fl/S/WJQ-9CNlDKYkxzO/TVUG1_OFSb0Y0/NWjSEd5LNITnY/wC

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

2a00:1178:1:4b::1a , Netherlands, ASN35415 (WEBZILLA, NL),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:33 GMT
x-content-type-options: nosniff
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 0
expires: Mon, 26 Jul 2011 05:00:00 GMT

GET
H3 200 New-Project-29.jpg
returnofdisasterclasshero.com/wp-content/uploads/2022/08/ 175 KB
175 KB 16ms
14ms Image
image/jpeg 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://returnofdisasterclasshero.com/wp-content/uploads/2022/08/New-Project-29.jpg
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b46567af498cc5d9c06c3f03bdb3db3b9ca14bcda9625f864b57192f90bede08

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 22:13:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7099
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RgXMZ%2FWNFeDgdbM9LLbto8a5wUpVSwW82EeYwXIfsZJlUq22kuWUugMJMVxvrBarRcL%2FhpnIRD03wMOx5tBD%2FfbcFO7bEKNNGmOjXPoqo13XK0J4o%2BodP3LKzCjmksVkf7nloo0WtB0OXtxl%2Be4mOrs2omuPotj%2F%2FB0wuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78f0ddc6dadd90ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 179000

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
23 KB 33ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300italic,700,700i|Source+Sans+Pro:400,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 04:30:41 GMT
x-content-type-options: nosniff
age: 199972
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:56:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Jan 2024 04:30:41 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ 23 KB
23 KB 39ms
13ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300italic,700,700i|Source+Sans+Pro:400,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 11:05:12 GMT
x-content-type-options: nosniff
age: 262701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 22 Jan 2024 11:05:12 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ 13 KB
13 KB 40ms
15ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300italic,700,700i|Source+Sans+Pro:400,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 17:43:57 GMT
x-content-type-options: nosniff
age: 152376
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Jan 2024 17:43:57 GMT

GET
H3 200 forkawesome-webfont.woff2
returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/vendor/fork-awesome/fonts/ 107 KB
108 KB 69ms
68ms Font
font/woff2 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/vendor/fork-awesome/fonts/forkawesome-webfont.woff2?v=1.2.0
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/css/icons.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8810ba3440bf482ced33d2f74b7803bba711f689d8e4caa7da5c6ae6844a1b49

Request headers

Referer: https://returnofdisasterclasshero.com/wp-content/plugins/shortcodes-ultimate/includes/css/icons.css
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
cf-cache-status: REVALIDATED
last-modified: Thu, 03 Nov 2022 03:14:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xUlNztHVwYHyrZU8MsqRpH9nRVTjWV0hYfZzVSOnsrvWNYb%2BMZkV%2BU8zio9jaku7vDacAX46gKRmC7Xh1GSzbblJ4r1mcjI1RYVGHVAQ2c%2FIm2LrXuzVA%2By%2Flk%2Friu4xg8uy8Syys3wwB934llV9TbEf4wYA%2B5tjS76BTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78f0ddc70b0290ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 109916

GET
H3 200 fontawesome-webfont.woff2
returnofdisasterclasshero.com/wp-content/themes/Ifenzi/font-awesome/fonts/ 55 KB
56 KB 57ms
56ms Font
font/woff2 2606:4700:3035::ac43:da9c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/font-awesome/fonts/fontawesome-webfont.woff2?v=4.3.0
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/font-awesome/css/font-awesome.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::ac43:da9c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Request headers

Referer: https://returnofdisasterclasshero.com/wp-content/themes/Ifenzi/font-awesome/css/font-awesome.min.css
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 06 Oct 2021 01:52:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2BevtELhqUHakd0yvVin1%2F2jC6o5bc9xB5Fvdp9943VUp8MzckTVNe3zXZjKuy0tIqZmnTALZJb1lHcP7TZx6n4uON26O7v3Jz3Cuu5pLxKlWsUsXq%2BuwkgnpJUok4PDMRtTwdGu%2F5i%2Bf7AxvFlDJfKJ4mFsLkKPSfFOyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 78f0ddc70b0490ef-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 56780

GET
H2 200 S6u9w4BMUTPHh6UVSwaPGR_p.woff2
fonts.gstatic.com/s/lato/v23/ 5 KB
5 KB 18ms
17ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v23/S6u9w4BMUTPHh6UVSwaPGR_p.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300italic,700,700i|Source+Sans+Pro:400,400italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ef7cd3d4ed7de91e7eb3c05a31c6fa1da0b08d07cbfab8ae108c34d5e39cdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://returnofdisasterclasshero.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 17:13:10 GMT
x-content-type-options: nosniff
age: 67823
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5368
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:56:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Jan 2024 17:13:10 GMT

OPTIONS
H2 200 init
api.purpleads.io/x/ Frame 0
0 313ms
98ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/init?ts=1674648213788
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:34 GMT
x-request-id: 72b8c2fa-43d7-4a8f-afc8-318bd77e7a09

GET
H2 200 init Show response
api.purpleads.io/x/ 88 B
390 B 423ms
225ms Fetch
application/json 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/init?ts=1674648213788
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash: 3b8c82e1a32337e150164886ef2dd2761fc41c86ee4f6f98b6b3bc408623fc81

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
etag: W/"58-xHfpdyWesQspKgt99FMxHrYL2p8"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
content-length: 88
x-request-id: 5fb348fd-b8f8-4b15-b54a-1deea0c54df1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
216 B 15ms
14ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=947273758&t=pageview&_s=1&dl=https%3A%2F%2Freturnofdisasterclasshero.com%2F&ul=en-us&de=UTF-8&dt=Return%20of%20the%20Disaster-Class%20Hero%20Manga%20-%20%5BAll%20Chapters%5D&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1982178400&gjid=1839639623&cid=1207468414.1674648214&tid=UA-222744437-1&_gid=1895677716.1674648214&_r=1&_slc=1&z=1551702683

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 25ms
24ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1260
etag: W/"2f96824aee4bf927e734cc519e3e726d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 78f0ddc85c789bac-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 28 Jan 2023 12:03:33 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301120101/ 359 KB
118 KB 99ms
83ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3190457468549923&plah=returnofdisasterclasshero.com&bust=31071718

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3190457468549923

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b03a4365b0142950c3af8f381502635ac094e23d885b03a4ac0cec1acfc8cb0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120764
x-xss-protection: 0
server: cafe
etag: 748942625028598723
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 25 Jan 2023 12:03:33 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230123/r20190131/ Frame 2A56 10 KB
5 KB 97ms
25ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230123/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3190457468549923

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11149
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:57:44 GMT
etag: 10353107486223812946
expires: Wed, 08 Feb 2023 08:57:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 web Show response
onesignal.com/api/v1/sync/d494430b-244b-4ac6-a9fc-03427f312779/ 3 KB
2 KB 58ms
57ms Script
text/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/d494430b-244b-4ac6-a9fc-03427f312779/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c668f8859313a4e2dfc5109eab8a4348944e3e5ffbd1c631556848f6936d6767

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 1a18822c-08a6-4dea-8877-be40a5527fd4
x-runtime: 0.022469
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"c668f8859313a4e2dfc5109eab8a4348"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 78f0ddc8fdc69bac-FRA
access-control-allow-headers: SDK-Version
expires: Wed, 25 Jan 2023 13:03:33 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 21ms
21ms Stylesheet
text/css 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:33 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 3356
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 78f0ddc96c3d9186-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 24 Feb 2023 12:03:33 GMT

GET
H2 200 / Show response
api.purpleads.io/x/b/ 3 KB
2 KB 363ms
216ms Fetch
application/json 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=0&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=84216a3a-dc92-43c8-b6b3-c95c77aed010&ts=1674648213999
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash: ab2c9ac63fdeb298fee5e857c1e2cedcfd86507345de7d8eb02197791389dc0c

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
pa-user-id: 141b39a4-56a7-405a-977a-23a00026bd18
etag: W/"dc5-V2YMWmBvm+aryrnCxYKosx2cTmA"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
x-request-id: 166ddb23-8e76-4c44-8aa7-3b1a6b9191d9

GET
H2 200 / Show response
api.purpleads.io/x/b/ 3 KB
2 KB 350ms
169ms Fetch
application/json 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=1&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=802e4755-465c-4ad0-a2a4-7ab1b51e2033&ts=1674648214000
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash: 6c11366720a04c3215987caeea1295ef63e8d5c9c1dd28d7fcba12fc2469b9d4

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
pa-user-id: d3ece7b4-4431-4868-b3c4-8d26d0509211
etag: W/"dc5-dZYHW9e5Q3mkNejiIw61obvZTZE"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
x-request-id: 80ce96b5-f24d-4f7d-aab6-6c975b25de0d

OPTIONS
H2 200 /
api.purpleads.io/x/b/ Frame 0
0 151ms
149ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=0&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=84216a3a-dc92-43c8-b6b3-c95c77aed010&ts=1674648213999
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:34 GMT
x-request-id: 7ad06dd8-b78e-41e4-abbd-7acb5ae48010

OPTIONS
H2 200 /
api.purpleads.io/x/b/ Frame 0
0 117ms
115ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=1&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=802e4755-465c-4ad0-a2a4-7ab1b51e2033&ts=1674648214000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:34 GMT
x-request-id: 32708d8f-af2c-42ab-9874-1c54956a38aa

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/d494430b-244b-4ac6-a9fc-03427f312779/ 184 B
578 B 62ms
47ms Fetch
application/json 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/d494430b-244b-4ac6-a9fc-03427f312779/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9a363407218fa3804565855e7885286a7cc1068188a33638874062968e7a250

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 93ca8e9c-321c-4475-9cc0-e4d6c3ea11dc
x-runtime: 0.006042
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"b9a363407218fa3804565855e7885286"
x-download-options: noopen
x-frame-options: SAMEORIGIN
vary: Accept, Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 78f0ddc9fa2e5bf5-FRA
access-control-allow-headers: SDK-Version

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 425 B
619 B 40ms
16ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=returnofdisasterclasshero.com&callback=_gfp_s_&client=ca-pub-3190457468549923

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301120101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3190457468549923&plah=returnofdisasterclasshero.com&bust=31071718

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a76aa393d6137493a19b5b34e4fe42f2af0dd2987815eedb9be47483355ff4ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 267
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 57ms
17ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 115ms
45ms Script
application/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 109ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&tn=NAV&cls=navbar%20lh-nav-bg-transform%20navbar-default%20navbar-fixed-top%20navbar-left&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 55E4 130 KB
21 KB 379ms
378ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&adk=1812271804&adf=3025194257&lmt=1674631548&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&plas=140x945_l%7C140x945_r&format=0x0&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648213875&bpp=5&bdt=423&idt=257&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=932973055409&frm=20&pv=2&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=286

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6546d25626026e24a037df961acca9a80bfd5ce00985f7681db5c6642aaa2be7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 21658
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:34 GMT
expires: Wed, 25 Jan 2023 12:03:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4e9b3198-c1b3-4711-b53b-5ca25c4f7c13
img.onesignal.com/permanent/ 98 KB
98 KB 411ms
395ms Image
image/png 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.onesignal.com/permanent/4e9b3198-c1b3-4711-b53b-5ca25c4f7c13

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92d3a001fdba54825896074c47c9d3283c2cbbac5b470efc9c4037e9bb543041

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
x-amz-meta-cache-control: public, maxage=604800
cf-cache-status: REVALIDATED
strict-transport-security: max-age=15552000; includeSubDomains
x-amz-request-id: 8B8YZ78XN88ZEJ4P
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 100011
x-amz-id-2: k+lWjAS443tdwW7n/0EnJED+f3tOepcmru4nWMcHW/BTOG6MILmO0fu2tXkBon45YHA84dtyzA4=
last-modified: Sat, 12 Mar 2022 19:31:32 GMT
server: cloudflare
etag: "5619dcacb1e99641c5bfc623974f50d5"
vary: Accept-Encoding
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 78f0ddcaa94e9bac-FRA
expires: Sat, 25 Feb 2023 12:03:34 GMT

GET
H2 200 prebid-2023-01-25.js Show response
cdn.psdn.xyz/ Frame 3CA4 359 KB
117 KB 92ms
9ms Script
application/javascript 205.185.216.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.psdn.xyz/prebid-2023-01-25.js

Requested by

Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

205.185.216.42 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

5cc82541728ac4b6bb4a5d544f009c7004db65a48fed2552ea19604aad007e76

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
last-modified: Wed, 25 Jan 2023 08:39:03 GMT
x-sp-metadata: HS256.CKbRxJ4GEokBCiQwMTMxODg2Yi1mY2MwLTQ3MzEtYmEyMS1mNWVjZjEwYmI5ZjMQgMGmkNnD+wIaBgiWtcSeBiIOMTM4LjE5OS4zOC4xMzQoqNACMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogM2U5YjIwNjEwMDk4YjZjOWJmZjk1Mzg1NmU1ODAxNmEaLAgBEiQ2ZDc2ZGI4Ni05MjYxLTQzZDgtOGFkNi03YzZlNTE4ZTFkOWIYpqUHIhgIAhIUY2RzMjczLmZyOC5od2Nkbi5uZXQ=.GBgvOFTgp3fefSsrqraDz4dtfUsXZH76IiXYvP0eG+0=
x-amz-request-id: tx00000000000029710af24-0063d0eaac-34c6886a-nyc3b
etag: "a77d424b9b6e1c7570d6a0db5b34b30f"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1674648214.dop267.fr8.t,1674648214.cds241.fr8.hn,1674648214.cds273.fr8.c
content-type: application/javascript
x-rgw-object-type: Normal
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 119462

GET
H2 200 prebid-2023-01-25.js Show response
cdn.psdn.xyz/ Frame A2D5 359 KB
117 KB 47ms
24ms Script
application/javascript 205.185.216.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.psdn.xyz/prebid-2023-01-25.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

205.185.216.42 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

5cc82541728ac4b6bb4a5d544f009c7004db65a48fed2552ea19604aad007e76

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
last-modified: Wed, 25 Jan 2023 08:39:03 GMT
x-sp-metadata: HS256.CKbRxJ4GEokBCiQ4YWZhMGJiMi0xYTdlLTQ0ODAtOTY3ZC1kOGExZjBhZjUwYjMQgMGmkNnD+wIaBgiWtcSeBiIOMTM4LjE5OS4zOC4xMzQoqNACMAM4BEIWVExTX0FFU18xMjhfR0NNX1NIQTI1NlogM2U5YjIwNjEwMDk4YjZjOWJmZjk1Mzg1NmU1ODAxNmEaLAgBEiQ0MDJhMTI1Ny00Y2NhLTQyZDQtODMyOS00Nzk4Zjc1NTVmZjcYpqUHIhgIAhIUY2RzMjczLmZyOC5od2Nkbi5uZXQ=.sKiAP7K9Cth6aQmUfz17CEb3Zfm44j3r7BC0dBLvRlM=
x-amz-request-id: tx00000000000029710af24-0063d0eaac-34c6886a-nyc3b
etag: "a77d424b9b6e1c7570d6a0db5b34b30f"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1674648214.dop267.fr8.t,1674648214.cds241.fr8.hn,1674648214.cds273.fr8.c
content-type: application/javascript
x-rgw-object-type: Normal
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 119462

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301120101/ 150 KB
51 KB 76ms
76ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202301120101/reactive_library_fy2021.js?bust=31071718

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1de9e0d07a06da2a53b03c2b9072024cd3525253982add347b165c1d5f614cc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52151
x-xss-protection: 0
server: cafe
etag: 6951401933239779586
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 Jan 2023 12:03:34 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 18ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 46ms
46ms Script
application/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0565 99 KB
35 KB 468ms
467ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&h=280&adk=3903388278&adf=3964591440&pi=t.aa~a.422568436~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1674631548&rafmt=1&to=qs&pwprc=6017413186&format=960x280&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648214615&bpp=3&bdt=1163&idt=3&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&prev_fmts=0x0&nras=2&correlator=932973055409&frm=20&pv=1&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=160&ady=2943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qh7MhSu5xX&p=https%3A//returnofdisasterclasshero.com&dtd=14

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

94f832a19fa507de1dac4e2a0cf8d775ed005c329bd5227615d063ad517752da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 35407
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Wed, 25 Jan 2023 12:03:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 /
api.purpleads.io/x/b/ Frame 0
0 100ms
99ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=2&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[970,90],[728,90],[468,60],[320,100],[320,50],[300,100]]&slotid=3781e417-dad0-448b-bb77-8e47c8d7c905&ts=1674648214662
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:34 GMT
x-request-id: c2437c62-5b69-433b-84a4-0d533a21db7a

GET
H2 200 / Show response
api.purpleads.io/x/b/ 2 KB
2 KB 164ms
164ms Fetch
application/json 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=2&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[970,90],[728,90],[468,60],[320,100],[320,50],[300,100]]&slotid=3781e417-dad0-448b-bb77-8e47c8d7c905&ts=1674648214662
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash: a7da90a6886dbe0df271f68772eef1e99ebab218c06e9a900cc586f0400d9ba8

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
pa-user-id: ec468dcb-5055-4ee4-bf10-b23090b38e6a
etag: W/"9fa-KcXKJ4oVUKF1rc+L0GF0iBVyZys"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
x-request-id: 0094e41d-6d81-44c1-a69b-fd793443dbf5

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame 3CA4 483 B
1016 B 33ms
15ms Script
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Wed, 25 Jan 2023 12:03:34 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Wed, 23 Nov 2022 15:43:18 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 494957
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1CM0QRl3DJ%2BVOj73PH9oLBmR5w3naiI0aL0c9qFvygC%2FnmHAZOlRmyG7A0fs88JZaRBC5ihZG1LMtEOTz3CUzEQP57skGnqZz6Ryg2KwAfBOGD1fRwIGdpsGnVxWgABrA3n69zTSO4Qo8L98"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 78f0ddcdef3f9bc2-FRA

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame 3CA4 1 KB
980 B 167ms
118ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU2BX48Z
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 83c079e782cdd3b2edc325e9a5c8e7a67f4cd381d3c5f4eb79d3abd2cdb2de0e

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Wed, 25 Jan 2023 12:03:34 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 3CA4 0
231 B 61ms
32ms XHR
text/plain 2a02:2638:1::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.33.0&cb=11942196731&lsavail=1

Requested by

Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame 3CA4 0
192 B 84ms
16ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:34 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 3CA4 138 B
961 B 45ms
14ms XHR
application/json 185.89.210.46
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

36bd895003fb4975ffdaf712c3af10df02078bfe8848ed1922c14878f6cacb68

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 25 Jan 2023 12:03:34 GMT
AN-X-Request-Uuid: f0af7f5b-8dc7-4605-a062-576653410cc4
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://returnofdisasterclasshero.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 138
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ Frame 3CA4 0
179 B 57ms
17ms XHR
text/plain 147.75.85.234
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.85.234 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Wed, 25 Jan 2023 12:03:34 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2

POST
H2 200 adreq Show response
ads.servenobid.com/ Frame 3CA4 468 B
624 B 101ms
31ms XHR
application/json 52.211.92.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=5018
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.211.92.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-211-92-106.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 76376278e4b868bf151dd8258598809c0ea5d932743a7f12833112d09ba8b5ec

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 prebid Show response
mp.4dex.io/ Frame 3CA4 114 B
191 B 122ms
104ms XHR
application/json 2a06:98c1:3123::
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3123:: , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c26af84a7972616bc72fb4c63097580f28f1ab28c755e71396971416bdffa901

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

x-version: 3.0.0-gcp-ams
date: Wed, 25 Jan 2023 12:03:34 GMT
x-err: Shapings: no adunits with size and seat and mapping
via: 1.1 google
cf-cache-status: DYNAMIC
content-encoding: gzip
x-warn: Process Floors. 2 inventory rules not found for mediatype: banner and adUnitCode: gpt-passback, Process Seats Booster. unable to get the seat booster engine for organization: 1263
pragma: no-cache
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 78f0ddce18782bca-FRA
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ Frame 3CA4 15 B
377 B 59ms
41ms XHR
application/json 51.75.86.98
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.75.86.98 , France, ASN16276 (OVH, FR),

Reverse DNS

ip98.ip-51-75-86.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://returnofdisasterclasshero.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ Frame A2D5 483 B
1022 B 13ms
12ms Script
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Wed, 25 Jan 2023 12:03:34 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Wed, 23 Nov 2022 15:43:18 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 494957
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3n%2FQDPeoQZdPwSieErnwpz%2BBme1bhaBtDG9nT31%2BOOoxniLZGWQT%2BbxlTmqtxjIQz5jQCYI5bgZ9BSHt2tuhLOr3bBsVNOhcCPE9p8CW5pR6X92II2vC1OZSyx5tn9Otsnvr0FGnjpK%2FKnEx"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 78f0ddce0f719bc2-FRA

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/ Frame 74A3 10 KB
4 KB 23ms
22ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11404
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:53:30 GMT
etag: 10353107486223812946
expires: Wed, 08 Feb 2023 08:53:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/ Frame 7E6C 10 KB
4 KB 25ms
23ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11404
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:53:30 GMT
etag: 10353107486223812946
expires: Wed, 08 Feb 2023 08:53:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/ Frame B3BA 10 KB
4 KB 24ms
23ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11404
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:53:30 GMT
etag: 10353107486223812946
expires: Wed, 08 Feb 2023 08:53:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 prebid Show response
mp.4dex.io/ Frame A2D5 114 B
592 B 39ms
39ms XHR
application/json 2a06:98c1:3123::
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3123:: , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a93c90b4e3ca866781992d8b1ba96ff92fd1ca501d97e8a2f97a04a1c9f0d202

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

x-version: 3.0.0-gcp-ams
date: Wed, 25 Jan 2023 12:03:34 GMT
x-err: Shapings: no adunits with size and seat and mapping
via: 1.1 google
cf-cache-status: DYNAMIC
content-encoding: gzip
x-warn: Process Floors. 2 inventory rules not found for mediatype: banner and adUnitCode: gpt-passback, Process Seats Booster. unable to get the seat booster engine for organization: 1263
pragma: no-cache
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 78f0ddce59052bca-FRA
expires: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame A2D5 0
230 B 56ms
55ms XHR
text/plain 2a02:2638:1::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.33.0&cb=56069106200&lsavail=1

Requested by

Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame A2D5 138 B
961 B 26ms
26ms XHR
application/json 185.89.210.46
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

fe71418a9f39fea16ad4a058d80c182b70fd3b81a310bc9bce0ddbcb36dbd82f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 25 Jan 2023 12:03:34 GMT
AN-X-Request-Uuid: ef8de3c1-6538-412c-8830-601bf090041b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://returnofdisasterclasshero.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 138
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ Frame A2D5 0
20 B 14ms
14ms XHR
text/plain 147.75.85.234
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.85.234 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Wed, 25 Jan 2023 12:03:34 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 200 adreq Show response
ads.servenobid.com/ Frame A2D5 468 B
623 B 54ms
54ms XHR
application/json 52.211.92.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=6007
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.211.92.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-211-92-106.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 76376278e4b868bf151dd8258598809c0ea5d932743a7f12833112d09ba8b5ec

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 prebid-request Show response
onetag-sys.com/ Frame A2D5 15 B
376 B 35ms
35ms XHR
application/json 51.75.86.98
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.75.86.98 , France, ASN16276 (OVH, FR),

Reverse DNS

ip98.ip-51-75-86.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://returnofdisasterclasshero.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 prebid Show response
prebid.media.net/rtb/ Frame A2D5 1 KB
686 B 116ms
115ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU2BX48Z
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5a42d00832679359932e0dc8aa8a93a2731f7f626a8c55641fb560cf695d6ea3

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Wed, 25 Jan 2023 12:03:34 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ Frame A2D5 0
191 B 16ms
16ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.psdn.xyz
URL: https://cdn.psdn.xyz/prebid-2023-01-25.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://returnofdisasterclasshero.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:34 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame EFCB 167 KB
53 KB 121ms
92ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOAKsoeEAAfVH2wt0E5nzLk0QWLXjg&u=%7C7Pm5Wog6nkd9ubvoX2mZ1k8LFVpcNs11oeOwnWOytEg%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_T4U3ERXQAMafMI0At8H8tIXNA50hUfvRil2-hkb2Ar4coqfQCEAQm2spJolaDNE5lmk0EEJ3MUbxgIkPC1hCBA1qM7pKHyI_ohDk5kdQdwZs6ysSONcre-NLWTAEN3IuiDYek4iVIWgjh-Cr5v6h-F4K-Bp7NbGKHX44NoRt1WGq53DJKD5q50xqfKt9tF0qlscuaqXeEOPwv5QXX_-KFMND5rkq5dsNmL6uTQA88E544zIA4BrTDxqJSY6cBHFsugCazH8_VcMwtpDHvrO8J3pGdmXBGHdj3flw6q01oTqsxy8NXDUu1urX5Cw0KqNduO49L2LuGbSRrWLD1UpGpDDOqEWs77yHoOKFZ1iGkKfgr9o4TfV2pow4hP9X3UUJHQ4b_2k66h6Ma6K9kRImTneFFdEnse3Q2YeGlNQkK478Huq7Yiy-_p3xunYcBbAd-iF6XNKNpIcMDgcXlBL4db9zxX6EP_BnWkKQu51dGkFvp-WO2FXfhfRmPDkPY8MjxLSLVZW0VIs33yeXsstqMMDlZy-ZQMiHSxu1QsNX3ekUMVYSkGeBbYo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCF53flhrRY-CxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIUCT9CeEwX-7V3OFufZN23rBjYBmHGfQXIzUpnX9hjQMZ53UvPHEl6FnN3cR-DwqS-fcuX2mwpNI2x5AanlfRzStrIo5B9y74pjRBvxofskxkAq2S9xyfL0oSNGZhWehJxSVmUiNFp3YLLMGCQHmD_lw7xCfy78QXbOIAWGBS3F62Wh7P9VqiNyxQmY-sAfz4k3NtrLw8ExdLyvafAoibw9tvYy5gPoYzeqpIPo5MyMIeWHYbg_sZ-XoS9KdNBGCHqDXopN2xsPUPVpG3rmxf0D_MGFY12yu1NhBm4J3vpeT9PeFP7e_-43OoObx15ydPeakcVL8IKy0ZE073CZa8GDThcNYyNEgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_38JjKuZrd0EzH7Mvw_ME-wX24KaQ%26client%3Dca-pub-3190457468549923%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

427b2be8291d45cfe36c8fabf11df7cf4ac2b690d0c3e56c00de12b24f9e5ab0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=dPLUEXv_iaMsRGkxC7MF8NKehFKQcIarHlal12Oh_YOWU8xeo5nhRL3Hj1ur0VokdzSYwEiA--LIeUZo53jEzM9GX2JkvB7oG2B6mnugURVdYbr1FWhaXMiavFz4vn6-d1k_okZJ3oVJ5h2RtDhErWJThoSP4rUnH7BW2bOp2N0qjZJoWKCJL6h-dUhLR4vWoUY_TSfucHlreruxZlCha2zZmg1ZkbSJTrXa3giGgYtBLoz4zcscZMOU9LE"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 70467168
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 74A3 3 KB
1 KB 113ms
40ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11009
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 74A3 18 KB
8 KB 97ms
24ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11008
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 74A3 156 KB
48 KB 45ms
23ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:34 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 893E 210 KB
59 KB 184ms
163ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOEKsoeEAAfVH7Mfo04rJJyxvcS-Ag&u=%7C7Pm5Wog6nkfeR4%2BUjrrYPOD6RDhcvKl%2FXgQNUA4AotI%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_T4U3ERXQAMafMI0At8H8tIW92GoAMeffWC3JrvEAWlaL-NPREbmAU35de88Lx7J0Bcs-dmICAOIPQnYgOItglIGxvtJS1LNW-IvqDFcGowJFYHFBv6ZoVIEhDXC0mn2QuPwZVbP3TR7iJXmgu-cmMP8_y1zHgZvgmMydhXPRZQhetwM-f6VLghMuoM14P75AhnM2K7YQpwtHPdz3ScVnn4Gy4UxMgT02KQRwTVzKrnK8Gh19eM_Mos0Q7KW9STgaW6Q5vpmnGYKNKTko9rVhtymhuA_7VQkQOXuEW06ittiTMqXuuNYybRrY48t81JZW82wGS1kv6jMn0VO7ez22bKKbxI4GRHL9LrSskHZ5yVt8qtF2MUen6zIVZd8xy0xHN4XVQm4UEBBGhg-w_n4a5t-owRMZE4Ip5FED1b872cI41eNhSIlFiPxAv96wH76dAYcOR3U5dsou2mYmF0wKOhiR5X_oFy9GVUpBLD8aFbNyUWnht7p_kBjXm6Ja9grdEGqtiJZIsuhkL2Q4Z3yFIRNAi9OkxIX0FgrlrzHkNOGj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCjSyklhrRY-GxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIUCT9A28WQ6uRHciRF4MflPvwnI-SYNs5wHfs4ganTcHXCN7DHy31jBYTpe62G-T1lTF8Gtewlxssdvn2gvduqIOIcujJTzlVPOijNjsfuX5J-wq0WgOkYeeFw40qNjJS46dRruCyndy-deeviJBEG3G1h_Hqlvm-JtJQCyJ62Umm3HKqNKVAmN0ef2vq7c6noPDBE0kwmr1qYSKRfmEzBm91CZ-Jijc6BPHFR9MvQJjklzObdxXACxprkU4Cfhbc4u6D-Q_DJ6yhWv_jKBwl5NYpoYeEnaIlsp9_srp4KYn4NSVt0loyLUQAJeAFKbS9Ubo6o8AcQ4bD6cOwAFlFAyehwOGEsbgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0Jz8JN2-qSIZh_4jYa8efwLIIcjg%26client%3Dca-pub-3190457468549923%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4f914a87cc3c1cc1c7350e318ae9a4ac08a5141abb0f165022d41d2be355197f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=0mTxJHv_iaMsRGkxEPWqNolkiRZEP-BfpZbKuUq0KTkOJbVQM0-HaSFYQeCid2WYKLGjPzDal6S9nmXPVfOagkwhoYYEI4YfK4_KZQXc-Kg1cmic7QYCNFA7pt0Q43-QRt2_rsZghHqffCx0shmN3gATEU83EzUo2BR4eVrFUyHGoUT5WNUxGr9N_dthKt9oWp84r364ehweT4DdAIg-80T-jgBUmYhcEv2x9fT3QhcrwVUgyowlYoSyJII"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 138305968
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 7E6C 3 KB
1 KB 110ms
46ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11009
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 7E6C 18 KB
7 KB 91ms
27ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11008
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7E6C 156 KB
48 KB 54ms
40ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:34 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B3BA 0
0 65ms
64ms Fetch
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CfskilhrRY-KxDISPygWfqp_AAsme0rFczfHi3YgBwI23ARABIABgldqIgpgHggEXY2EtcHViLTMxOTA0NTc0Njg1NDk5MjPIAQmpAtSmKH7oSLI-qAMBqgSDAk_QWqPzjjh428E1-At6DqISbWGT5f_WS0IBA4tCYMHvU3T9j-bJ1nOW6l2VMQIjEplTv4gFTecI_eMNEMFSWRHteqY_7jDH4qcgjJa3Tr5cpEtRoR6XJKl3YMFs_fjm5jXCQd-Nof1iEeK8OYZk3kJ5RhuIs-ZwgPNWTpyT5laIemXLH-NxFMw3yfLr3QKHWVZrudnkpPHQqFYIr3tDXEuufCXpVlHLzbJz5qfSASLbc0iklkPmvtNZMy7NvOXfxmwpn_xn29Ab_hYkuVyP0mO3NcKeemfS4-n_C7sG5hYimXcgGzVQhjkkwDG3Pa92970BnlknjLgZt5tJhuSYE59kYx2ABrCan5zrkfS3swGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTMxOTA0NTc0Njg1NDk5MjMYAA&sigh=CDQQ5Ohp6jE&uach_m=[UACH]&cid=CAQSGwDUE5ymyFvV-8S50V7LOIcQZ1_5xLmq3FiaJBgBIBM

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 25 Jan 2023 12:03:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:34 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame B3BA 0
0 217ms
40ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kLKVEMz6RO0HfJ2DYgICAAAALbYKa9d2lk0QlRrRY0VvNrX21KjLWBR-ABIAAAoOQVFVQkJRWUJCUUVCQlE&wp=Y9EalgADGOIKsoeEAAfVH3YxRbdrgjbncMJmIQ

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 16502140
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 1231 243 KB
63 KB 163ms
152ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOIKsoeEAAfVH3YxRbdrgjbncMJmIQ&u=%7C7Pm5Wog6nkfKm3SFGlVVxBNfcHtNaywMCBLcSpcpm1M%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANdxyL-B-DE_nbHS1sNQA-aOVQmAntDJMysO1XrhquT5j_SLJ3R5pEb6iKUnd8aG0jHZ76twftxEGnnMRA48l51yNKE6afRMjzdnB47qvozLxbVwA21-K0OUSBxOjAfQWWaOPOR5LysUFOp9NSxI2IVkyvoEnCa4sob4byNtrrVuGbihky_Ln8rZtQofSw0XFivhPilGsRr0hGAGRLVL1UEARHIz7cw_CSS7Ie0SVExoRmUsVY68e-0ZbfzE2Bfwr9TlxcJKONIohidjjuYP62WYmVCSQEJA31EA3Lna0_zYwyMMlnYC7tKtL09VhulqRdhOlknJ45i-y6QW6LNVGLM6QfLL0rvB6u_cWfceyjgsIoU5JdQ1MuYUUv1BWOmnXTWebFTBnjezj5xKvNRDSfI6QEQ0fJZUDQJ0Y2JeMawc52HtEQLzAMSSuq7ZyV37Nzhg1e7ZZPtXhpw4JAY1iayaqQGSvKBkbc7sCz5AN8Q9Y_KlSJ9MmN0W2lEswZjPc_kRu4b4ouIJJ14reTOvPCuHUfqvGfYzcGWnLvx_yJ3K8l7JHrpJLT6w&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DClA_4lhrRY-KxDISPygWfqp_AAsme0rFczfHi3YgBwI23ARABIABgldqIgpgHggEXY2EtcHViLTMxOTA0NTc0Njg1NDk5MjPIAQmpAtSmKH7oSLI-qAMBqgSGAk_QWqPzjjh428E1-At6DqISbWGT5f_WS0IBA4tCYMHvU3T9j-bJ1nOW6l2VMQIjEplTv4gFTecI_eMNEMFSWRHteqY_7jDH4qcgjJa3Tr5cpEtRoR6XJKl3YMFs_fjm5jXCQd-Nof1iEeK8OYZk3kJ5RhuIs-ZwgPNWTpyT5laIemXLH-NxFMw3yfLr3QKHWVZrudnkpPHQqFYIr3tDXEuufCXpVlHLzbJz5qfSASLbc0iklkPmvtNZMy7NvOXfxmwpn_xn29Ab_hYkuVyP0mO3NcKeemfS4-n_C7sGpBQDC_CvhybvGi2HEAwRxaZi_QsLsEGlOHAkEWn2mMiAljXgcKLNaNKABrCan5zrkfS3swGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3WBY5XHI61aA7Z9DNADxDzSoXV0Q%26client%3Dca-pub-3190457468549923%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b380887dc66bccce51e2a65719bd79619ab197fad12c851ca31ea831a2056587

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=7G544Hv_iaMsRGkxl-oyKzrIql_xeJ8HIie11tbnp3Jc64H1QlggMd3pdYsIUDm3GrrodsDHK-00lMwpOUYTo9w591tf7fMN95EIxcKEGFCtzPDD3K7i_06FGI0OFBdC5-gdsEgp4TxCZWToGodCuyYdB0zkCWyAE4fdbgrB2YJDwrYa-6LRmE_sGALfCBOhpfBFHNBJYKHG5t-nB9uV6HYk7STc1j7NfHGmLCy6-kj6yt4Q3vQoF4sOwN8uUuq82W23gQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 129201339
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame B3BA 3 KB
1 KB 101ms
47ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11009
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame B3BA 18 KB
7 KB 84ms
30ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11008
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B3BA 156 KB
48 KB 43ms
39ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:34 GMT

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame 3CA4 74 KB
24 KB 33ms
18ms Fetch
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Wed, 25 Jan 2023 12:03:34 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 6RXRQ6RXN05M4K99
Age: 165126
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: /MX6vFsM1Va9FXGo3XFY7QLWHXWfuiLVr59e2hn3sZ4rlv2WLw2wqcspiLzT7P6XHEgk1IHwbUM=
Last-Modified: Tue, 22 Nov 2022 09:44:15 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H0j%2FkHhx%2BEn5dGUqd7JRTmmopO9DCTOv2jE%2F4Lm9bVXBBAktW%2Fxb3Cn4VEhlfOvfKIGyVm0nmw8BYXs%2B0zFOKt7IPV8Al2pQdfuAY8vvzT%2F%2F55CRDVapKobHqZ4T4%2FbeEP%2ButPKcqZcWNvBo"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
CF-RAY: 78f0ddcefe5090ae-FRA

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame A2D5 74 KB
24 KB 45ms
29ms Fetch
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Date: Wed, 25 Jan 2023 12:03:34 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 6RXRQ6RXN05M4K99
Age: 165126
Transfer-Encoding: chunked
Connection: keep-alive
x-amz-id-2: /MX6vFsM1Va9FXGo3XFY7QLWHXWfuiLVr59e2hn3sZ4rlv2WLw2wqcspiLzT7P6XHEgk1IHwbUM=
Last-Modified: Tue, 22 Nov 2022 09:44:15 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FZ4N6vXlrsMJKfiZ2tjKSSHzOtV7RbR3drqWGdX3qGarX4qzfBnc0Xbpvc1Efx%2F%2B1lH0HZUupTqPU1lab0CFFpuWHrJUqcsiNvlTzcajuHPqkHLCapCQnsEJnjtSdvSDx8hqr8DO3LNk40nm"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
CF-RAY: 78f0ddcf0d0d914d-FRA

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame EFCB 2 KB
1 KB 50ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOAKsoeEAAfVH2wt0E5nzLk0QWLXjg&u=%7C7Pm5Wog6nkd9ubvoX2mZ1k8LFVpcNs11oeOwnWOytEg%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_T4U3ERXQAMafMI0At8H8tIXNA50hUfvRil2-hkb2Ar4coqfQCEAQm2spJolaDNE5lmk0EEJ3MUbxgIkPC1hCBA1qM7pKHyI_ohDk5kdQdwZs6ysSONcre-NLWTAEN3IuiDYek4iVIWgjh-Cr5v6h-F4K-Bp7NbGKHX44NoRt1WGq53DJKD5q50xqfKt9tF0qlscuaqXeEOPwv5QXX_-KFMND5rkq5dsNmL6uTQA88E544zIA4BrTDxqJSY6cBHFsugCazH8_VcMwtpDHvrO8J3pGdmXBGHdj3flw6q01oTqsxy8NXDUu1urX5Cw0KqNduO49L2LuGbSRrWLD1UpGpDDOqEWs77yHoOKFZ1iGkKfgr9o4TfV2pow4hP9X3UUJHQ4b_2k66h6Ma6K9kRImTneFFdEnse3Q2YeGlNQkK478Huq7Yiy-_p3xunYcBbAd-iF6XNKNpIcMDgcXlBL4db9zxX6EP_BnWkKQu51dGkFvp-WO2FXfhfRmPDkPY8MjxLSLVZW0VIs33yeXsstqMMDlZy-ZQMiHSxu1QsNX3ekUMVYSkGeBbYo&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCF53flhrRY-CxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIUCT9CeEwX-7V3OFufZN23rBjYBmHGfQXIzUpnX9hjQMZ53UvPHEl6FnN3cR-DwqS-fcuX2mwpNI2x5AanlfRzStrIo5B9y74pjRBvxofskxkAq2S9xyfL0oSNGZhWehJxSVmUiNFp3YLLMGCQHmD_lw7xCfy78QXbOIAWGBS3F62Wh7P9VqiNyxQmY-sAfz4k3NtrLw8ExdLyvafAoibw9tvYy5gPoYzeqpIPo5MyMIeWHYbg_sZ-XoS9KdNBGCHqDXopN2xsPUPVpG3rmxf0D_MGFY12yu1NhBm4J3vpeT9PeFP7e_-43OoObx15ydPeakcVL8IKy0ZE073CZa8GDThcNYyNEgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_38JjKuZrd0EzH7Mvw_ME-wX24KaQ%26client%3Dca-pub-3190457468549923%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame EFCB 2 KB
1 KB 50ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame EFCB 308 B
636 B 46ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame EFCB 293 B
621 B 49ms
20ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame EFCB 43 B
348 B 57ms
15ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=kOWGY2muBySL9v5XwAAFlHs6SfSs6aom1DZGyDi3RK206hFmF_c8y4EpJ-RqripCaoB7XQhkGAYyFrKZ7PiaTmrOMmhElqR6fPXngCCxuNYlbjJeFS6Vh3TnWsHP8F8iUYcp7Hk0gfkiol6YbX-FIktdO82C4wc4qGuKnf4KODDBtl9Px9EPrlOjkk5wRGqmI9eq57ZHai9Q8bfir6pB4NnQWv9V-pBlG7zy5srMKuex02BATGP5h3pZH5dQHKkMvsSv_XKJ3OUq1zQGq8FNWYOIcj9Qfp-LVshJz_EXsAraexyWfVYwnHUDDiRTUIWTlzJzeSYiVDMtCotBFcDFaB-eRgUzGyJz5nZAFSP1hFSiH5hSiXTzWICVih-Gb5DTCU0QTbbakyWHlKIup_V4Y7IDrS2ucZeNuGAf2KWFEuVSBD3L

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1785553
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame EFCB 43 B
1 KB 134ms
19ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=15&extPu=13929-criteo&extLi=264882&consent_string=&iab=1&rnd=63d11a9646655457dca0bdc77041505a

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Wed, 25 Jan 2023 12:03:35 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mi, 25 Jan 2023 12:03:35 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://ads.eu.criteo.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1051
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

OPTIONS
H2 200 /
api.purpleads.io/x/b/ Frame 0
0 132ms
131ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=3&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=802e4755-465c-4ad0-a2a4-7ab1b51e2033&demand=unifiedPb&ts=1674648215002
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:35 GMT
x-request-id: a0b15674-a2b6-4d13-8f1a-8ae87c460c34

OPTIONS
H2 200 /
api.purpleads.io/x/b/ Frame 0
0 115ms
115ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=4&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=84216a3a-dc92-43c8-b6b3-c95c77aed010&demand=unifiedPb&ts=1674648215003
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:35 GMT
x-request-id: 36051833-71d7-4697-96ce-ea1c5d32bdea

GET
H2 200 / Show response
api.purpleads.io/x/b/ 3 KB
2 KB 195ms
195ms Fetch
application/json 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=3&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=802e4755-465c-4ad0-a2a4-7ab1b51e2033&demand=unifiedPb&ts=1674648215002
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash: a53a1b8e09ad2a82953fa60923cfc5582a9beb0c903d58eb111314ab6115b534

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
pa-user-id: c9ec8bf3-bec6-488a-9b25-014f74890bbf
etag: W/"a41-JSdn/DnHsl+Mn/X+p1quIZiDX1g"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
x-request-id: a0415210-2e86-4f0f-ad21-327c87599be2

GET
H2 200 / Show response
api.purpleads.io/x/b/ 3 KB
2 KB 178ms
178ms Fetch
application/json 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/b/?idx=4&pid=0212a21a76d24768913865e425ac7d8b&sizes=[[728,90],[468,60],[336,280],[300,600],[300,250],[160,600],[120,600],[200,200],[250,250],[320,100],[320,50],[320,480],[300,100]]&slotid=84216a3a-dc92-43c8-b6b3-c95c77aed010&demand=unifiedPb&ts=1674648215003
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash: 45d332aab81c93fed59ab2aa2e9cf1d2796ce6932205378d1174b0af747b4ce5

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
pa-user-id: da78c2a0-bdc1-4f1c-bb89-cb0fcad7d658
etag: W/"a41-RXTjyO4savlzzHzTTAA+PHT2H74"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://returnofdisasterclasshero.com
access-control-allow-credentials: true
x-request-id: b9b69a74-b3ea-4a5f-958c-582847aa85c8

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 3A28 80 KB
27 KB 155ms
84ms Script
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c41c77ceae3327a4186c557d3c686d5679a7b9dc0e15fb6adafe53180ebef909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27428
x-xss-protection: 0
server: sffe
etag: "1462 / 165 of 1000 / last-modified: 1674646782"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
DATA 200
OK truncated
/ Frame B3BA 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81615952e40e467e5c96639d12f1e0bed25096356d7982f61a9c791e197cd24a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 1231 2 KB
1 KB 22ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOIKsoeEAAfVH3YxRbdrgjbncMJmIQ&u=%7C7Pm5Wog6nkfKm3SFGlVVxBNfcHtNaywMCBLcSpcpm1M%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANdxyL-B-DE_nbHS1sNQA-aOVQmAntDJMysO1XrhquT5j_SLJ3R5pEb6iKUnd8aG0jHZ76twftxEGnnMRA48l51yNKE6afRMjzdnB47qvozLxbVwA21-K0OUSBxOjAfQWWaOPOR5LysUFOp9NSxI2IVkyvoEnCa4sob4byNtrrVuGbihky_Ln8rZtQofSw0XFivhPilGsRr0hGAGRLVL1UEARHIz7cw_CSS7Ie0SVExoRmUsVY68e-0ZbfzE2Bfwr9TlxcJKONIohidjjuYP62WYmVCSQEJA31EA3Lna0_zYwyMMlnYC7tKtL09VhulqRdhOlknJ45i-y6QW6LNVGLM6QfLL0rvB6u_cWfceyjgsIoU5JdQ1MuYUUv1BWOmnXTWebFTBnjezj5xKvNRDSfI6QEQ0fJZUDQJ0Y2JeMawc52HtEQLzAMSSuq7ZyV37Nzhg1e7ZZPtXhpw4JAY1iayaqQGSvKBkbc7sCz5AN8Q9Y_KlSJ9MmN0W2lEswZjPc_kRu4b4ouIJJ14reTOvPCuHUfqvGfYzcGWnLvx_yJ3K8l7JHrpJLT6w&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DClA_4lhrRY-KxDISPygWfqp_AAsme0rFczfHi3YgBwI23ARABIABgldqIgpgHggEXY2EtcHViLTMxOTA0NTc0Njg1NDk5MjPIAQmpAtSmKH7oSLI-qAMBqgSGAk_QWqPzjjh428E1-At6DqISbWGT5f_WS0IBA4tCYMHvU3T9j-bJ1nOW6l2VMQIjEplTv4gFTecI_eMNEMFSWRHteqY_7jDH4qcgjJa3Tr5cpEtRoR6XJKl3YMFs_fjm5jXCQd-Nof1iEeK8OYZk3kJ5RhuIs-ZwgPNWTpyT5laIemXLH-NxFMw3yfLr3QKHWVZrudnkpPHQqFYIr3tDXEuufCXpVlHLzbJz5qfSASLbc0iklkPmvtNZMy7NvOXfxmwpn_xn29Ab_hYkuVyP0mO3NcKeemfS4-n_C7sGpBQDC_CvhybvGi2HEAwRxaZi_QsLsEGlOHAkEWn2mMiAljXgcKLNaNKABrCan5zrkfS3swGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3WBY5XHI61aA7Z9DNADxDzSoXV0Q%26client%3Dca-pub-3190457468549923%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 1231 2 KB
1 KB 23ms
22ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 1231 308 B
636 B 18ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 1231 293 B
621 B 20ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 1231 43 B
347 B 21ms
20ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=_Z1YVzhIgopJvU92UQzpSq0vyM3C3B5LeQvlXbeMRkBAB7TroOPZYEmnRm1FZFcL7x-8ORTuxuzvNoW6yBPlQegpcql5MsdmTaHWbK60Gi51twrRUPrqRFGRoJkXJYWlTBKo8zjFj1lMF2QjO9h1pP2005H_Tqq_fhfupnJIS-WI_gaQsA_aYW_vlMrvK0cCspmRl6mI1PCszkKdfxlKe-2B490iZ5yGoT4OYQoT2oVMA_n9iCCfA_jNiKF1X1F1F793O4vFs_-omfqIg31rJnYfOkLmCO6O5y29yxsf2gfIqGF-LuS8PBqgE9T8hjCV_NZ6BfyatOzCO3QYy4UoIxV-2kd1AI1QIn4QNWSN7OyT8IxZtoyJE4o_dnQ9mlInIZSG2nfTSWgFQEsIMknRpvBMXX7qYuOJ2aTFiE1BW8yyb-pt

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3263033
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 1231 43 B
1 KB 56ms
20ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=15&extPu=13929-criteo&extLi=264882&consent_string=&iab=1&rnd=63d11a962b1ac5dd9674351c4010ef67

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Wed, 25 Jan 2023 12:03:34 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mi, 25 Jan 2023 12:03:35 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://ads.eu.criteo.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1051
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 893E 2 KB
1 KB 22ms
21ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y9EalgADGOEKsoeEAAfVH7Mfo04rJJyxvcS-Ag&u=%7C7Pm5Wog6nkfeR4%2BUjrrYPOD6RDhcvKl%2FXgQNUA4AotI%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNTJmLEv97WHnUtKOrKYxIg_Yv4RnZRq4P_PySyhhQairi-eDLwKj_T4U3ERXQAMafMI0At8H8tIW92GoAMeffWC3JrvEAWlaL-NPREbmAU35de88Lx7J0Bcs-dmICAOIPQnYgOItglIGxvtJS1LNW-IvqDFcGowJFYHFBv6ZoVIEhDXC0mn2QuPwZVbP3TR7iJXmgu-cmMP8_y1zHgZvgmMydhXPRZQhetwM-f6VLghMuoM14P75AhnM2K7YQpwtHPdz3ScVnn4Gy4UxMgT02KQRwTVzKrnK8Gh19eM_Mos0Q7KW9STgaW6Q5vpmnGYKNKTko9rVhtymhuA_7VQkQOXuEW06ittiTMqXuuNYybRrY48t81JZW82wGS1kv6jMn0VO7ez22bKKbxI4GRHL9LrSskHZ5yVt8qtF2MUen6zIVZd8xy0xHN4XVQm4UEBBGhg-w_n4a5t-owRMZE4Ip5FED1b872cI41eNhSIlFiPxAv96wH76dAYcOR3U5dsou2mYmF0wKOhiR5X_oFy9GVUpBLD8aFbNyUWnht7p_kBjXm6Ja9grdEGqtiJZIsuhkL2Q4Z3yFIRNAi9OkxIX0FgrlrzHkNOGj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCjSyklhrRY-GxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIUCT9A28WQ6uRHciRF4MflPvwnI-SYNs5wHfs4ganTcHXCN7DHy31jBYTpe62G-T1lTF8Gtewlxssdvn2gvduqIOIcujJTzlVPOijNjsfuX5J-wq0WgOkYeeFw40qNjJS46dRruCyndy-deeviJBEG3G1h_Hqlvm-JtJQCyJ62Umm3HKqNKVAmN0ef2vq7c6noPDBE0kwmr1qYSKRfmEzBm91CZ-Jijc6BPHFR9MvQJjklzObdxXACxprkU4Cfhbc4u6D-Q_DJ6yhWv_jKBwl5NYpoYeEnaIlsp9_srp4KYn4NSVt0loyLUQAJeAFKbS9Ubo6o8AcQ4bD6cOwAFlFAyehwOGEsbgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0Jz8JN2-qSIZh_4jYa8efwLIIcjg%26client%3Dca-pub-3190457468549923%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 893E 2 KB
1 KB 25ms
25ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 893E 308 B
636 B 18ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 893E 293 B
621 B 19ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 893E 43 B
347 B 17ms
15ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=0W13eWmuBySL9v5XwAAFlHs6SfQZmOSA22RfyZZ3AMcGeRBGYBjblIGQKFP2hHB9Ei4YW9SfXY24ZSSMDm7rpz9DM97hF7jJ-KYAuzNW1Vn2FS34G3t7aLjtlXBrnefIh5ErDBG9CKzHZ0P1tzyukujZOriDQl4DgZCinm4qe5AbmkZQVm5bQYWkEyt2IOms_6CsYB3ONN5GZV18aQq0QCIsUjOwfHrJMFslky1qc4PTjQxct-lE-3kb_jFYiN88PGdPUXu6eCk-neDWbTs5DlMcT3Hf_Qyqh4oudlEaCVLCgpGUYOgBVmvKgSprNWZq0Wt4UAbbMBM3FGac_7vl_OnKAO5owyrDzZ4rAqS_MAOrofPY2kqBHmWijtadkj5i3APa6Mv-jNhVBUQoko89s1bidhedNEyHpvYfhksjE2HTfbTE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1836312
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 893E 43 B
1 KB 57ms
19ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=15&extPu=13929-criteo&extLi=264882&consent_string=&iab=1&rnd=63d11a962670671837ea81964f4bff43

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Wed, 25 Jan 2023 12:03:34 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mi, 25 Jan 2023 12:03:35 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://ads.eu.criteo.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1051
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 sourcesanspro-400.css
static.criteo.net/design/googlefont/sourcesanspro/ Frame EFCB 2 KB
854 B 22ms
21ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

edb79682e63246515260549ce35ef25b28017be72a0f1f7701eff54b6cc54f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:04 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e0-8a8"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-700.css
static.criteo.net/design/googlefont/sourcesanspro/ Frame EFCB 2 KB
854 B 20ms
19ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

50d455c07f26ae94481e9cb2dd5129a6d0127a650d4e3609370d247b53e4f814

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:06 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e2-8a8"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame EFCB 12 KB
6 KB 20ms
20ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame EFCB 0
128 B 45ms
14ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=dPLUEXv_iaMsRGkxC7MF8NKehFKQcIarHlal12Oh_YOWU8xeo5nhRL3Hj1ur0VokdzSYwEiA--LIeUZo53jEzM9GX2JkvB7oG2B6mnugURVdYbr1FWhaXMiavFz4vn6-d1k_okZJ3oVJ5h2RtDhErWJThoSP4rUnH7BW2bOp2N0qjZJoWKCJL6h-dUhLR4vWoUY_TSfucHlreruxZlCha2zZmg1ZkbSJTrXa3giGgYtBLoz4zcscZMOU9LE&sds=2&rev=84429&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame EFCB 2 KB
1 KB 21ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame EFCB 2 KB
1 KB 19ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0565 8 KB
991 B 18ms
16ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&h=280&adk=3903388278&adf=3964591440&pi=t.aa~a.422568436~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1674631548&rafmt=1&to=qs&pwprc=6017413186&format=960x280&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648214615&bpp=3&bdt=1163&idt=3&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&prev_fmts=0x0&nras=2&correlator=932973055409&frm=20&pv=1&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=160&ady=2943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qh7MhSu5xX&p=https%3A//returnofdisasterclasshero.com&dtd=14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 25 Jan 2023 10:22:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 0565 2 KB
823 B 30ms
28ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/ Frame 0565 22 KB
9 KB 25ms
23ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

682b9a643ebc5c5b7f54f802fe82d4d9117b6cdff3479110b81afdccfd6148c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11008
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8871
x-xss-protection: 0
server: cafe
etag: 9510037503091481574
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:07 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 0565 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame 0565 18 KB
7 KB 28ms
26ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11009
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0565 0
0 39ms
16ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQRvUF7zsTncxYtJECdBdVDqjKVcTZWxXhxzqX68WqYDjgDncuTAtZwunjeYwXlpGS_h2G3EkxBqLlbx4yKznz2RXkl5g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&h=280&adk=3903388278&adf=3964591440&pi=t.aa~a.422568436~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1674631548&rafmt=1&to=qs&pwprc=6017413186&format=960x280&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648214615&bpp=3&bdt=1163&idt=3&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&prev_fmts=0x0&nras=2&correlator=932973055409&frm=20&pv=1&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=160&ady=2943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qh7MhSu5xX&p=https%3A//returnofdisasterclasshero.com&dtd=14
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0565 156 KB
48 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
H2 200 8aec859a266e19fb42fee7f82edeac28.js Show response
www.gstatic.com/mysidia/ Frame 0565 33 KB
14 KB 97ms
25ms Script
text/javascript 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8aec859a266e19fb42fee7f82edeac28.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07970172ef078d9a58aa9ed9e9b54dd1cfbfec021be21b0d0fc7484c5fd5a58a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 05:47:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108961
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14079
x-xss-protection: 0
last-modified: Tue, 24 Jan 2023 03:52:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 24 Apr 2023 05:47:34 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0565 0
0 66ms
65ms Fetch
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CS_SJlhrRY5HnKNSTxdwPuNSj2Av12pO6bqXal7X5EIvb6L6NDhABIKz44iBgldqIgpgHoAHs_c3uAcgBCakC1KYofuhIsj6oAwHIA8sEqgSoAk_QHNvNg1q3e8zH5yeYfcx61zYEo1y-RHcMYEpE06izvAqrflE3Xko3uAnjprsc80Ts1TRawNSU3ugPOmtoVYjwMXEk6clx_zSeNTEAWdwPZgFX1cJDGdzCPkGV4Rkx178HWuPyIZy_oe936xL-g1TAbqjWhZZrLE2XCRnKOg_rY8JD6kHRb9tglUOmHgjjF-4GZPyjSuUgXcCX0eKAZhQ-ZltXxU7r3XDVVHkiyX61gxV0JGqpKg07JbqoZbRKOAqgvIYaty50viruw60Bz-5h19fZvh0Dv9E_aj_gvp6FgKBukQGvdSh_utadBaDJCJt-YyUUAr6nKyNHpVHPDZvohQKWy4eTz48AY6EwW-bJkgD58ueU4McC8ux9adT2oZnAN_aojLdWwATgiNrSrwSSBQQIBBgBkgUECAUYBKAGLoAH_IGykQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDP0QHSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTDIgUAdAVAZgWAYAXAbIXHAoaCAASFHB1Yi0zMTkwNDU3NDY4NTQ5OTIzGAA&sigh=0L2ybob0hS4&uach_m=[UACH]&cid=CAQSOwDUE5ymRTP5Npstd8XouXAg-khcCGr41rGm48h3ZJaX3wBdYK0b8tfiw2428QcqYPvngTljMemj6pcIGAEgEw&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&h=280&adk=3903388278&adf=3964591440&pi=t.aa~a.422568436~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1674631548&rafmt=1&to=qs&pwprc=6017413186&format=960x280&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648214615&bpp=3&bdt=1163&idt=3&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&prev_fmts=0x0&nras=2&correlator=932973055409&frm=20&pv=1&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=160&ady=2943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qh7MhSu5xX&p=https%3A//returnofdisasterclasshero.com&dtd=14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 25 Jan 2023 12:03:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/9724434517152106664/ Frame 0565 14 KB
14 KB 24ms
23ms Image
image/jpeg 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9724434517152106664/14763004658117789537?w=400&h=209

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef17a9f91c061c1acd3ea44921065e1257b31be45858b6d00862e89fbb66dccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 16:18:23 GMT
x-content-type-options: nosniff
age: 157512
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14069
x-xss-protection: 0
last-modified: Wed, 21 Dec 2022 03:27:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 23 Jan 2024 16:18:23 GMT

GET
DATA 200
OK truncated
/ Frame 0565 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 0565 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 sourcesanspro-400.css
static.criteo.net/design/googlefont/sourcesanspro/ Frame 1231 2 KB
854 B 17ms
16ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

edb79682e63246515260549ce35ef25b28017be72a0f1f7701eff54b6cc54f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:04 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e0-8a8"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-700.css
static.criteo.net/design/googlefont/sourcesanspro/ Frame 1231 2 KB
854 B 16ms
16ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

50d455c07f26ae94481e9cb2dd5129a6d0127a650d4e3609370d247b53e4f814

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:06 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e2-8a8"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 1231 12 KB
6 KB 17ms
17ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 10 KB
10 KB 76ms
32ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=244&m=0&partner=8721&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F8721%2F151110%2Ff72c9b427a974b29a26231c07646f1bb_breuninger_de_all.png&v=3&w=196&s=59dXpf5sQkNZLb_qQPpm31W-

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

34105da8973bdef5f096304c920c976eb20007ca983f322b4d1768d9bba9d1ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28570376
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9836
expires: Fri, 22 Dec 2023 04:16:32 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 6 KB
6 KB 75ms
31ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F3%2F100130857317000_0_1647481851145.jpg&v=3&w=800&s=UEnj-BSt149rqAH5mpgIOINE&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

668617a2777896f805c70aa41a6ccc1dc1d64f0b9fed4bafa3e2c7c1f87c2ca8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6346460
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6352
expires: Sat, 08 Apr 2023 22:57:56 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 7 KB
7 KB 81ms
37ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F11%2F100132312617000_0_1667807550629.jpg&v=3&w=800&s=YKniyDrF6exEWPhvYYlUij_L&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

21c670994e1a8317d0cac7b9715a1c659573eb5d9f9b1327acad7a94f3abf12e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7573290
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6986
expires: Sun, 23 Apr 2023 03:45:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 5 KB
6 KB 79ms
35ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F10%2F100140034411000_0_1664897973005.jpg&v=3&w=800&s=Hp5CSUINLGCOanJPqe19ncO0&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

0dcf797aff8c8a65b44cea1ffd2c730b5a3b5706866924db258052344b2b9457

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7367455
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5550
expires: Thu, 20 Apr 2023 18:34:31 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 7 KB
8 KB 84ms
40ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F10%2F100132858717500_0_1664906712937.jpg&v=3&w=800&s=95520hzI8OCjWBEXX8wb3uPr&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

fccfce221f5d033301592f4d78b9ca4b08c025aaff07dfe416201aaccf6d3731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7578050
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7464
expires: Sun, 23 Apr 2023 05:04:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 4 KB
4 KB 76ms
33ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100131798513000_0_1660847114119.jpg&v=3&w=800&s=fWxVGpU-7NCtunqcAMpn5csd&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

5fac38c45343239fc75d4df8825d8bdf25c61a380efae384e3e1ba7554789c50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6809433
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4164
expires: Fri, 14 Apr 2023 07:34:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 4 KB
4 KB 22ms
21ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100133175418700_0_1659433818236.jpg&v=3&w=800&s=IR0GFkJFA-RDXOmySB-FcTb7&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

34814f621b88ef58f44fac3b466fecf1d87834ca714efa7861095ad32777b89f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7397924
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3780
expires: Fri, 21 Apr 2023 03:02:19 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 4 KB
5 KB 22ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100131847715001_0_1658151574896.jpg&v=3&w=800&s=nRPq7iuq2zmg5KB4UYPNMPeg&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

863785adc44f68b4f6920d3225c986a719e0c97a6a54b1a9a03837790f5bbcbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6213804
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4602
expires: Fri, 07 Apr 2023 10:06:59 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 4 KB
4 KB 50ms
49ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F11%2F100135996013000_0_1667380191222.jpg&v=3&w=800&s=_v_TESfBPO0lY1jc13YzFhNM&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ef83e5eba3be9b463108cdf8c3e7735dea7c34fbd899658e0a2b62ac9c6d7826

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7366297
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4112
expires: Thu, 20 Apr 2023 18:15:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 3 KB
3 KB 23ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100131847913000_0_1658151565404.jpg&v=3&w=800&s=r0zBHm2XlDE5JNOFGRol9K0Q&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cdf06ed6bd6c5c8b31c27e6a2052ac666f7d5792a0cb57523faa24d933bee1f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7744204
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2584
expires: Tue, 25 Apr 2023 03:13:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1231 115 KB
115 KB 26ms
25ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=8721&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F8721%2F220915%2F3c7c39af2c3041588a493c877a3cc549_img_horizontal_1.jpg&v=3&w=1200&s=pQg-UU2xWl9yZqhOvsp7TIAg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

67f9fc2b60764aed2f4918acff39b40e8f1e79526edead31b3f83d7970bf3d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30436594
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 117272
expires: Fri, 12 Jan 2024 18:40:10 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 1231 0
127 B 14ms
13ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=7G544Hv_iaMsRGkxl-oyKzrIql_xeJ8HIie11tbnp3Jc64H1QlggMd3pdYsIUDm3GrrodsDHK-00lMwpOUYTo9w591tf7fMN95EIxcKEGFCtzPDD3K7i_06FGI0OFBdC5-gdsEgp4TxCZWToGodCuyYdB0zkCWyAE4fdbgrB2YJDwrYa-6LRmE_sGALfCBOhpfBFHNBJYKHG5t-nB9uV6HYk7STc1j7NfHGmLCy6-kj6yt4Q3vQoF4sOwN8uUuq82W23gQ&sds=2&rev=84429&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 1231 2 KB
1 KB 18ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 1231 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-400.css
static.criteo.net/design/googlefont/sourcesanspro/ Frame 893E 2 KB
854 B 19ms
19ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

edb79682e63246515260549ce35ef25b28017be72a0f1f7701eff54b6cc54f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:04 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e0-8a8"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-700.css
static.criteo.net/design/googlefont/sourcesanspro/ Frame 893E 2 KB
854 B 16ms
15ms Stylesheet
text/css 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

50d455c07f26ae94481e9cb2dd5129a6d0127a650d4e3609370d247b53e4f814

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:06 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e2-8a8"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 893E 12 KB
6 KB 21ms
21ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 893E 0
127 B 14ms
14ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=0mTxJHv_iaMsRGkxEPWqNolkiRZEP-BfpZbKuUq0KTkOJbVQM0-HaSFYQeCid2WYKLGjPzDal6S9nmXPVfOagkwhoYYEI4YfK4_KZQXc-Kg1cmic7QYCNFA7pt0Q43-QRt2_rsZghHqffCx0shmN3gATEU83EzUo2BR4eVrFUyHGoUT5WNUxGr9N_dthKt9oWp84r364ehweT4DdAIg-80T-jgBUmYhcEv2x9fT3QhcrwVUgyowlYoSyJII&sds=2&rev=84429&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 893E 2 KB
1 KB 21ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 893E 2 KB
1 KB 19ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-400-latin.woff2
static.criteo.net/design/googlefont/sourcesanspro/ Frame 1231 13 KB
13 KB 62ms
29ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

d51105af85114f8e1637892f3971892eeaff4acb5d8ce2cbeb0eae526c1a1372

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:03 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1df-32ec"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-700-latin.woff2
static.criteo.net/design/googlefont/sourcesanspro/ Frame 1231 13 KB
13 KB 66ms
34ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

43e7c5032ef551716251cd76d2d271ff8a66bda855fbf366d176e1629f33f8e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:05 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e1-327c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
DATA 200
OK truncated
/ Frame 74A3 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9de8122b7af1078ffd18e7b4261ce781ec4e46f7ef9b7bc9356443fceb480f64

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sourcesanspro-700-latin.woff2
static.criteo.net/design/googlefont/sourcesanspro/ Frame EFCB 13 KB
13 KB 66ms
45ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

43e7c5032ef551716251cd76d2d271ff8a66bda855fbf366d176e1629f33f8e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:05 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e1-327c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-400-latin.woff2
static.criteo.net/design/googlefont/sourcesanspro/ Frame EFCB 13 KB
13 KB 59ms
39ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

d51105af85114f8e1637892f3971892eeaff4acb5d8ce2cbeb0eae526c1a1372

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:03 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1df-32ec"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 456C 1 KB
643 B 8ms
8ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 13508
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:18:27 GMT
etag: 48472445140208031
expires: Thu, 26 Jan 2023 08:18:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pubads_impl_2023012302.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 3A28 384 KB
130 KB 25ms
24ms Script
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8a49489f495524cd96a24f7c2ff2c3ff8ac06c0d87877518834821872533ea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 00:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126339
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 132981
x-xss-protection: 0
last-modified: Mon, 23 Jan 2023 23:24:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 24 Jan 2024 00:57:56 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ Frame 3A28 268 B
152 B 112ms
59ms XHR
application/json 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4409401d274e605a324c4235871c50361f98f05de3963a9a4ca2cba2f9223707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
DATA 200
OK truncated
/ Frame 0565 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd428520f34b12ff9ec27592a228a14b08075f8822c9b158b54ecc6d544fe62

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 74A3 0
18 B 65ms
64ms Image
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CDabElhrRY-CxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIICT9CeEwX-7V3OFufZN23rBjYBmHGfQXIzUpnX9hjQMZ53UvPHEl6FnN3cR-DwqS-fcuX2mwpNI2x5AanlfRzStrIo5B9y74pjRBvxofskxkAq2S9xyfL0oSNGZhWehJxSVmUiNFp3YLLMGCQHmD_lw7xCfy78QXbOIAWGBS3F62Wh7P9VqiNyxQmY-sAfz4k3NtrLw8ExdLyvafAoibw9tvYy5gPoYzeqpIPo5MyMIeWHYbg_sZ-XoS9KdNBGCHqDXopN2xsPUPVpG3rmxf0D_MGFY12yu1NhBm4J3rhcbkFZm2LNQHIjmVOmYaZ7YP0sm-tTcjZ67DfGUG61c0QpygSygAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0zMTkwNDU3NDY4NTQ5OTIzGAA&sigh=_Oq46w4NhI4&uach_m=[UACH]&cid=CAQSGwDUE5ymyFvV-8S50V7LOIcQZ1_5xLmq3FiaJBgBIBM&vis=1

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 25 Jan 2023 12:03:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 74A3 0
126 B 334ms
14ms Image
text/plain 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kLKVEJi6MHjYBJ2DYgICAAAALbYKa9d2lk0QlhrRY8zbBn_vBept3VqXABIAAAoOQVFVQkFnWUJBZ0VCQWc&wp=Y9EalgADGOAKsoeEAAfVH2wt0E5nzLk0QWLXjg

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 243674
content-length: 0

GET
H2 200 30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg
static.criteo.net/design/dt/8721/230118/ Frame EFCB 4 KB
4 KB 23ms
21ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0d3ae56dcf523334972a0a7c3041767a11b5312fe165903ac6565389a8ab2f1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fd-ef6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3830
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg
static.criteo.net/design/dt/8721/230118/ Frame EFCB 4 KB
4 KB 18ms
17ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c5a5d91081fc38f56495852489aabf23d3a7ef52d1df443141e630b59a54f1c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:26 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fe-f12"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3858
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 12 KB
12 KB 20ms
19ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=110&m=0&partner=8721&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F8721%2F151110%2Ff72c9b427a974b29a26231c07646f1bb_breuninger_de_all.png&v=3&w=236&s=s--1pfBcC51KRaY6x13ubX79

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bf29a0826e30cdf280ba376f1bd1088a711ceba035972f5b73af56c40c0f2de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28570376
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12432
expires: Fri, 22 Dec 2023 04:16:32 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 17 KB
17 KB 19ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F5%2F100130366318500_0_1652959982520.jpg&v=3&w=400&s=1SwO001OR0Fn65l8bIAbP1lB&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

fa932d5932542e00a57bbfc82cfd9cc42dee289016dceb776d4eca8381e0c737

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6501235
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16952
expires: Mon, 10 Apr 2023 17:57:30 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 8 KB
8 KB 21ms
19ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100138270617000_0_1660297258221.jpg&v=3&w=400&s=uG4rvtayZ80U2-C3MGhV6xnT&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a35f2e251d2e547a8a29bb5b422820656e0a90e38466bba16d4dbcd7008ad94e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7202401
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7980
expires: Tue, 18 Apr 2023 20:43:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 4 KB
4 KB 19ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100133175418700_0_1659433818236.jpg&v=3&w=400&s=B1F5hRzBtFPv2-FTubavCIng&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

34814f621b88ef58f44fac3b466fecf1d87834ca714efa7861095ad32777b89f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7397924
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3780
expires: Fri, 21 Apr 2023 03:02:19 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 3 KB
3 KB 21ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100131847913000_0_1658151565404.jpg&v=3&w=400&s=opA3a4cWMj27dcmbmcBWIOcL&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cdf06ed6bd6c5c8b31c27e6a2052ac666f7d5792a0cb57523faa24d933bee1f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7744204
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2584
expires: Tue, 25 Apr 2023 03:13:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 3 KB
4 KB 19ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100132683812000_0_1658154081775.jpg&v=3&w=400&s=mn5HayanoFFO-9BCO8v03DB9&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

34aef5f748ce6ffc3bf62671ef6956485209b36b1f380e67dfa144eeefe36148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7444571
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3450
expires: Fri, 21 Apr 2023 15:59:46 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 4 KB
4 KB 69ms
68ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F9%2F100139588013000_0_1663666726352.jpg&v=3&w=400&s=DMIa8ktnZwljTUwCdAM-Y25u&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e777cb1ef56ba78f331b760f8fa333b91b1f7ffaf3c3ed0fce8a7bb3ccfef147

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7379023
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4052
expires: Thu, 20 Apr 2023 21:47:18 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame C130 80 KB
27 KB 72ms
72ms Script
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c41c77ceae3327a4186c557d3c686d5679a7b9dc0e15fb6adafe53180ebef909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27428
x-xss-protection: 0
server: sffe
etag: "1462 / 121 of 1000 / last-modified: 1674646782"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame A90E 81 KB
27 KB 66ms
66ms Script
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7f1be4799bd9ff90c7bf1ff5e2e9a84ab86a477e8347a61895b0716f05625fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27673
x-xss-protection: 0
server: sffe
etag: "1462 / 301 of 1000 / last-modified: 1674646782"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
DATA 200
OK truncated
/ Frame 7E6C 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8f840c925238b7e3bb44db5daa9d97633d127e35308bd00ae975fb5ef6b2a357

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 456C
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEAGRtgV127Mlk978wTBsDQk&google_cver=1&google_push=Aa02lx_fIp0KTlcd5Td8unzqL5yMC5jl3UpLpsJjM1BLpFKmmlBS7fDBfatxxMe_UFy5GEZH6AzZFVewuFevHiRs...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aa02lx_fIp0KTlcd5Td8unzqL5yMC5jl3UpLpsJjM1BLpFKmmlBS7fDBfatxxMe_UFy5GEZH6AzZFVewuFevHiRsucVzECRBftB-g-Q

170 B
232 B

49ms
49ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aa02lx_fIp0KTlcd5Td8unzqL5yMC5jl3UpLpsJjM1BLpFKmmlBS7fDBfatxxMe_UFy5GEZH6AzZFVewuFevHiRsucVzECRBftB-g-Q

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 25 Jan 2023 12:03:35 GMT
Server: MT3 357 2feb0b5 master cdg-pixel-x31 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aa02lx_fIp0KTlcd5Td8unzqL5yMC5jl3UpLpsJjM1BLpFKmmlBS7fDBfatxxMe_UFy5GEZH6AzZFVewuFevHiRsucVzECRBftB-g-Q
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 25 Jan 2023 12:03:34 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 456C
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEN_1EIJ0SOiVIa6iKtb1F8M&google_cver=1&google_push=Aa02lx9QLw4FpmvZMTPEYr3I2h7lcdnrVxj_hspudaL6BErNN6WVn8umAU1uO037B1Q-vm5Aqu4JD6wpF3mQ4f...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE5MjU1OTMxNTc0ODcxNDY1MA%3D%3D&google_push=Aa02lx9QLw4FpmvZMTPEYr3I2h7lcdnrVxj_hspudaL6BErNN6WVn8umAU1uO037B1Q-vm5Aqu4JD6wpF3mQ4fp_QV...

170 B
232 B

48ms
47ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE5MjU1OTMxNTc0ODcxNDY1MA%3D%3D&google_push=Aa02lx9QLw4FpmvZMTPEYr3I2h7lcdnrVxj_hspudaL6BErNN6WVn8umAU1uO037B1Q-vm5Aqu4JD6wpF3mQ4fp_QVsCaLdEuEXOYsg

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE5MjU1OTMxNTc0ODcxNDY1MA%3D%3D&google_push=Aa02lx9QLw4FpmvZMTPEYr3I2h7lcdnrVxj_hspudaL6BErNN6WVn8umAU1uO037B1Q-vm5Aqu4JD6wpF3mQ4fp_QVsCaLdEuEXOYsg
Date: Wed, 25 Jan 2023 12:03:35 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 456C
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEAGCmTmN50j371xGOBpbm34&google_cver=1&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEAGCmTmN50j371xGOBpbm34&google_cver=1&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se_rhGMl1Y

170 B
188 B

56ms
47ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se_rhGMl1Y

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx8T_ghoYqWXtUW1E_gxVRn8BJSGPLRUdIsMRGl6tw9-PdeRo18c-lV5s1bp-MvIXNNYksacxCt4fwu8wFvHAi3Y7se_rhGMl1Y
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 dds
rtb.openx.net/sync/ Frame 456C 43 B
350 B 35ms
17ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPvJaapVI71nsvhPQAZwajk&google_cver=1&google_push=Aa02lx-P0RiF-DpCvtkrkbEKRqDtzKqERRmK-fhzbJpQVD4b13giAdMm6xJv-DgbjwhbtKLjFpFo9caCytbicr4z0x41rZWpsjpbmwo
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3190457468549923&output=html&h=280&adk=3903388278&adf=3964591440&pi=t.aa~a.422568436~rp.1&w=960&fwrn=4&fwrnh=100&lmt=1674631548&rafmt=1&to=qs&pwprc=6017413186&format=960x280&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1674648214615&bpp=3&bdt=1163&idt=3&shv=r20230123&mjsv=m202301120101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&prev_fmts=0x0&nras=2&correlator=932973055409&frm=20&pv=1&ga_vid=1207468414.1674648214&ga_sid=1674648214&ga_hid=947273758&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=160&ady=2943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C31071718%2C44779793&oid=2&pvsid=787854871938832&tmod=366845215&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=qh7MhSu5xX&p=https%3A//returnofdisasterclasshero.com&dtd=14
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: o7gaai028ljsi9ocpqvkdhi2t7697ta9

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 456C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKFzeTmf1fCBBhQL1XX265M&google_cver=1&google_push=Aa02lx_eL1QF2ejXTMXbXBj3yFqUJf-nJ3jR2zMD2YMtd5l0ARo9Yuj5DkymglsrPmbUoLjKhPD...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TERCTUI0WlktVS1NQlo3&google_push=Aa02lx_eL1QF2ejXTMXbXBj3yFqUJf-nJ3jR2zMD2YMtd5l0ARo9Yuj5DkymglsrPmbUoLjKhPDztOijtteh_stMGn0Cvecum4xuIw

170 B
329 B

48ms
47ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TERCTUI0WlktVS1NQlo3&google_push=Aa02lx_eL1QF2ejXTMXbXBj3yFqUJf-nJ3jR2zMD2YMtd5l0ARo9Yuj5DkymglsrPmbUoLjKhPDztOijtteh_stMGn0Cvecum4xuIw

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TERCTUI0WlktVS1NQlo3&google_push=Aa02lx_eL1QF2ejXTMXbXBj3yFqUJf-nJ3jR2zMD2YMtd5l0ARo9Yuj5DkymglsrPmbUoLjKhPDztOijtteh_stMGn0Cvecum4xuIw
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 402fba8a82f093def2459220061c8d31
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 456C
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEL...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y&redir=https%3A%2F%2Fcm.g.do...
https://sync.targeting.unrulymedia.com/csync/RX-f41f8c48-9cc6-4627-aa0c-4edcd39376b8-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAa02lx9_tDsdDIvA0BmgXMY4V...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y&google_hm=A_QfjEicxkYnqgxO3NOTdrg

170 B
188 B

47ms
46ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y&google_hm=A_QfjEicxkYnqgxO3NOTdrg

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=Aa02lx9_tDsdDIvA0BmgXMY4VTipA5uikinL0E6XLuBg57WhiTbCtakLVngzFk7h5Bk6XxXun0vNUHQyqEgib0p40C04ViAUBjJyD7Y&google_hm=A_QfjEicxkYnqgxO3NOTdrg
date: Wed, 25 Jan 2023 12:03:35 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXf41f8c489cc64627aa0c4edcd39376b8003
content-type: text/html

GET
H2

200

report
sync.teads.tv/um/ Frame 456C
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESENpqSFFbZ8_TWM2lf0pOFhA&...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=Aa02lx9Gm5HsNaC5_cYdmsrEz-HfEJrnHStSx3_EhUgSXonUSt9TliWLBtYPiV0dSIMUYspmmmgT0s2gwsPgTBTr1oOwh06iDkSMYtRv
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
172 B

32ms
32ms

Image
image/gif

23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

expires: Wed, 25 Jan 2023 12:03:35 GMT
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 456C 0
223 B 109ms
44ms Image
text/html 142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JD1TWO61DJt1T-b22iFhuSq29wXUQkR6ufeu8n5cwwUVkxBXombNBlcmyI_lgnzxKNLw0cLg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 0565 28 KB
28 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Thu, 19 Jan 2023 21:35:41 GMT
x-content-type-options: nosniff
age: 484074
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 19 Jan 2024 21:35:41 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 17 KB
17 KB 20ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

fa932d5932542e00a57bbfc82cfd9cc42dee289016dceb776d4eca8381e0c737

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6501235
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 16952
expires: Mon, 10 Apr 2023 17:57:30 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 4 KB
4 KB 21ms
19ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100133175418700_0_1659433818236.jpg&v=3&w=400&s=B1F5hRzBtFPv2-FTubavCIng&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

34814f621b88ef58f44fac3b466fecf1d87834ca714efa7861095ad32777b89f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7397924
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3780
expires: Fri, 21 Apr 2023 03:02:19 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 3 KB
4 KB 21ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100132683812000_0_1658154081775.jpg&v=3&w=400&s=mn5HayanoFFO-9BCO8v03DB9&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

34aef5f748ce6ffc3bf62671ef6956485209b36b1f380e67dfa144eeefe36148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7444571
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3450
expires: Fri, 21 Apr 2023 15:59:46 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 12 KB
12 KB 22ms
21ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bf29a0826e30cdf280ba376f1bd1088a711ceba035972f5b73af56c40c0f2de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28570376
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12432
expires: Fri, 22 Dec 2023 04:16:32 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 8 KB
8 KB 19ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100138270617000_0_1660297258221.jpg&v=3&w=400&s=uG4rvtayZ80U2-C3MGhV6xnT&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a35f2e251d2e547a8a29bb5b422820656e0a90e38466bba16d4dbcd7008ad94e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7202401
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7980
expires: Tue, 18 Apr 2023 20:43:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 3 KB
3 KB 22ms
21ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100131847913000_0_1658151565404.jpg&v=3&w=400&s=opA3a4cWMj27dcmbmcBWIOcL&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cdf06ed6bd6c5c8b31c27e6a2052ac666f7d5792a0cb57523faa24d933bee1f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7744204
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2584
expires: Tue, 25 Apr 2023 03:13:40 GMT

GET
H2 200 sourcesanspro-700-latin.woff2
static.criteo.net/design/googlefont/sourcesanspro/ Frame 893E 13 KB
13 KB 33ms
32ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

43e7c5032ef551716251cd76d2d271ff8a66bda855fbf366d176e1629f33f8e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-700.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:05 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1e1-327c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 sourcesanspro-400-latin.woff2
static.criteo.net/design/googlefont/sourcesanspro/ Frame 893E 13 KB
13 KB 17ms
17ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

d51105af85114f8e1637892f3971892eeaff4acb5d8ce2cbeb0eae526c1a1372

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/sourcesanspro/sourcesanspro-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:17:03 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391f1df-32ec"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg
static.criteo.net/design/dt/8721/230118/ Frame 893E 4 KB
4 KB 20ms
19ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0d3ae56dcf523334972a0a7c3041767a11b5312fe165903ac6565389a8ab2f1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fd-ef6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3830
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg
static.criteo.net/design/dt/8721/230118/ Frame 893E 4 KB
4 KB 21ms
21ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c5a5d91081fc38f56495852489aabf23d3a7ef52d1df443141e630b59a54f1c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:26 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fe-f12"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3858
expires: Sat, 20 Jan 2024 12:03:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 12 KB
12 KB 22ms
21ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bf29a0826e30cdf280ba376f1bd1088a711ceba035972f5b73af56c40c0f2de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28570376
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12432
expires: Fri, 22 Dec 2023 04:16:32 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 8 KB
8 KB 22ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100138270617000_0_1660297258221.jpg&v=3&w=400&s=uG4rvtayZ80U2-C3MGhV6xnT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a35f2e251d2e547a8a29bb5b422820656e0a90e38466bba16d4dbcd7008ad94e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7202401
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7980
expires: Tue, 18 Apr 2023 20:43:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 14 KB
14 KB 19ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Ftradebyte%2F02%2Fmedia%2F2463%2F371694-63466044190e8.jpg&v=3&w=400&s=DbT8QCMNhDuHPveuZ4PKTv5F&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

752e5aeeee17ac71508d5b82c8ef4c1067100f4e80905c9ec2bfb0d8ba302c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=50052
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14566
expires: Thu, 26 Jan 2023 01:57:48 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 12 KB
12 KB 21ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100133954516000_0_1659459045107.jpg&v=3&w=400&s=W-Xap-JxrXI2GxoL16hfBWO-&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

23e9a944e80cf479ba7a8c45b5019700991c39f60a328d6d53a5acc91e4dd823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=5452984
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11844
expires: Wed, 29 Mar 2023 14:46:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 7 KB
8 KB 26ms
23ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F10%2F100132858717500_0_1664906712937.jpg&v=3&w=400&s=T_wYy1hAwHJpriNP22nutoGn&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

fccfce221f5d033301592f4d78b9ca4b08c025aaff07dfe416201aaccf6d3731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7578050
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7464
expires: Sun, 23 Apr 2023 05:04:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 1 KB
1 KB 20ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100127920311001_0_1657634176398.jpg&v=3&w=400&s=W9gcJUNxkCrJPhOLhsskpkbF&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

375e021eea878a252407f1cade3523f6f4533fa251cf0727c70c887898a42b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6565766
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1252
expires: Tue, 11 Apr 2023 11:53:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 3 KB
4 KB 21ms
19ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100138269012000_0_1660902385367.jpg&v=3&w=400&s=LlmOkWQpVyE0fMYZhzalgS_g&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ea26064fffbbb526340d9e5416176537073f1a86c676041f2b7ad63ab9c367ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6726497
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3390
expires: Thu, 13 Apr 2023 08:31:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 4 KB
4 KB 21ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100073439815001_0_1656650697799.jpg&v=3&w=400&s=x_2ff1jbyVn79YsPsHUGHoGF&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

08dad37537a1311944f9f3ec50cce1c5c5eca667645d78032b0b68d8a658a0fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=5823226
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4080
expires: Sun, 02 Apr 2023 21:37:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 3 KB
3 KB 22ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F11%2F100133840813000_0_1667817701582.jpg&v=3&w=400&s=3VqsVlyudHsk9fQFYFjU3hha&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

6f546448acf820e74ae00f48af2b49efe00381ea2b178cc70b74146765993830

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7371749
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3092
expires: Thu, 20 Apr 2023 19:46:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 4 KB
4 KB 23ms
21ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Ftradebyte%2F02%2Fmedia%2F2463%2F366250-63464bcab81f0.jpg&v=3&w=400&s=K7ePwxE47YAGEIOFnLWJsVX-&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a74dbe391d1b70efea8cb0d538724a4a5dca381db7528d7b1de55352a9c74e47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7365646
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3684
expires: Thu, 20 Apr 2023 18:04:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 7 KB
7 KB 21ms
19ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F6%2F100130284911000_0_1654859609305.jpg&v=3&w=400&s=Wz4X_VeFhLsNdzVZPsTlybrL&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bb0c5ae74cc4811ef8cbd9b48cc1a822024574b300a44345c21fec42ae96c176

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7408569
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7200
expires: Fri, 21 Apr 2023 05:59:44 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 5 KB
5 KB 22ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Ftradebyte%2F02%2Fmedia%2F3072%2F26817-628619deb8b1a.jpg&v=3&w=400&s=CFsXAZZsPsLspfhvKm8unyPK&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

4b1e93529892b7f06b60e94f67eb3ccc1d7c1c1e760bcc38de14a765fb7eb50c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=19527
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4608
expires: Wed, 25 Jan 2023 17:29:03 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 4 KB
5 KB 23ms
21ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F12%2F100140158419500_0_1670759205819.jpg&v=3&w=400&s=KKYXb3DFDJ66NLqu4h33atFb&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f40268b52190ad94fe5a34b37958ab9666f1d99b2c35bee0c1fab24b38080fdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7068865
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4492
expires: Mon, 17 Apr 2023 07:38:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 5 KB
5 KB 24ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100137538812000_0_1659469927266.jpg&v=3&w=400&s=RSZkFqzJqFPAqO8HTSC45zj-&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

92ce40715e78f5d0435e3bcf57e34113ead0be54f46e77a1653f4780189696cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7617644
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5136
expires: Sun, 23 Apr 2023 16:04:20 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 6 KB
6 KB 22ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F10%2F100140037915000_0_1664881529754.jpg&v=3&w=400&s=-BLRflFgqa3-nGf9WIM3eayR&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7d84159abff8ee67a49b660d0d1aef9c838c6dcc7436c9b9e753a22b3cd294b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7340737
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5834
expires: Thu, 20 Apr 2023 11:09:13 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 10 KB
10 KB 24ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F6%2F100134022517001_0_1656420333124.jpg&v=3&w=400&s=SdmE1iztWQtSQIjxwgEYlw6R&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

8c6e197f9b0a3e11dbb9bf10f937d243becbe440d526e405ebf7e887cbf44f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7149349
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10218
expires: Tue, 18 Apr 2023 05:59:25 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame 3A28 107 B
122 B 45ms
45ms Script
application/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 3A28 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 3A28 19 KB
8 KB 323ms
323ms XHR
text/plain 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3043263596147497&correlator=77035097505442&eid=31071679%2C31071820%2C31071827%2C31071840%2C31068366%2C31070233&output=ldjh&gdfp_req=1&vrg=2023012302&ptt=17&impl=fif&iu_parts=21902364955%3A22652385948%2Ccm_pu_returnofdisasterclasshero.com_books_and_literature_comics_and_graphic_novels_top%2Ccm_pu_returnofdisasterclasshero.com_books_and_literature_comics_and_graphic_novels_btf_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x90%7C728x90%7C468x60%7C320x100%7C320x50%7C300x100&ifi=1&adks=101534194&sfv=1-0-40&eri=4&sc=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&abxe=1&dt=1674648215658&dlt=1674648215026&idt=604&adxs=315&adys=1105&biw=1600&bih=1200&isw=970&ish=90&scr_x=0&scr_y=0&btvi=0&ucis=f1e5n9nig5ei&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&top=returnofdisasterclasshero.com&frm=23&vis=1&psz=970x0&msz=970x0&fws=256&ohw=0&ea=0&ga_vid=1207468414.1674648214&ga_sid=1674648216&ga_hid=840606844&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b3b4486cf5f4a098853794b725b196af8800dc64616122ca1e62854b13c1667

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8340
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 3A28 15 KB
11 KB 52ms
52ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2023012302&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b4629d58a15c76cb0177c9cb33d8bb598f91f2c03d435e172b4bdc10ee8e3c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11250
x-xss-protection: 0

GET
H2 200 container.html Show response
e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F347 6 KB
3 KB 98ms
15ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Thu, 25 Jan 2024 12:03:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 img
pix.eu.criteo.net/img/ Frame EFCB 4 KB
4 KB 18ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F9%2F100139588013000_0_1663666726352.jpg&v=3&w=400&s=DMIa8ktnZwljTUwCdAM-Y25u&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e777cb1ef56ba78f331b760f8fa333b91b1f7ffaf3c3ed0fce8a7bb3ccfef147

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7379022
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4052
expires: Thu, 20 Apr 2023 21:47:18 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7E6C 0
18 B 71ms
71ms Image
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-8FVlhrRY-GxDISPygWfqp_AAsme0rFc1Z2R93DAjbcBEAEgAGCV2oiCmAeCARdjYS1wdWItMzE5MDQ1NzQ2ODU0OTkyM8gBCakC1KYofuhIsj6oAwGqBIICT9A28WQ6uRHciRF4MflPvwnI-SYNs5wHfs4ganTcHXCN7DHy31jBYTpe62G-T1lTF8Gtewlxssdvn2gvduqIOIcujJTzlVPOijNjsfuX5J-wq0WgOkYeeFw40qNjJS46dRruCyndy-deeviJBEG3G1h_Hqlvm-JtJQCyJ62Umm3HKqNKVAmN0ef2vq7c6noPDBE0kwmr1qYSKRfmEzBm91CZ-Jijc6BPHFR9MvQJjklzObdxXACxprkU4Cfhbc4u6D-Q_DJ6yhWv_jKBwl5NYpoYeEnaIlsp9_srp8CavhHV2UE2HL7A49JjpqqSX9-tqYQkg3DwUZhuhB4pjNWY_g-xgAawmp-c65H0t7MBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi0zMTkwNDU3NDY4NTQ5OTIzGAA&sigh=csU3-pkFdNc&uach_m=[UACH]&cid=CAQSGwDUE5ymyFvV-8S50V7LOIcQZ1_5xLmq3FiaJBgBIBM&vis=1

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 25 Jan 2023 12:03:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 7E6C 0
125 B 22ms
21ms Image
text/plain 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kLKVEJi6MHjYBJ2DYgICAAAALbYKa9d2lk0QlhrRY9qlXCjioJzuz-77ABIAAAoOQVFVQkJRWUJCUUVCQlE&wp=Y9EalgADGOEKsoeEAAfVH7Mfo04rJJyxvcS-Ag

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 332594
content-length: 0

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame FF3A 36 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16224
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 pubads_impl_2023012302.js Show response
securepubads.g.doubleclick.net/gpt/ Frame C130 384 KB
130 KB 25ms
24ms Script
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8a49489f495524cd96a24f7c2ff2c3ff8ac06c0d87877518834821872533ea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 00:57:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126339
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 132981
x-xss-protection: 0
last-modified: Mon, 23 Jan 2023 23:24:55 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 24 Jan 2024 00:57:56 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ Frame C130 268 B
152 B 59ms
59ms XHR
application/json 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4409401d274e605a324c4235871c50361f98f05de3963a9a4ca2cba2f9223707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 12 KB
12 KB 19ms
14ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bf29a0826e30cdf280ba376f1bd1088a711ceba035972f5b73af56c40c0f2de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28570376
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12432
expires: Fri, 22 Dec 2023 04:16:32 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 8 KB
8 KB 21ms
15ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100138270617000_0_1660297258221.jpg&v=3&w=400&s=uG4rvtayZ80U2-C3MGhV6xnT&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a35f2e251d2e547a8a29bb5b422820656e0a90e38466bba16d4dbcd7008ad94e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7202401
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7980
expires: Tue, 18 Apr 2023 20:43:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 14 KB
14 KB 21ms
16ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

752e5aeeee17ac71508d5b82c8ef4c1067100f4e80905c9ec2bfb0d8ba302c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=50052
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14566
expires: Thu, 26 Jan 2023 01:57:48 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 1 KB
1 KB 23ms
18ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100127920311001_0_1657634176398.jpg&v=3&w=400&s=W9gcJUNxkCrJPhOLhsskpkbF&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

375e021eea878a252407f1cade3523f6f4533fa251cf0727c70c887898a42b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6565766
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1252
expires: Tue, 11 Apr 2023 11:53:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 12 KB
12 KB 22ms
17ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100133954516000_0_1659459045107.jpg&v=3&w=400&s=W-Xap-JxrXI2GxoL16hfBWO-&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

23e9a944e80cf479ba7a8c45b5019700991c39f60a328d6d53a5acc91e4dd823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=5452984
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11844
expires: Wed, 29 Mar 2023 14:46:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 4 KB
4 KB 25ms
21ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F7%2F100073439815001_0_1656650697799.jpg&v=3&w=400&s=x_2ff1jbyVn79YsPsHUGHoGF&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

08dad37537a1311944f9f3ec50cce1c5c5eca667645d78032b0b68d8a658a0fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=5823226
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4080
expires: Sun, 02 Apr 2023 21:37:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 3 KB
4 KB 23ms
19ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100138269012000_0_1660902385367.jpg&v=3&w=400&s=LlmOkWQpVyE0fMYZhzalgS_g&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ea26064fffbbb526340d9e5416176537073f1a86c676041f2b7ad63ab9c367ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=6726497
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3390
expires: Thu, 13 Apr 2023 08:31:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 7 KB
7 KB 22ms
19ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F6%2F100130284911000_0_1654859609305.jpg&v=3&w=400&s=Wz4X_VeFhLsNdzVZPsTlybrL&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bb0c5ae74cc4811ef8cbd9b48cc1a822024574b300a44345c21fec42ae96c176

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7408569
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7200
expires: Fri, 21 Apr 2023 05:59:44 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 3 KB
3 KB 30ms
28ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F11%2F100133840813000_0_1667817701582.jpg&v=3&w=400&s=3VqsVlyudHsk9fQFYFjU3hha&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

6f546448acf820e74ae00f48af2b49efe00381ea2b178cc70b74146765993830

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7371749
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3092
expires: Thu, 20 Apr 2023 19:46:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 5 KB
5 KB 23ms
21ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Ftradebyte%2F02%2Fmedia%2F3072%2F26817-628619deb8b1a.jpg&v=3&w=400&s=CFsXAZZsPsLspfhvKm8unyPK&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

4b1e93529892b7f06b60e94f67eb3ccc1d7c1c1e760bcc38de14a765fb7eb50c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=19527
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4608
expires: Wed, 25 Jan 2023 17:29:03 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 6 KB
6 KB 22ms
20ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F10%2F100140037915000_0_1664881529754.jpg&v=3&w=400&s=-BLRflFgqa3-nGf9WIM3eayR&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7d84159abff8ee67a49b660d0d1aef9c838c6dcc7436c9b9e753a22b3cd294b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7340737
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5834
expires: Thu, 20 Apr 2023 11:09:13 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 4 KB
4 KB 29ms
27ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Ftradebyte%2F02%2Fmedia%2F2463%2F366250-63464bcab81f0.jpg&v=3&w=400&s=K7ePwxE47YAGEIOFnLWJsVX-&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a74dbe391d1b70efea8cb0d538724a4a5dca381db7528d7b1de55352a9c74e47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7365646
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3684
expires: Thu, 20 Apr 2023 18:04:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 4 KB
5 KB 27ms
25ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F12%2F100140158419500_0_1670759205819.jpg&v=3&w=400&s=KKYXb3DFDJ66NLqu4h33atFb&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f40268b52190ad94fe5a34b37958ab9666f1d99b2c35bee0c1fab24b38080fdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7068865
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4492
expires: Mon, 17 Apr 2023 07:38:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 5 KB
5 KB 23ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F8%2F100137538812000_0_1659469927266.jpg&v=3&w=400&s=RSZkFqzJqFPAqO8HTSC45zj-&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

92ce40715e78f5d0435e3bcf57e34113ead0be54f46e77a1653f4780189696cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7617644
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5136
expires: Sun, 23 Apr 2023 16:04:20 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 10 KB
10 KB 29ms
27ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F6%2F100134022517001_0_1656420333124.jpg&v=3&w=400&s=SdmE1iztWQtSQIjxwgEYlw6R&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

8c6e197f9b0a3e11dbb9bf10f937d243becbe440d526e405ebf7e887cbf44f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:34 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7149349
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10218
expires: Tue, 18 Apr 2023 05:59:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 893E 7 KB
8 KB 27ms
26ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=8721&q=80&r=0&u=https%3A%2F%2Fcms.brnstc.de%2Fproduct_images%2F435x596%2Fcpro%2Fmedia%2Fimages%2Fproduct%2F22%2F10%2F100132858717500_0_1664906712937.jpg&v=3&w=400&s=T_wYy1hAwHJpriNP22nutoGn&b=400

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

fccfce221f5d033301592f4d78b9ca4b08c025aaff07dfe416201aaccf6d3731

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7578049
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7464
expires: Sun, 23 Apr 2023 05:04:25 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 3A28 17 KB
6 KB 66ms
65ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
H3 200 pubads_impl_2023012301.js Show response
securepubads.g.doubleclick.net/gpt/ Frame A90E 385 KB
130 KB 36ms
27ms Script
text/javascript 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79e66558ee620ce57bc0a6be17a96c32074065e763b49f0be5551799623943a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 15:58:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158698
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133281
x-xss-protection: 0
last-modified: Mon, 23 Jan 2023 09:36:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 23 Jan 2024 15:58:37 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ Frame A90E 268 B
152 B 68ms
59ms XHR
application/json 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4409401d274e605a324c4235871c50361f98f05de3963a9a4ca2cba2f9223707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 127
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:35 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame C130 107 B
122 B 45ms
45ms Script
application/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame C130 107 B
122 B 47ms
47ms Script
application/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame C130 17 KB
8 KB 347ms
347ms XHR
text/plain 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4291472681348779&correlator=1273733679590416&eid=31071819%2C31071824%2C31071826%2C31071840&output=ldjh&gdfp_req=1&vrg=2023012302&ptt=17&impl=fif&iu_parts=21902364955%3A22652385948%2Ccm_pu_returnofdisasterclasshero.com_books_and_literature_comics_and_graphic_novels_top%2Ccm_pu_returnofdisasterclasshero.com_books_and_literature_comics_and_graphic_novels_btf_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C468x60%7C336x280%7C300x600%7C300x250%7C160x600%7C120x600%7C200x200%7C250x250%7C320x100%7C320x50%7C320x480%7C300x100&ifi=1&adks=3575694295&sfv=1-0-40&eri=4&sc=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&abxe=1&dt=1674648215870&dlt=1674648215461&idt=399&adxs=276&adys=527&biw=1600&bih=1200&isw=728&ish=90&scr_x=0&scr_y=0&btvi=0&ucis=5canjn2zqaot&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&top=returnofdisasterclasshero.com&frm=23&vis=1&psz=728x0&msz=728x0&fws=256&ohw=0&ea=0&ga_vid=1207468414.1674648214&ga_sid=1674648216&ga_hid=1833829765&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b896b02caf801467476e5280340221ff164b7be0bdbec0be8250477f5e20c212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7775
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C130 15 KB
11 KB 55ms
54ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2023012302&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8e1433257284d2d9c362ebc9cc5b2d9ab37d2fee70e29624955f6bd033efd28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11264
x-xss-protection: 0

GET
H2 200 container.html Show response
0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F027 6 KB
3 KB 57ms
15ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Thu, 25 Jan 2024 12:03:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 04F7 13 KB
5 KB 27ms
25ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11011
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:04 GMT
expires: Thu, 25 Jan 2024 09:00:04 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8F09 783 B
998 B 17ms
16ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b0a89ebadfa758790bb0724071f5538185d9f382fbedec2d75d14fa1c219c4d0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-u-aY6txQXUpaaI6dntWjWg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-u-aY6txQXUpaaI6dntWjWg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Wed, 25 Jan 2023 12:03:35 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame A90E 107 B
122 B 47ms
47ms Script
application/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame A90E 107 B
122 B 47ms
47ms Script
application/javascript 2a00:1450:400d:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=returnofdisasterclasshero.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame A90E 17 KB
7 KB 321ms
321ms XHR
text/plain 2a00:1450:400d:807::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1449949795513544&correlator=3480901909748560&eid=31071816%2C31071822%2C31071823%2C31071828%2C31068366&output=ldjh&gdfp_req=1&vrg=2023012301&ptt=17&impl=fif&iu_parts=21902364955%3A22652385948%2Ccm_pu_returnofdisasterclasshero.com_books_and_literature_comics_and_graphic_novels_top%2Ccm_pu_returnofdisasterclasshero.com_books_and_literature_comics_and_graphic_novels_btf_banner&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C468x60%7C336x280%7C300x600%7C300x250%7C160x600%7C120x600%7C200x200%7C250x250%7C320x100%7C320x50%7C320x480%7C300x100&ifi=1&adks=3575694295&sfv=1-0-40&eri=4&sc=1&cookie=ID%3D53fa6cd834f0043b-222fec0568db00d4%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg&gpic=UID%3D00000ba8ca13aa76%3AT%3D1674648214%3ART%3D1674648214%3AS%3DALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw&abxe=1&dt=1674648215919&dlt=1674648215505&idt=392&adxs=276&adys=2748&biw=1600&bih=1200&isw=728&ish=90&scr_x=0&scr_y=0&btvi=1&ucis=wsihsmkf3ccl&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Freturnofdisasterclasshero.com%2F&top=returnofdisasterclasshero.com&frm=23&vis=1&psz=728x0&msz=728x0&fws=256&ohw=0&ea=0&ga_vid=1207468414.1674648214&ga_sid=1674648216&ga_hid=1569567363&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:807::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a71642063b020952cadcf6d4c2cf6b48d594cbe4bf1ae5283bf6d10c4e95ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7571
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://returnofdisasterclasshero.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A90E 14 KB
11 KB 57ms
57ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2023012301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5c5983e49896f5993ab0ab4f248af3d9da907a93bc49a239f0e961f81d8a4c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11167
x-xss-protection: 0

GET
H2 200 container.html Show response
cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 87DB 6 KB
3 KB 66ms
15ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Thu, 25 Jan 2024 12:03:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C130 17 KB
6 KB 111ms
110ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8F09 0
0 109ms
108ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2023012302&jk=3043263596147497&rc=
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame 04F7 36 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16224
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A90E 17 KB
6 KB 166ms
166ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H2 200 container.html Show response
e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame CD55 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Thu, 25 Jan 2024 12:03:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 i
api.purpleads.io/x/a/63f398fbed1abd21a1e11412c75f5708:6708fe51a9c144265c1a04b90d446c2c8a005a0e66298bb3141b84af37ee4a8ee46645ce8c019637873e0685f140a2b58cf1623d25623bd7f315d434a2850a06360107c6e18dfda... Frame 0
0 103ms
103ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/a/63f398fbed1abd21a1e11412c75f5708:6708fe51a9c144265c1a04b90d446c2c8a005a0e66298bb3141b84af37ee4a8ee46645ce8c019637873e0685f140a2b58cf1623d25623bd7f315d434a2850a06360107c6e18dfda3dee28b1c1507dd7d73a4173ade44bc70b167dae65fb215ab5174b9f6a62991306fdba99ddf26e5fa5ea2f5bf8683d947740cae28ea4ba0050ec809ce3e667ee7204f03c5bc4f5938e457a7fb9e5f6be8ee25fba75724e694/i?id=0094e41d-6d81-44c1-a69b-fd793443dbf5&ts=1674648216012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:36 GMT
x-request-id: b3b19d13-5f6f-44b5-ae37-a13ed2aa4f3a

GET
H2 204 i
api.purpleads.io/x/a/63f398fbed1abd21a1e11412c75f5708:6708fe51a9c144265c1a04b90d446c2c8a005a0e66298bb3141b84af37ee4a8ee46645ce8c019637873e0685f140a2b58cf1623d25623bd7f315d434a2850a06360107c6e18dfda... 0
0 158ms
157ms Fetch 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/a/63f398fbed1abd21a1e11412c75f5708:6708fe51a9c144265c1a04b90d446c2c8a005a0e66298bb3141b84af37ee4a8ee46645ce8c019637873e0685f140a2b58cf1623d25623bd7f315d434a2850a06360107c6e18dfda3dee28b1c1507dd7d73a4173ade44bc70b167dae65fb215ab5174b9f6a62991306fdba99ddf26e5fa5ea2f5bf8683d947740cae28ea4ba0050ec809ce3e667ee7204f03c5bc4f5938e457a7fb9e5f6be8ee25fba75724e694/i?id=0094e41d-6d81-44c1-a69b-fd793443dbf5&ts=1674648216012
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:36 GMT
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
x-request-id: 79593681-495c-4105-b935-ec9ec70737aa

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7FD6 624 B
242 B 60ms
58ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDW4pWXBBjjodDdATAB&v=APEucNWlfhPAGqXGzleTUJnEuqhc18fIKGjLz2iB07ZdAUzEQwL80yn9obL9nMvSuu-34P70Wnjf6p3FA5Nw2wLyTKlOVq_3u7sEo-kS7vhvzdBP1bv31xhXK7s6Hk4fUqjS1ij3bY46jTRWnlBHwwYxv7tGXs9urHXFMG5rMmBaRHAbzjrJXYs

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame CD55 76 KB
27 KB 110ms
109ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc54379b6288f5970da471f0f64ca15f8c9e3a3819a0950608a45b7479d5a11f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27384
x-xss-protection: 0
server: cafe
etag: 10506132538256102613
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD55 42 B
63 B 110ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A5Yb47yUjBj5LxVGpehawiHh63hrWbLqG9c9gJ5OPLRYHwVtZlu-N1-poA7uEVz_-41M0lub8So5jAODGCiwthGv7pn8sEa6XuSDMTDGaRChxpcxM

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD55 0
20 B 110ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=740343352990812345&x=1&ct=77

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adition.js Show response
imagesrv.adition.com/js/ Frame CD55 32 KB
8 KB 61ms
16ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adition.js
Requested by: Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Thu, 21 Oct 2021 06:32:42 GMT
etag: "4043560335-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 8355

GET
H2 200 js Show response
ad4.adfarm1.adition.com/ Frame CD55 3 KB
2 KB 60ms
22ms Script
application/x-javascript 217.79.188.46
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4.adfarm1.adition.com/js?wp_id=4789020&clickurl=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI-qAMBqgSyAk_QiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI_FW-i0TD-u4IBVQ1lxU_lCY4rgHrXC-J52cAoAc8PMSI9HD7ol0YWrJen_gzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB_IGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs-YJiNWcAEvuil55EE4AQDkAYBoAZNgAfE_bDvA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT_-DX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE&ae=1&num=1&cid=CAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat_PNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw&sig=AOD64_2jQOgPOKBq6xellpwMVy7mZAa3Dg&client=ca-pub-5413329544040947&dbm_c=AKAmf-BHoJKMpaUy_6sITw6htf3Kqvidp4n8yA58CAGK-gXOurrKwe7uuqWHQA3OC4YKhH_gEwffl9vEKG9haAEzkb7s91pe5wX15T_LySUcP_VnRhPr2bR4C7Reg7kNrOhhfYhf7_wWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg&cry=1&dbm_d=AKAmf-DrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3_g5kIxuOLeMvTbnxXP_gLOz_IeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz-ejTt8ybKntby5IgpeQ9-oU-Ezyfj6_ODpqnNeEQ_3A69bAgpU7LmTi41FYI-IIJCeGL-oKcUVfKLSRnyCVKCowj-MPL2L1F-QvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp-6zJUCP9j54xYUM2z_xYm0MJOwgkJt-VK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ-rlabST8MNOGX2Z58_3Pno9nVDbh4d3Otec4ga7j3cs2_g5EG7sU-1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN_L4JU1Nyh30NMtekx3Qw3OOeUYn4K-FAq8Jm6LO2FgXKrv1j-oGXoDBG_HEOqBkz4vLT78TmGpNRCFK5bGqRIva&adurl=
Requested by: Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.46 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad4.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: a77918c4a5338c8732e4229d76dfbeefe5ddee9f78c0d78ef431a4a92c8a85b6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Wed, 25 Jan 2023 13:03:36 +0100
cache-control: max-age=600
content-encoding: gzip
content-type: application/x-javascript
server: ADITIONSERVER v1.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame CD55 3 KB
1 KB 26ms
24ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11011
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame CD55 18 KB
7 KB 27ms
26ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame CD55 0
0 17ms
16ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQpzIUjg4TIONymZgiy3_PZbx3TfUbegXlT8Ni_KuGqbVkMB-nShJSPFPWzv6tDuvnfKFb8hvjnfunjrq1c7GVGzK-ppg
Requested by: Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CD55 156 KB
48 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0379 13 KB
5 KB 27ms
26ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11012
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:04 GMT
expires: Thu, 25 Jan 2024 09:00:04 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame AB93 783 B
535 B 17ms
17ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e91cfc81671ebe7a4184747ec2e76157af7458385f4baf64bcb54f9016c11e90

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_w0CT9vg4RyPLofFy7DmTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-_w0CT9vg4RyPLofFy7DmTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:36 GMT
expires: Wed, 25 Jan 2023 12:03:36 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 04F7 0
10 B 25ms
25ms Image
text/plain 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?wDEzFQ
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 7FD6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1

43 B
766 B

9ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDW4pWXBBjjodDdATAB&v=APEucNWlfhPAGqXGzleTUJnEuqhc18fIKGjLz2iB07ZdAUzEQwL80yn9obL9nMvSuu-34P70Wnjf6p3FA5Nw2wLyTKlOVq_3u7sEo-kS7vhvzdBP1bv31xhXK7s6Hk4fUqjS1ij3bY46jTRWnlBHwwYxv7tGXs9urHXFMG5rMmBaRHAbzjrJXYs
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 25 Jan 2023 12:03:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 7FD6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y9EamNcM3V8Avk1UwdegBQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1

43 B
766 B

10ms
10ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDW4pWXBBjjodDdATAB&v=APEucNWlfhPAGqXGzleTUJnEuqhc18fIKGjLz2iB07ZdAUzEQwL80yn9obL9nMvSuu-34P70Wnjf6p3FA5Nw2wLyTKlOVq_3u7sEo-kS7vhvzdBP1bv31xhXK7s6Hk4fUqjS1ij3bY46jTRWnlBHwwYxv7tGXs9urHXFMG5rMmBaRHAbzjrJXYs
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 25 Jan 2023 12:03:36 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMyW405k6MtORDdBgsgcXKs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 7FD6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKIS9mwx-HS-702BVlviMsU&google_cver=1

43 B
1 KB

14ms
14ms

Image
image/gif

185.89.210.46
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKIS9mwx-HS-702BVlviMsU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDW4pWXBBjjodDdATAB&v=APEucNWlfhPAGqXGzleTUJnEuqhc18fIKGjLz2iB07ZdAUzEQwL80yn9obL9nMvSuu-34P70Wnjf6p3FA5Nw2wLyTKlOVq_3u7sEo-kS7vhvzdBP1bv31xhXK7s6Hk4fUqjS1ij3bY46jTRWnlBHwwYxv7tGXs9urHXFMG5rMmBaRHAbzjrJXYs

Protocol

HTTP/1.1

Server

185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 25 Jan 2023 12:03:36 GMT
AN-X-Request-Uuid: a6ed1f29-b2d5-49a8-9e7c-8281249a030f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKIS9mwx-HS-702BVlviMsU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7FD6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTUxMDgwOTIxNTE0NDE2MjM3MQ%3D%3D

170 B
188 B

48ms
48ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTUxMDgwOTIxNTE0NDE2MjM3MQ%3D%3D

Requested by

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 25 Jan 2023 12:03:36 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: bc4a4269-658b-4446-80fd-e0dca94a93c2
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTUxMDgwOTIxNTE0NDE2MjM3MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame AB93 0
0 110ms
109ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2023012302&jk=4291472681348779&rc=
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame 0379 36 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16225
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B3BA 42 B
64 B 108ms
108ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss-3FNQDG9tiqy8dpOEyaL3tdFAn1K8hI3sWjrg9VcZAC1oFCncduzuDrzjnUDeEYbn44ralz53MlW18zhesnUKUExl&sig=Cg0ArKJSzK8bIqa7JrFfEAE&id=lidar2&mcvt=1005&p=0,0,124,1005&mtos=121,787,1005,1090,1090&tos=121,666,218,85,0&v=20230123&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674648214741&rpt=316&met=ie&wmsd=0&pbe=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD55 0
20 B 107ms
107ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8284791658584&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD55 0
20 B 107ms
107ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8284791658584&version=m202209210101&ct=77&x=1&cor=740343352990812300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CD55 28 KB
17 KB 73ms
73ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AKZav90UXZI5tM_LUjNV6-jpMGaxlMMtJb_KexOpd2kuH-RmMxZW2kV4QtrGvVFhbxXN08s1vJDJjO-cT_x2UEQM1QvtUZP8teqmq-BQXYA36KXorA12o9EIt-zxiKsH1SLvMWzsJVE2u84r_Cakq1o6Hknj-jy9SyHx00VJ9a8uJscoM&cry=1&dbm_d=AKAmf-DNASF_deLWmbrWFi16__CipBzOPoW9nbqDgh8jbaDgFUM0S9JrED2kk3JfTIRghqB95Un693ta0FjbshoXmRKH4AOASoydK7Vcxn667xKVY6VHGN4WEclHPcY0GBr4F-Pp50t0qS1M36fAsduMRYAPrpbMqi4ejocFnFHqg4SktNSD1xqt8egHVgZrXUfdwlQRJ9C_4kLrAJiU9809t3SZwP08hins9ExdtLI2ug4PAKNyF6eK8r02BO0f8haTiWp9GQWTxemZe0ON7IjhQjsmLJYboP8bz-lNTgdqECHro2GoXzMcal3X7VPtxxlsLj191RWQ04A4xVZIGmS1x-TEakXr8yXtBQHJtBr5W5n06TG4K3OCBcOtIGDWAPH_xJyib90SpPWxffa4oTlvF6LIRkQx1UT6ViiTDrDc5tQZDuqgF2M9s1VHuoSMUtAArBXE4LlAWaaZYlY39k-KkMG7Nly19tSCsQBguzxI2nk5KQRItwj_iL0UzFoi28bVyWnL6J8P9awJl-sLImLO4cSa7lZLxPGJk-xieNxMwPpEFICb22miiznS-BB0biz-O-EdCkXkPGPWuzk6-L6SGPkB_i61xa9p5Nwz69HwfGB9H1YlnQNm4R7_mWVJ7DgBChmeP-zKwrc7IAaniZ5WMVr1JzRAVKhcHngvrylbbwAS0KkW_W-ozAMj7nMOLKKYRuRMAOuQzb07rl5Zvq91xB3l6U4mhFn_3EVTrLZ0SiUfHHjRS91o-98rwh729ZCQzUNTcJlEMn2e6T7pNOBswAIbKJe_fRFrLHnJjSqrEest9iM1jL70bYGTETWcxa_vg-GHFzmUyzokl55WOg7PgMTlSBipLXcOtm1GPZxdLeM95dejZJR4ec_T6S-LHzfxqM0ThsfeW1bxlPfS0hnNNKccDBA9_iWzaTDBbUJUsN02pnKgZM4JWPUh89qIco7lZMm2XBfU83AJar2FihrNw_R3Qy7tsPpbMnwyfIUax5XInRnHrMTxqparqAoSnpkliTvmD-LgiPuN0-dpVQr1FMl0Yvh0osnLLmLdqelXxdQ3yaRPJZ6TBZ4Nv2-JeKYa5f3-0YJ6ydRrOhpnrOhqpFpHTWhRADGfG-RqlI5b0S5Ejz1tfz5FCRqbp32AUygGcoyEOY43h_Z4Oy7BSlESKvwSg4zmn3dWRS4nielHnPI1fsCj4CIieOQmtzirKpzmAQlDRzYPqAhfS9W75blMNsQ9DD0bPHMH7-koH-Qzcl6EFGXeniUVQFjkwJRn2Jgs20nJdbKatOr7PpOXWT4hTNUZrx30aFrV01qsY_UMZyQEGCL3izerYwBfov9XjbDNKtWsDpIl64zlUK4Iri5bxz792WOZ2SWVRGrLx6H995mrSyyZ47Z4itp0dM54IkBS3Cxz6WMTiI3AtcVsoe2V83_lUFppDRiul84DdG3BJo8iyVzP1zX_RFUXPFCVMvGncTPrE4zqx4AJSjZA31uh6SGVD9fmtQGeoP74rjY15KeJxdWImr87609hvo4ABQYi4hxGpRBWTnZI9S_XZg0wfGGi_D8p8DFC_19GvURfFdKY5s901uUJ_1d5HQNiDkmvPLXEAY0koVpODzHY3bsl5YSlqDS2eYf7rY7iVfK0BmmDTVzN_i2iZp6xVjcMjR9KFFwYCky1Esgoz_NmjaGg7hmr9pqvaisAg3K20iVvuoGTp-OznhYT9AaC_VoPYjZvEaPH920Nlg2cEl0l7c09ZGtk98KRRLj80bi_u8VrfsrD5k_K73qyz2kznIiHLnM-sBmKqO3o7LkE-7-xg9WlXv0aOrSqtd93Yt_J_wVOYaaQVtuqTlOfzHxFYYFcdo4BZAnsnHN2omfZigkqgJ8ld4Tf3SVq1weqMlqfACkQQlr7Nhy8fclrTmE9NF64MdlsGH68QOUlNmdU1CVkzRNpMGXBcrd147hJntAFZQsCCYn1N1OK_xpuQU03GZHNicQggNrzHQvf9XKjKXFG2zbgEkiy8vPzEuVZbvGdpcXOFLrHSJXTwuj-XfrpzDl_Hxh0xVgopX10dzz8LP2kxALYNjtZ_puMWT4sNpO-nHu-BEc4kvnAEpDyyDWclo0SPhCE0Y_ckVH5qB15ZPrgpqHea3HficoqNAkUN8sMujAuckswq_VTCWZzw7gKxWft72G6VYMtkw3hQEt6gMAGwgh6FLob6LcvnurkcFZr0afJMeya-laN6nqyYprK2bv2Vb5e0lCUkk4xj5JUDVdMPmSFfmN9R0yzHBgHatpNx24LJPUgFEiUqMtNx_7vZqL-upf8qGWbzAtPr2bPFK7IxdtnTz1Kkq8drM__aitRrNfOpaHYcDBixp6ieo7j85uX-55dFqDf7FV__yROYZ1gStwe2ngDvRpkOHnVnrQNSRpY8QxsivmarLnXVmiwVwh_1pMDc9Z2jVgiKKHEoKpqTJcDR997xsQE-uZHN-lxoA6Od2lj4c_OfeadlEY85S9SmtMpALUULb50YGWY0RWLpduZ79LlwIOlSUJES7FIJa44LuJba4IlipfO_4mcrAglij4oUVpX_R4vsYT-5QuleWVMdXrzdABeIWn47_v_KbckHOI2B4xOQ94UvrmxxE31IBUg2oMi6wEeqwNE1ezi4wwnBU0S-zQ1Ye1gDNmu06hnjbKhlUoiGZlaFtwbSrO_4nBZbpgMXbFdZI1m7BEIJqk0RPFD55Qt7J6ia2jieRhBJGPQq29PK6jwDQjVur-Ayt_SUCcaokkSqN-5TEG-l-vtLw0hp3p4uy4aENolI-ofnqonHYnAt2_gmGGqyziDTv4vsomYjNd-zUCcqCQo1GaRvNq5Zm0biFYhK_mQyhAVjA0z1LbdMmY-T85ibPf_RaMQLV_UVHKKLDBJH8jo6VzHRUIH8kSVcDmaglX1zy0LyTjSHzXqFZC9pnL52vnRs2t-pBQ9yez6wPVJFOmPlWxSGVahwmUmFnjqeWtMlPTmiod7dyWxH9oqg3m-J6p5t13kU3ya2kHsIhUjBZMvcQksqPOnD0xEanO_QMXiH-0mfaxPu8x02s5npUmKFkh_V8GG4Nm3n7Sag4Mhsl1werLIaTeTbLkk5lV41PTrPPaPeeAaiIwUIsJ1xuSz4iXpd9kjLJ7BVEmp-5caSkryMOHZzHXe5WNVSwX_fRGfgNB3fyS4Bd-fbntCb_F3ZH_OGOv52N-CvrXg0zzKrLTc51HDF7Q5hMCEbaKgrkmxAgegGtyt8zq1TXgb-uVUNVb0DqqVN9p4wTarKtPHjeEaKqxcKU438Xe3WBwCp8SolvSxpO8bS1_uthjGRN74wWZR_o5SRdaC4Fv89PUV8Gk_GoOnNKR3ytSrBJG4e1VOmCWgR95SjMN61ef7SSu7PJpXa0md0DfyEgNwrw4bsDAPDn28SJBL_rPzj_SCPYihRBpHCNBuH7XI6O5PndoOZepW6wIpeuSnCEziT79ILPMj20FI12B_2GlUJrLFGeu2Ln-4uklLu7_JUYPu9wU8gp6qq2younL5quXEnL6d_ySfJVAHZvr7L_87sgDfzdhpsHjVfrCzsWFDTPM--uyhiTlEHsPc1cIsWxJc&cid=CAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat_PNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freturnofdisasterclasshero.com&ds=l&xdt=1&iif=1&cor=740343352990812300&adk=109667760&idt=113&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf98c19c125bd70626014b2f30256b2605e917cc01c7f31b89fb3cbbd2635483

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17157
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4CE9 13 KB
5 KB 26ms
25ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11012
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:04 GMT
expires: Thu, 25 Jan 2024 09:00:04 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B528 783 B
535 B 18ms
17ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8aaca6dd7322bae522f4371583a03d7c81aff57b57b6bb20fea799768a36fc2a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ddVsI7zdVO-DMfKI_JH3bQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-ddVsI7zdVO-DMfKI_JH3bQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:36 GMT
expires: Wed, 25 Jan 2023 12:03:36 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 container.html Show response
0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C30D 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012302.js?cb=31071840

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Thu, 25 Jan 2024 12:03:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 i
api.purpleads.io/x/a/1abbeda4002cda659aa846e266a52720:f5efbcce933eb21e020a78365594889594db67a84da2ebae2746c6918a9dd15c3a664ae589f9c398d6081107555942156ea583f5e650fb2fa5efa67598159848461a4688d51a3d3... Frame 0
0 99ms
99ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/a/1abbeda4002cda659aa846e266a52720:f5efbcce933eb21e020a78365594889594db67a84da2ebae2746c6918a9dd15c3a664ae589f9c398d6081107555942156ea583f5e650fb2fa5efa67598159848461a4688d51a3d3b0d2e1de1f2b5511f55b230e033672e4b9bb08d0d62740ea493154625e447161bc8db9dab04be1ca39a3b91b6fa69ae3b2ad11f263e7cdfd7191d050d116f9d31abdaf76259950d3573389f9dae5100994cfcf064090db7d7/i?id=b9b69a74-b3ea-4a5f-958c-582847aa85c8&ts=1674648216243
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:36 GMT
x-request-id: 64e63795-ad70-49e3-954a-ed518ccda7ff

GET
H2 204 i
api.purpleads.io/x/a/1abbeda4002cda659aa846e266a52720:f5efbcce933eb21e020a78365594889594db67a84da2ebae2746c6918a9dd15c3a664ae589f9c398d6081107555942156ea583f5e650fb2fa5efa67598159848461a4688d51a3d3... 0
0 539ms
538ms Fetch 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/a/1abbeda4002cda659aa846e266a52720:f5efbcce933eb21e020a78365594889594db67a84da2ebae2746c6918a9dd15c3a664ae589f9c398d6081107555942156ea583f5e650fb2fa5efa67598159848461a4688d51a3d3b0d2e1de1f2b5511f55b230e033672e4b9bb08d0d62740ea493154625e447161bc8db9dab04be1ca39a3b91b6fa69ae3b2ad11f263e7cdfd7191d050d116f9d31abdaf76259950d3573389f9dae5100994cfcf064090db7d7/i?id=b9b69a74-b3ea-4a5f-958c-582847aa85c8&ts=1674648216243
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:36 GMT
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
x-request-id: 4c92a7ae-3410-489a-8395-c04f4962395a

GET
H3 200 container.html Show response
cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FC6D 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023012301.js?cb=31071816

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:35 GMT
expires: Thu, 25 Jan 2024 12:03:35 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 i
api.purpleads.io/x/a/caa3f63b11ecb5ebb12a2d471dbc6d30:01b6484cb5a5b457343a8d46c32d26c2f7b1db258ddbeaaa43daaf8274880cde36d53894ecb6e88f0269bc5f0f52da4fcc9ddd4347d69b00a181a44251a1f0732f478ce8a8a0649... Frame 0
0 99ms
98ms Preflight 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/a/caa3f63b11ecb5ebb12a2d471dbc6d30:01b6484cb5a5b457343a8d46c32d26c2f7b1db258ddbeaaa43daaf8274880cde36d53894ecb6e88f0269bc5f0f52da4fcc9ddd4347d69b00a181a44251a1f0732f478ce8a8a06493c2ffa17d927084133731fb3acb944cde4c46eabc5c6d2672493dfc301f0bf4d1de1604d53426e897196db6a08936a18ea03f009a17921978465cf6f745b0c7e5fb6f18768cfc6895f2b83d25a995d404cb2336de44b1fa39/i?id=a0415210-2e86-4f0f-ad21-327c87599be2&ts=1674648216281
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,x-purpleads-version,x-request-url
Access-Control-Request-Method: GET
Origin: https://returnofdisasterclasshero.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,content-type,x-purpleads-version,x-request-url
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:36 GMT
x-request-id: d611aa8b-8179-4fae-892a-1c3221c6d423

GET
H2 204 i
api.purpleads.io/x/a/caa3f63b11ecb5ebb12a2d471dbc6d30:01b6484cb5a5b457343a8d46c32d26c2f7b1db258ddbeaaa43daaf8274880cde36d53894ecb6e88f0269bc5f0f52da4fcc9ddd4347d69b00a181a44251a1f0732f478ce8a8a0649... 0
0 271ms
262ms Fetch 18.204.127.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.purpleads.io/x/a/caa3f63b11ecb5ebb12a2d471dbc6d30:01b6484cb5a5b457343a8d46c32d26c2f7b1db258ddbeaaa43daaf8274880cde36d53894ecb6e88f0269bc5f0f52da4fcc9ddd4347d69b00a181a44251a1f0732f478ce8a8a06493c2ffa17d927084133731fb3acb944cde4c46eabc5c6d2672493dfc301f0bf4d1de1604d53426e897196db6a08936a18ea03f009a17921978465cf6f745b0c7e5fb6f18768cfc6895f2b83d25a995d404cb2336de44b1fa39/i?id=a0415210-2e86-4f0f-ad21-327c87599be2&ts=1674648216281
Requested by: Host: cdn.purpleads.io
URL: https://cdn.purpleads.io/agent.js?publisherId=3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.204.127.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-204-127-105.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

x-request-url: aHR0cHM6Ly9yZXR1cm5vZmRpc2FzdGVyY2xhc3NoZXJvLmNvbS8=
accept-language: de-DE,de;q=0.9
Authorization: Bearer 3a1fdf8dba3406a4ca49159f4cd696cb:375c66c899237a1676d0cc63f24f7027a02c5f7c940a0dee127c2de33036b94e37655cf0abf79cdcef048d06f5c16b611728f82cab1779a675faa6f4c5db4189
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: application/json
Accept: application/json
Referer: https://returnofdisasterclasshero.com/
x-purpleads-version: 2.5.0

Response headers

access-control-allow-origin: https://returnofdisasterclasshero.com
date: Wed, 25 Jan 2023 12:03:36 GMT
access-control-allow-credentials: true
access-control-allow-methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
x-request-id: 82f739ab-74e0-46ad-a2e1-8c290b70d02b

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DA35 640 B
262 B 61ms
60ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQj_jnAhiZuPTcATAB&v=APEucNWhJrYl8zayGX6Ce3mwSDqiVntniDczLIw8iPZ4eRRpuGpoLARXy7IZDJQ2qAIObp4lxCqqGBraBpHUCTJoA_F20WnXDSYvPHBZvRV70B9aGk-DbSYMgsA9pK3TDbJlj_mOEY8ZXsVRVMYGcxzrmujd3OivCL_VC718d4JaTv1Ed4Kvgps

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C30D 76 KB
27 KB 114ms
112ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc54379b6288f5970da471f0f64ca15f8c9e3a3819a0950608a45b7479d5a11f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27384
x-xss-protection: 0
server: cafe
etag: 10506132538256102613
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C30D 42 B
63 B 110ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C2WtJ-aZQjFgHQNrowHk3xviFv0SyNKX9f-137MoaXA7oiNcUhRdCqGeDOAl1RHO_VoVgEaKuS3eDmp3hUpwyZ8esQUojSkEpexOpd3VvC8Js_7rY

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C30D 0
20 B 109ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=7347711312252080206&x=1&ct=76

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame C30D 3 KB
1 KB 28ms
27ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11011
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame C30D 18 KB
7 KB 29ms
28ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C30D 0
0 16ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ-jt8Z4B6SdpgSJd-wONxwehPzRFhgKMfSlaCG-d7YysG8vLRC86tRr0dOCbg3b7pHGle7u5Z3u8vB4jdy9DvZi121sw
Requested by: Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C30D 156 KB
48 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/ Frame CD55 28 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AKZav90UXZI5tM_LUjNV6-jpMGaxlMMtJb_KexOpd2kuH-RmMxZW2kV4QtrGvVFhbxXN08s1vJDJjO-cT_x2UEQM1QvtUZP8teqmq-BQXYA36KXorA12o9EIt-zxiKsH1SLvMWzsJVE2u84r_Cakq1o6Hknj-jy9SyHx00VJ9a8uJscoM&cry=1&dbm_d=AKAmf-DNASF_deLWmbrWFi16__CipBzOPoW9nbqDgh8jbaDgFUM0S9JrED2kk3JfTIRghqB95Un693ta0FjbshoXmRKH4AOASoydK7Vcxn667xKVY6VHGN4WEclHPcY0GBr4F-Pp50t0qS1M36fAsduMRYAPrpbMqi4ejocFnFHqg4SktNSD1xqt8egHVgZrXUfdwlQRJ9C_4kLrAJiU9809t3SZwP08hins9ExdtLI2ug4PAKNyF6eK8r02BO0f8haTiWp9GQWTxemZe0ON7IjhQjsmLJYboP8bz-lNTgdqECHro2GoXzMcal3X7VPtxxlsLj191RWQ04A4xVZIGmS1x-TEakXr8yXtBQHJtBr5W5n06TG4K3OCBcOtIGDWAPH_xJyib90SpPWxffa4oTlvF6LIRkQx1UT6ViiTDrDc5tQZDuqgF2M9s1VHuoSMUtAArBXE4LlAWaaZYlY39k-KkMG7Nly19tSCsQBguzxI2nk5KQRItwj_iL0UzFoi28bVyWnL6J8P9awJl-sLImLO4cSa7lZLxPGJk-xieNxMwPpEFICb22miiznS-BB0biz-O-EdCkXkPGPWuzk6-L6SGPkB_i61xa9p5Nwz69HwfGB9H1YlnQNm4R7_mWVJ7DgBChmeP-zKwrc7IAaniZ5WMVr1JzRAVKhcHngvrylbbwAS0KkW_W-ozAMj7nMOLKKYRuRMAOuQzb07rl5Zvq91xB3l6U4mhFn_3EVTrLZ0SiUfHHjRS91o-98rwh729ZCQzUNTcJlEMn2e6T7pNOBswAIbKJe_fRFrLHnJjSqrEest9iM1jL70bYGTETWcxa_vg-GHFzmUyzokl55WOg7PgMTlSBipLXcOtm1GPZxdLeM95dejZJR4ec_T6S-LHzfxqM0ThsfeW1bxlPfS0hnNNKccDBA9_iWzaTDBbUJUsN02pnKgZM4JWPUh89qIco7lZMm2XBfU83AJar2FihrNw_R3Qy7tsPpbMnwyfIUax5XInRnHrMTxqparqAoSnpkliTvmD-LgiPuN0-dpVQr1FMl0Yvh0osnLLmLdqelXxdQ3yaRPJZ6TBZ4Nv2-JeKYa5f3-0YJ6ydRrOhpnrOhqpFpHTWhRADGfG-RqlI5b0S5Ejz1tfz5FCRqbp32AUygGcoyEOY43h_Z4Oy7BSlESKvwSg4zmn3dWRS4nielHnPI1fsCj4CIieOQmtzirKpzmAQlDRzYPqAhfS9W75blMNsQ9DD0bPHMH7-koH-Qzcl6EFGXeniUVQFjkwJRn2Jgs20nJdbKatOr7PpOXWT4hTNUZrx30aFrV01qsY_UMZyQEGCL3izerYwBfov9XjbDNKtWsDpIl64zlUK4Iri5bxz792WOZ2SWVRGrLx6H995mrSyyZ47Z4itp0dM54IkBS3Cxz6WMTiI3AtcVsoe2V83_lUFppDRiul84DdG3BJo8iyVzP1zX_RFUXPFCVMvGncTPrE4zqx4AJSjZA31uh6SGVD9fmtQGeoP74rjY15KeJxdWImr87609hvo4ABQYi4hxGpRBWTnZI9S_XZg0wfGGi_D8p8DFC_19GvURfFdKY5s901uUJ_1d5HQNiDkmvPLXEAY0koVpODzHY3bsl5YSlqDS2eYf7rY7iVfK0BmmDTVzN_i2iZp6xVjcMjR9KFFwYCky1Esgoz_NmjaGg7hmr9pqvaisAg3K20iVvuoGTp-OznhYT9AaC_VoPYjZvEaPH920Nlg2cEl0l7c09ZGtk98KRRLj80bi_u8VrfsrD5k_K73qyz2kznIiHLnM-sBmKqO3o7LkE-7-xg9WlXv0aOrSqtd93Yt_J_wVOYaaQVtuqTlOfzHxFYYFcdo4BZAnsnHN2omfZigkqgJ8ld4Tf3SVq1weqMlqfACkQQlr7Nhy8fclrTmE9NF64MdlsGH68QOUlNmdU1CVkzRNpMGXBcrd147hJntAFZQsCCYn1N1OK_xpuQU03GZHNicQggNrzHQvf9XKjKXFG2zbgEkiy8vPzEuVZbvGdpcXOFLrHSJXTwuj-XfrpzDl_Hxh0xVgopX10dzz8LP2kxALYNjtZ_puMWT4sNpO-nHu-BEc4kvnAEpDyyDWclo0SPhCE0Y_ckVH5qB15ZPrgpqHea3HficoqNAkUN8sMujAuckswq_VTCWZzw7gKxWft72G6VYMtkw3hQEt6gMAGwgh6FLob6LcvnurkcFZr0afJMeya-laN6nqyYprK2bv2Vb5e0lCUkk4xj5JUDVdMPmSFfmN9R0yzHBgHatpNx24LJPUgFEiUqMtNx_7vZqL-upf8qGWbzAtPr2bPFK7IxdtnTz1Kkq8drM__aitRrNfOpaHYcDBixp6ieo7j85uX-55dFqDf7FV__yROYZ1gStwe2ngDvRpkOHnVnrQNSRpY8QxsivmarLnXVmiwVwh_1pMDc9Z2jVgiKKHEoKpqTJcDR997xsQE-uZHN-lxoA6Od2lj4c_OfeadlEY85S9SmtMpALUULb50YGWY0RWLpduZ79LlwIOlSUJES7FIJa44LuJba4IlipfO_4mcrAglij4oUVpX_R4vsYT-5QuleWVMdXrzdABeIWn47_v_KbckHOI2B4xOQ94UvrmxxE31IBUg2oMi6wEeqwNE1ezi4wwnBU0S-zQ1Ye1gDNmu06hnjbKhlUoiGZlaFtwbSrO_4nBZbpgMXbFdZI1m7BEIJqk0RPFD55Qt7J6ia2jieRhBJGPQq29PK6jwDQjVur-Ayt_SUCcaokkSqN-5TEG-l-vtLw0hp3p4uy4aENolI-ofnqonHYnAt2_gmGGqyziDTv4vsomYjNd-zUCcqCQo1GaRvNq5Zm0biFYhK_mQyhAVjA0z1LbdMmY-T85ibPf_RaMQLV_UVHKKLDBJH8jo6VzHRUIH8kSVcDmaglX1zy0LyTjSHzXqFZC9pnL52vnRs2t-pBQ9yez6wPVJFOmPlWxSGVahwmUmFnjqeWtMlPTmiod7dyWxH9oqg3m-J6p5t13kU3ya2kHsIhUjBZMvcQksqPOnD0xEanO_QMXiH-0mfaxPu8x02s5npUmKFkh_V8GG4Nm3n7Sag4Mhsl1werLIaTeTbLkk5lV41PTrPPaPeeAaiIwUIsJ1xuSz4iXpd9kjLJ7BVEmp-5caSkryMOHZzHXe5WNVSwX_fRGfgNB3fyS4Bd-fbntCb_F3ZH_OGOv52N-CvrXg0zzKrLTc51HDF7Q5hMCEbaKgrkmxAgegGtyt8zq1TXgb-uVUNVb0DqqVN9p4wTarKtPHjeEaKqxcKU438Xe3WBwCp8SolvSxpO8bS1_uthjGRN74wWZR_o5SRdaC4Fv89PUV8Gk_GoOnNKR3ytSrBJG4e1VOmCWgR95SjMN61ef7SSu7PJpXa0md0DfyEgNwrw4bsDAPDn28SJBL_rPzj_SCPYihRBpHCNBuH7XI6O5PndoOZepW6wIpeuSnCEziT79ILPMj20FI12B_2GlUJrLFGeu2Ln-4uklLu7_JUYPu9wU8gp6qq2younL5quXEnL6d_ySfJVAHZvr7L_87sgDfzdhpsHjVfrCzsWFDTPM--uyhiTlEHsPc1cIsWxJc&cid=CAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat_PNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freturnofdisasterclasshero.com&ds=l&xdt=1&iif=1&cor=740343352990812300&adk=109667760&idt=113&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f9909775d48d612aae837f0153817e8addbfa082f901254471bced4d8c72691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:17:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49541
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10810
x-xss-protection: 0
server: cafe
etag: 8766511519597269738
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 22:17:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame CD55 41 KB
15 KB 26ms
26ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11011
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jan 2024 09:00:05 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0379 0
10 B 26ms
25ms Image
text/plain 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Gmgsaw
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 02F7 640 B
262 B 59ms
57ms Document
text/html 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjG8_zbATAB&v=APEucNXg4LLDbFn4SefwSrscBejaC2SOJSnuYd0LG9Zpwz6319a6OiRuP7EiPt3KguUsZYBTgSJy068KiaiUKQy1iah3ycp3yDuwWfs6OJJZdymo840HYHMCjmoI1LahfuDrPxv237YiNWuBquApNdwAg9uH1G4zSQfEdrAaBDMErcK3g_bWapU

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame FC6D 76 KB
27 KB 172ms
167ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc54379b6288f5970da471f0f64ca15f8c9e3a3819a0950608a45b7479d5a11f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27384
x-xss-protection: 0
server: cafe
etag: 10506132538256102613
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC6D 42 B
63 B 114ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AJRXn43iKP5TW1yTsVOhoyiS4yMlWub_JU4zs-ytPuvlelUJSi4S1sKgHtLfrrlf--u-8vCdx7B2IaV2s3XSFAqEmflIer_BEJ_IGFxPDAK4bcv7g

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC6D 0
20 B 114ms
108ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1069454614765414448&x=1&ct=76

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame FC6D 3 KB
1 KB 33ms
27ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/window_focus_fy2021.js

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11011
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/ Frame FC6D 18 KB
7 KB 33ms
28ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230123/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7523
x-xss-protection: 0
server: cafe
etag: 641023367890010850
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Feb 2023 09:00:06 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FC6D 0
0 20ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSi1znTqvy29i8ZOP5ixz7myKJgBtrl1P-12xEwoYPYamveo3Yn6OlwlzAPklKYxx6jvLff-03mLLnayVU15sRJD0C2Lg
Requested by: Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FC6D 156 KB
48 KB 25ms
20ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48884
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1674478187548999"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B528 0
0 112ms
107ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2023012301&jk=1449949795513544&rc=
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

POST
H2 200 all
csm.eu.criteo.net/ Frame 1231 0
127 B 15ms
14ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:35 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame 4CE9 36 KB
14 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16225
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H2 200 banner Show response
ad4.adfarm1.adition.com/ Frame CD55 6 KB
3 KB 28ms
22ms Script
text/javascript 217.79.188.46
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4.adfarm1.adition.com/banner?sid=4789020&adjsver=3&fvers=&iframe=1&ref=https%3A//returnofdisasterclasshero.com/&ro=https%3A//e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html%3Fn%3D1&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/109.0.5414.74%20Safari/537.36&os=17&browser=11&userid=7192559315748714650&wi=273368169&ac=1&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3D
Requested by: Host: ad4.adfarm1.adition.com
URL: https://ad4.adfarm1.adition.com/js?wp_id=4789020&clickurl=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI-qAMBqgSyAk_QiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI_FW-i0TD-u4IBVQ1lxU_lCY4rgHrXC-J52cAoAc8PMSI9HD7ol0YWrJen_gzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB_IGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs-YJiNWcAEvuil55EE4AQDkAYBoAZNgAfE_bDvA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT_-DX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE&ae=1&num=1&cid=CAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat_PNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw&sig=AOD64_2jQOgPOKBq6xellpwMVy7mZAa3Dg&client=ca-pub-5413329544040947&dbm_c=AKAmf-BHoJKMpaUy_6sITw6htf3Kqvidp4n8yA58CAGK-gXOurrKwe7uuqWHQA3OC4YKhH_gEwffl9vEKG9haAEzkb7s91pe5wX15T_LySUcP_VnRhPr2bR4C7Reg7kNrOhhfYhf7_wWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg&cry=1&dbm_d=AKAmf-DrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3_g5kIxuOLeMvTbnxXP_gLOz_IeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz-ejTt8ybKntby5IgpeQ9-oU-Ezyfj6_ODpqnNeEQ_3A69bAgpU7LmTi41FYI-IIJCeGL-oKcUVfKLSRnyCVKCowj-MPL2L1F-QvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp-6zJUCP9j54xYUM2z_xYm0MJOwgkJt-VK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ-rlabST8MNOGX2Z58_3Pno9nVDbh4d3Otec4ga7j3cs2_g5EG7sU-1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN_L4JU1Nyh30NMtekx3Qw3OOeUYn4K-FAq8Jm6LO2FgXKrv1j-oGXoDBG_HEOqBkz4vLT78TmGpNRCFK5bGqRIva&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.46 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad4.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 09b39faea4943abed73f1ca5095f3cbc2e61a10185d4a48b824fae621d11efc7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 13:03:36 +0100
content-encoding: gzip
server: ADITIONSERVER v1.0
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
content-type: text/javascript
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0598 22 KB
8 KB 26ms
25ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11011
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:05 GMT
expires: Thu, 25 Jan 2024 09:00:05 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 all
csm.eu.criteo.net/ Frame EFCB 0
127 B 14ms
13ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame DA35
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1

43 B
114 B

17ms
16ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQj_jnAhiZuPTcATAB&v=APEucNWhJrYl8zayGX6Ce3mwSDqiVntniDczLIw8iPZ4eRRpuGpoLARXy7IZDJQ2qAIObp4lxCqqGBraBpHUCTJoA_F20WnXDSYvPHBZvRV70B9aGk-DbSYMgsA9pK3TDbJlj_mOEY8ZXsVRVMYGcxzrmujd3OivCL_VC718d4JaTv1Ed4Kvgps
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame DA35 43 B
304 B 57ms
18ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQj_jnAhiZuPTcATAB&v=APEucNWhJrYl8zayGX6Ce3mwSDqiVntniDczLIw8iPZ4eRRpuGpoLARXy7IZDJQ2qAIObp4lxCqqGBraBpHUCTJoA_F20WnXDSYvPHBZvRV70B9aGk-DbSYMgsA9pK3TDbJlj_mOEY8ZXsVRVMYGcxzrmujd3OivCL_VC718d4JaTv1Ed4Kvgps
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame DA35
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1

23 B
172 B

39ms
38ms

Image
image/gif

23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQj_jnAhiZuPTcATAB&v=APEucNWhJrYl8zayGX6Ce3mwSDqiVntniDczLIw8iPZ4eRRpuGpoLARXy7IZDJQ2qAIObp4lxCqqGBraBpHUCTJoA_F20WnXDSYvPHBZvRV70B9aGk-DbSYMgsA9pK3TDbJlj_mOEY8ZXsVRVMYGcxzrmujd3OivCL_VC718d4JaTv1Ed4Kvgps
Protocol: H2
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

expires: Wed, 25 Jan 2023 12:03:36 GMT
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame DA35 23 B
172 B 36ms
35ms Image
image/gif 23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQj_jnAhiZuPTcATAB&v=APEucNWhJrYl8zayGX6Ce3mwSDqiVntniDczLIw8iPZ4eRRpuGpoLARXy7IZDJQ2qAIObp4lxCqqGBraBpHUCTJoA_F20WnXDSYvPHBZvRV70B9aGk-DbSYMgsA9pK3TDbJlj_mOEY8ZXsVRVMYGcxzrmujd3OivCL_VC718d4JaTv1Ed4Kvgps
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

expires: Wed, 25 Jan 2023 12:03:36 GMT
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 02F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1

43 B
61 B

18ms
17ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjG8_zbATAB&v=APEucNXg4LLDbFn4SefwSrscBejaC2SOJSnuYd0LG9Zpwz6319a6OiRuP7EiPt3KguUsZYBTgSJy068KiaiUKQy1iah3ycp3yDuwWfs6OJJZdymo840HYHMCjmoI1LahfuDrPxv237YiNWuBquApNdwAg9uH1G4zSQfEdrAaBDMErcK3g_bWapU
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFPYwY8hV0tjBHN4WyxaEVM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 02F7 43 B
120 B 39ms
21ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjG8_zbATAB&v=APEucNXg4LLDbFn4SefwSrscBejaC2SOJSnuYd0LG9Zpwz6319a6OiRuP7EiPt3KguUsZYBTgSJy068KiaiUKQy1iah3ycp3yDuwWfs6OJJZdymo840HYHMCjmoI1LahfuDrPxv237YiNWuBquApNdwAg9uH1G4zSQfEdrAaBDMErcK3g_bWapU
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 02F7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1

23 B
172 B

34ms
33ms

Image
image/gif

23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjG8_zbATAB&v=APEucNXg4LLDbFn4SefwSrscBejaC2SOJSnuYd0LG9Zpwz6319a6OiRuP7EiPt3KguUsZYBTgSJy068KiaiUKQy1iah3ycp3yDuwWfs6OJJZdymo840HYHMCjmoI1LahfuDrPxv237YiNWuBquApNdwAg9uH1G4zSQfEdrAaBDMErcK3g_bWapU
Protocol: H2
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

expires: Wed, 25 Jan 2023 12:03:36 GMT
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEFJZaGyNbTi_d0kpJ8lMC14&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 02F7 23 B
172 B 37ms
36ms Image
image/gif 23.35.237.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjG8_zbATAB&v=APEucNXg4LLDbFn4SefwSrscBejaC2SOJSnuYd0LG9Zpwz6319a6OiRuP7EiPt3KguUsZYBTgSJy068KiaiUKQy1iah3ycp3yDuwWfs6OJJZdymo840HYHMCjmoI1LahfuDrPxv237YiNWuBquApNdwAg9uH1G4zSQfEdrAaBDMErcK3g_bWapU
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.56 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-56.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

expires: Wed, 25 Jan 2023 12:03:36 GMT
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H2 200 js Show response
ad2.adfarm1.adition.com/ Frame CD55 3 KB
3 KB 64ms
19ms Script
application/x-javascript 217.79.188.21
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.adfarm1.adition.com/js?wp_id=4389191&gdpr=0&gdpr_consent=&ts=7192559320039620967&kid=5623783&keyword=PACS_4789020_17182597&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D
Requested by: Host: ad4.adfarm1.adition.com
URL: https://ad4.adfarm1.adition.com/banner?sid=4789020&adjsver=3&fvers=&iframe=1&ref=https%3A//returnofdisasterclasshero.com/&ro=https%3A//e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html%3Fn%3D1&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/109.0.5414.74%20Safari/537.36&os=17&browser=11&userid=7192559315748714650&wi=273368169&ac=1&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.21 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad2.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: c40754db0cdf6d076e637823f79a6da89bc1833883a8653572c1348651569726

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Wed, 25 Jan 2023 13:03:36 +0100
cache-control: max-age=600
content-encoding: gzip
content-type: application/x-javascript
server: ADITIONSERVER v1.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C30D 0
20 B 109ms
108ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2584239916365&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C30D 0
20 B 109ms
108ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2584239916365&version=m202209210101&ct=76&x=1&cor=7347711312252080000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C30D 88 KB
35 KB 87ms
86ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2yrVf3VN4uJ33GMBYf37RhPfABxLh6rgv0iyWDHQGPnvYRltnvchW4W9Ae8lQeyxT5Yv-wA421rLSiHGcykjhQGmFFXajS-YAIoNNSLSSIGSZgoeav8fr2gxVvnMDeCGswq21NU8PuQ-AJISaaFFbO_pJYAAFMO9dynTf7YXSDP0QPcE&dbm_d=AKAmf-DQEi_BkInZJd3WtUF7m3Toi1CMqZ2Tkmsky9dhZZf2YBUSbl2QwJTu47gl8a6s6evwpbBCtwjKGtmW2WpclxizAoMmZ_a1pzpWaRdMwPTF47Do1ixmIXKOi1rDUCURE1oHvTNjeqX8xpv4Rjj58_t0UtnVxSrLr1ZXmUMte-FsXNX5NMnjydWpCrb31rlJCS8lzPNfE2yX60tlR_dfwGgePFG5B7IJtC21DJZ7tfqWoXTg9IQe-Oj2GSgvTLpnIhwlZ-YPRED5Ak49NnduMHQUgk1hlWQiXfs-TmUuE7jDuk-o9l3_6uaToMnYRxy-G8RkYbdTyJ5qmwy7d5I1rKZUviFcklIbxAycvHwnZEYT5jomjwYKDdxFuSiie-yIRMgiT8yz0_q_7uJaKcbYEiWHrz1bPmBpXl9nbPjjhz_cBQTQEYk_FDhZ2tboYjshhNzX3lwMG9QnGH46oh5MG1keiUxU-eztlcNolkWJqHKUgGLPD-ghRWdpuQDvTqYoN-vjuWkiuwcje5n1ldYnYGozKz85T5C5PBpPuy9AkHtTFkaAUtNCz8raPQKwqfXLVjhbrMTSSj_ykhHzOjip28SpMnzTxO0ySeUKBXVOhdPRt_Gi3Bmw0awTSWE4F5-g59ySDLGH719DnlJFkcYDfPRbv6A_Oh5ytHveccyXWl0_Ki3z3jhiu_Gk4UqIdDtCzCmGZtTT0os8ij_4GmXjsU13GZQ0nbGimilCZYYfczyNm25YSQyiE-4xAmZlZygnVnHlXjV0G2wRfWFhtELKDwPyh2gQ_VJIN3U_7STJRBSx9RAxU4oAxyGFGjF6njWdzzFSchCx4vFh0OYCYWUUrYPEUw0-NtY8K3xeiMssOccle6KO4LnglD1He9cPdwDAN8Lp167M01mHo4WOvH2rbx2BEB5A7GGVt1qevgR3bGc4e_bxCJ2X5HVCsLtPAmMNokfw-xZvBlPCgO9BJcoZfCF4fJ89Rtq0s_IOoyTVVlpHR61ec7MpBOOswHL-Xkqh_2UqwpqdKqWa1YDJ622uUGOeAF4maoOou8WgB1FNSStRQo6ZO4wStHiHUxNX28czbEC_DwkzrPaHBX_XuHK7GaNqXyWTO8sI0ufYboEVp9Q4wuhoc5qwRwYHT5u3CBn6laKOJc0zjp_43VRmIbLRU7f_JSUEDewrUCYgROb7IYcuTtyQ5zJDhrGj81zGU044yTqJf6CMX8F52duoxByg2X-OTzsdYDKPtATJ8tOhAEGwItSIu9uB2-O_48fPCow1Wt9tSB4_FHO5mpPmFeQv75jbLQH5RIe_vwZMvuAZTzlKHr_eMfQHMQTBl6zv_n31rvX3JNL81v_l1de-3x6vGPiQLZdDP6E7tYC1JXGUuk1QH4Q18dKoz7rkQqWn7nhvwu1EV5Pmfh2LWqU9o4tyVUD63cfW9XELolawAAAibLbZt--1QLZTNgAdfhyErG7yx1AN5gRnK7XDdpU4IiJLuDx3MTUhI-RGF4GJdJJqIVFKzjmHwVYy4tVOraxKE4QHjG1ksFxuOc9f5uA8OthDtAFkjF8_nJpg9DyH_plVoI1I7ZQsJpCBiRFJFu-qBYSNTn8a7rXQgaYJNu-uy1bC6SjW7XyPRos9sEHi8nvG_J2s_Oyrko2UIRjeqE8AbL-22tEMDOo6Y8JOQvEFDW9rmRQdWDj7Jics4UNzOR5VWeUuwcA0stwaj6yo78CI_yZr4CcyRnRDg71dIxi9zDtNgjalp92w3AcHMeB7ahdLxSdF-KvjUb4Xc-NWgps-gQA6bZRHOcQlVsUXvc0RdclohntP4UZqBuCt0nLze-8jfHfHHWd4fWK2Tgy6m_5GkALp4s0pSqXOd3FqKPO9pLNleegJTYwPOCCEqT6NvvGqjOgAxYim0LVPOqTcrGvNh1_eqPeatJR8vsgDTq_M-30kxazb9sJ6u86vVSFTuPgcPmBE9B2SG-NUjcxZEq8N8vyfN1iFBhE0DWanj75RJ05kOGRfmxN2PGT8Mt9pE4wZfA-nblFxXZtG_imt5w6KwEQim9Y9h4wfVhKrlYxf8Fu8P9pRCOXeDBNs-ixMOIjCN2msXSk-OXvryN4VMC9xHlNhwCN3K8t-nXteAp4-Dj1lMLlfGsSDWw9oVKdG25YQxQTPWGJ7gG15qlbR0w_vcYN3VFtekl50HXYGEwCvVaZC0voLICCVcGLd5-A5ZzjTUSYF1AIfmTj_PdJdTYyJz3xULVxci2TTbRPnmJpbRskcKra8BckCr76aglZGWY4lm6EoQn2kgdchRNFqxj6HOjcOvTGTqunA6zXGfDiQDQNjSXqe1M1BDcyzCtSwFuWPdLry2SrF2VbajvXZnxWHcvL3Dz7PGqcFd74AKrpgTThj-Gt1A7c6ktgLxpg1cFO1lQLjEn-DzdxzpzdavegJgMpfuxNXdbKDB7tCYDICV0T81FJ9c0cVTnfkk4HnXLWchppRoh5NPvr0Vy1d_2xCv3W2vxHReoDM5NgzcwmN2regqzGbLa2MLz-BsdhZidbmW-v0-5Lc0btCBstSHkt3M4Dt2R3AXgjC5GbLEWQgeDhK39amebkIainyFaCBWRHC1iyytAexRLUf4M75JQis1Af5OHihnpWgE0QHO2wGrHB6H7dfYSo1u19Cx7n2b7YgDDAo6OjJ39jUAV1eIoAVrP2x_rjCZA41EIUwMgTPrczxytswlUHpcOBaakANPCkUNsa9zpnWhYiZc8B_UIjSqQZITIRgqWRke-kUTP0G_RdcCwSN_76MUfgz6ugm9ayyU1aUAxbrUmTg3p27hxXnJaMpPdDLovwhl61P9UlN5BDVOGakftvPmKy7Zgq2FjehKGNftriZHnkw2ZKbSlxgfHpWITcVhUh4LaBFADi46SGwvZLVqnVwXlnNrw4x-d_L3vzIKQ9HkVgUe50Xia3XyFIPdLztDjCiHMyu3iZI-u0IlixgWHDMs2oYblr61NqaC8o1bu_aG3CkC-ClVNoUzWTRRMxKnZIuABywe1EfxfU3a5bQ9RS0Jw0YmXS_mflJyoWE-Y7nqdRJkc1lKZrqpkuVwFzaHz0KuXbwrarQFuHT5eERKCLige4BH7l0u9IlWhJreBEn-rtSWxOqCbNGUIZDUew9Ew53FP4jGtQXiyqqYYvly5ACUf027C0gdTKXFOIpcUzOZsKKdFmkFAhfwSMXyHKvq8I-dlhKO5Y1ExJk1psocjqaRvvjh6wWMO4aoL5IVE7OW9dfofkZMXdjb1dp7qiwZMdrSRblR4Nm3ASHAXNJVM7wwccsbDQAHp6vkHzOY24gAmIGKmenEZiS-_RKZgJzPT1jfNSJ9EQ8p4VcCJtg-CSh2ZbxmON9Q7aFDWVvgksBqn5TBS0BXWkA4Z_NK-9K91PTJ1yOCOUzbYxGpmAaZsBVWVodM5IAMBXn7RsdAEQdaU6vHTVbFHr5NVsIaH8jIe_Nv56U7b09A32seKn2J1oadkH1plrXB1IYvijeOSZzrHFz57Zub1gcIPu7BNamhvORaMcsJZq2Fre11XJXhx3n9G9N1JsOh8RniMr0rTUe8EpW5wudjrzG3NFiVealjghTkHkT3JzZ5DBapMF067XumYG0Nea0ltecOMWQfM_3nmZbBIjbWY-iwJ9ErQhtB4yKFdep_73Te5jAVI0Mms-Ad5n5hE2d9rip-STQk8rE8EZfhUEvX1LFBkBHYy1SOlaF6jgUBeXfZ9JdYh3ZFfSZt2A8BLoq7h_zZiMbeaushaLeTUXuox2PNe-9MWNiZbL-&cid=CAQSOwDUE5ympZNO3FUuB7ZGaUh4falS5fl2Gntpr2hA84z8KjO-cmfEkK2Pbk-9ZpupcIk0z8WLVXGL67I5GAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freturnofdisasterclasshero.com&ds=l&xdt=1&iif=1&cor=7347711312252080000&adk=1307391552&idt=117&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

10336fcca756b989a08d89e11f8657c0a9a3d2f4400ce1e1622b5b7ca3293c0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36228
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 74A3 42 B
64 B 109ms
108ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstp76dcMFd5Tisn4nSa5NIW3YyNs102_5zKd9XDDeKE61hqBi9QmrVurFsXQ4rgzuF4cWqiBIDHtBpEsOQ7GNuwYAI&sig=Cg0ArKJSzNwd5ewPmZNjEAE&id=lidar2&mcvt=1021&p=0,0,600,120&mtos=1021,1021,1021,1021,1021&tos=1021,0,0,0,0&v=20230123&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674648214735&rpt=240&met=ie&wmsd=0&pbe=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame 0598 36 KB
14 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16225
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H2 200 banner Show response
ad2.adfarm1.adition.com/ Frame CD55 10 KB
4 KB 18ms
17ms Script
text/javascript 217.79.188.21
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.adfarm1.adition.com/banner?sid=4389191&adjsver=3&fvers=&iframe=1&ref=https%3A//returnofdisasterclasshero.com/&ro=https%3A//e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html%3Fn%3D1&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/109.0.5414.74%20Safari/537.36&os=17&browser=11&userid=7192559315748714650&kid=5623783&kw=PACS%5F4789020%5F17182597&gdpr=0&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D
Requested by: Host: ad2.adfarm1.adition.com
URL: https://ad2.adfarm1.adition.com/js?wp_id=4389191&gdpr=0&gdpr_consent=&ts=7192559320039620967&kid=5623783&keyword=PACS_4789020_17182597&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.21 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad2.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 8f382e5a3a2fdde68f5ab33189073c34de7981996f006a6f8782c0620ddf6616

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 13:03:36 +0100
content-encoding: gzip
server: ADITIONSERVER v1.0
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
content-type: text/javascript
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC6D 0
20 B 110ms
110ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2011544756524&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC6D 0
20 B 109ms
109ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2011544756524&version=m202209210101&ct=76&x=1&cor=1069454614765414400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FC6D 87 KB
36 KB 92ms
92ms Script
text/javascript 2a00:1450:400d:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6GmB8XG8Q6VcriC0m8vNTUZszbKA0te0LxXqyNWEwm3ClGPpSkzEFbwm7FNPj817_7MJaj4AfApoiKAgySR1cJaFH7caJ9C2WMNcGosAvIkga2f8Os5BauMCQM1l-CuY5D_kuxhJHvj5sMWJ5fynjPihyCYRuDVkl_HqCz0iekOk2m6k&dbm_d=AKAmf-DE8MAHPFZwhtrgK7p2Ed_09P8DlxrxG2Ly-F-EffjHub9r-OGNyY5aRnUTK6A9fzI1pafXGGs7KdTF7-0P5P4XLlTaPaArDOtQszwQ8X2d6mpauw-9955eLksoKFim6PLFOBJ-tkQ83IdG3QeUCUSfkbfzGNX6ooLDELX87ix2D_CUYU7pkVwxoNiZ9MCSS4C4UemJw7LwrVwo2jUIrMUYZLrCL-7K4q1LkL_hot01j3Y24AxMipCIgVjvsSpiVOghquuJmvutlGzBVBCit88Qcbpag8v-zk-RwKiDC9VdL1nbRBQaWGy5JcWgLbkjFbffc19TIU7sfGYLli8UXMuPJ3zBrrnC4Mn5mXSxHfFlcdSsA1a9ewlzxR7b9QPkmhBHUNGoBXkmS4nv9Q4R1g3xkjwrNzPy9MQwnggIym56c2ygB4uXynnRqFLDLPDmnY_KR1hO_7xf89iGzfx9PX7kz_4uJc_4d-iaaekBiOkd-ifmnfHTL9da1_UrkkbJBvOE1pzEwaZUWArIsw3RXwPQeQSknjEiY0frupaBowo8nNMb5bHU5jno4Z-Cih4nsTGxw7e9KWUBUU685X7DyhJDdYfW935VEZ2Win4NNh7CoFZfFTH8QktVLPpYB0rheI6RL0UQjeE-tCvuMZ6_7JYvr0m-KdK_TIA6SekL3IT_aXyuE7uxMPIJQr4g2yxqW3uJ8Dr27bbr807VrjgeCfOcMwb0AON3GqWoqe-4UGQywcUsP7-vGPxromkV1Spk478beQgBEVlE-Z77IV91avz8zjT-sSsHHoBqh4C87V9i-aF45Kl6V3nm6LyMPqK47wqIM7WF1-HsFJwyMR-rkoL3FSGuWkuyDMnYSfBS0RUeLE8rnYj2bvkMhWddZY6xDFln0hzIC0UhdPkLXcGcuAmvxdk3b5Incr_P3PTVp5xwJOAXt0b1wKE5HWYVJN6eRPm_r8MFEr0MGmRnGSme8lw0ZCQfg0XE1o90SG-6v2QeZ1UUw0C_e0bVBrQupHB25Itbi8WABBf_75mokbsqYfVwUGXc33InaJL-coPDO9RCYufejonfUkaHNzfAulvPA_uWOOq8EnFOrTi_YMAVGVuuoIv5s-kx182OOzFh6PZ2xq9D96IKLihwNnFXj0fJ2kw0-EjnkuKsRSlYZZKzux4TeggV2354905UKBU47ZnbOt62YxgJs9blrhiEbwVi4jp0XTguVzWjXNYOQDmR0Nzn1g5WcusMLR9w4Aj43Zsn6M_Aw6dYdEFKulPA1TBsKI0B_eNkUiQTiilnr-Zei6fAAsIEyzEyyp4crZmU6TUsv2Uskn5v6Gqge9HsBKvtn4nZ2ov9MOv-U23Q4q9ZFjtfy4HSken6dyIWBF38EyD3pha0pciLN-krdhTzKSMoHBhIqrDxjeGEhtGBeXFOpvfrqyWwYUGhloC13JdEK2gu7PHUBYVez99TRMDP8A9wT04A-K6b0_YNgouPJKULSCBPppZyqt8uaTEBTUANi5aU974NlISEq-hcAX3e7Etwvg31n43robYYBIMycUw95xkLrX4frnvP09GGKovV8QM8HjieylRESwVt7kzUqwxo4xE3kK0y7c9d9fIYgT4ZvciahXTgAdqEexV6kG6qr6MaiZ-OfcNSFkU_cxJC995mJ2OCAT8k3-hPXRmVzQtOnAtuYKW_ig-qP0Tytz6We7B0wg6ngA5DuN9tA_AfQfwNgnjS7MddEwKKSFHB1gW2wUuRhrCCEUFVrQlnxtWcUC6pMwwyrGV2VjfOIgrS1ZAVKbn7DHyyKiqdOGU9UOpLWlOcnI6dLedIS2JyVt3TRJH2Bya7uQChvg59eQXKqSjbUn1TO4CekMIfEW2mOw9jJSnL-znNW2XZt7TpYT3s24_FqMR2csefuBsY-z_9CM1kUZPc-GJSiF9L0nywrOSzIixyt4j_5WoE4GnnhR5XSCs9KTqQmAVqLtFsngtozpa49Dj4mmpdRFV2Y_mLYb4wICr5j8QmYP062bOWdTJPaIjHv1D5syIHrIikJDhc14TurntezlaE5uusfqIHOkNgwb0u5t1Bw_NMgtvLdjEoPLaGSPIbyBX6qbR1k7CkwLO1gO_HMUJXtSj2AqYQy-gw550m5A5HSe71nyP-fy-jbbJg8X2rNAHMqZfcHs9bVBXdDyg99pbxfaBbb44YDi4E-otcqHqz3kutgb08afuWJfdiQIWrIiUb7R2omPRMfCBiSlSGjBFS0NkPCJiVdATFKB7X64KWbnimCdGFfN4fCVr5i8deUnr5GHdVtQG-8CBP68fENCllgK6WHRZFJjQEr7_p9_qI4LZ6VRV-BR0_SYVSCCOV0Pq2fuNf7kzhB5ACNT6R4Lcihj6ODlG6GO2eRbXgeSR8krslOWR9hikOO1pvpKotOOr6ffApDmvWCmuL_nbUd7zdFhOou5i9K1euQ-0GY9LZXOr_26WhECamZDxvivMLa2Y5OREGiqVRNA_lGXGoAm9OSbAb4JpxFeTrkK_Z_KAVk_iML3ZOnBBP0CYfQ-CUEvn5WquMbyxQMmWsCOZKAm4R5jGJEZ4Ho89VfNjn4BakZimRwb8k1PzUxbgdcy_tOl5gOhH01A3n598abiHmiyAmgsMK56IuVv0zBKwg9mfZKNx6Op_COoIUB0cmhOpAozegLvwBirm4cd9q9nUO7pf1HrSioimFovabTZvZyz2SH4xa76EknSUpmaiDdHcOjv1bEuomWcEtA5v15VyF83PJI-21e7s2PcAo_EcNTVNIubLijZDsfkiGyn6lIZy4oIIMVPQbs7w6ltfeG1Aex9FV27j5E8VKCvzblvAz7Uypl82my6FRvRQYy_vA_E2sPkLPu8Wh39mYRy5NE-l1aH3iX5OziHg78p0xAxeqJE7Bq4R8p8fFBbn-skmGJlGK-TNCSDXT7P5Cvl8zGm0bZEbgir-I0Wr5p9hjjKeKf_mXtRA12P-tSgcapF8a-v-tmIaWvucBynubC76kpxKZD-c0T3xlh8k6w8ekKtUxYx5dNpG1FMnbIFrgchA0a3KQseZn3TmZfFRoFPKrhdE7Fozrf1MOZg3Mi76LLNHcwzk4kyShI16T0ORTP-mvWcV98C_GrfN0S8XiX2uxvNi-PSX5h7Nqaaaioica4yLcJnUOSVyyuO2ggxNtdZ3d3tYLvSw8eEuBWFNGS9qxI6He5yWA75XSyY7uWosA3ru00ndY3fliSOVvxHV8uraXGLAsYDXTkZ3xhOwWm4Q38TPuaoEPlzATO2ELG89jmQtQFtkYvrv9Ati1zg83YagU1AijkJY3Jrpj_0ZtEcyhtfQkj5nVIC87f7-EjqJamfulPpfDQMgi7eQAEqBh9UHyOkX3pus3DzQqcMLa-zZNc9z-0r6KMUflgJPgsEUVjmWa8GQdxu0PZo4RqbI7d2O4HxySMRaVJv0HMseJu7SJTSsCfYpcUgzS_8gsdjxEhrKYvTZuVNWVbOnbFVCOZc1dq7l0qd_Lo4WxAAmkzpnQh2eTcFElHb998uuL95MRal3ZiRGC6xuo7xGuld6MzHnhMVv-Rh8aufkE9y6F5QHxQBibSZgg&cid=CAQSOwDUE5ymysX1CNes-BWBp7dCP8FImmeXcYgo4zqdeXYMbQj3SS-_l7H8sqhh7l_O83QQiEatJSgvuQkiGAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freturnofdisasterclasshero.com&ds=l&xdt=1&iif=1&cor=1069454614765414400&adk=621368861&idt=176&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddcf0909c529a54c1ef1b830d132983b43262495b8a25068d167142c8e701466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 57 KB
5 KB 17ms
16ms Document
text/html 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 2b19d446b1ef3db413971d8d02335dd5abc4faffec5a2cf867e2dff6dcc59089

Request headers

Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
content-encoding: br
content-length: 4544
content-type: text/html
date: Wed, 25 Jan 2023 12:03:36 GMT
etag: "751520300-br"
last-modified: Mon, 02 Jan 2023 17:33:45 GMT
vary: Accept-Encoding

GET
H2 200 express_html_obb_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame C30D 119 KB
42 KB 115ms
29ms Script
text/javascript 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_276.js

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed44e345a8354731787a4fc575c66363aac13eebd6007b88aecd8a1deea341df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
Origin: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:14:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49762
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42405
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 22:14:14 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/elements/html/ Frame C30D 8 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2yrVf3VN4uJ33GMBYf37RhPfABxLh6rgv0iyWDHQGPnvYRltnvchW4W9Ae8lQeyxT5Yv-wA421rLSiHGcykjhQGmFFXajS-YAIoNNSLSSIGSZgoeav8fr2gxVvnMDeCGswq21NU8PuQ-AJISaaFFbO_pJYAAFMO9dynTf7YXSDP0QPcE&dbm_d=AKAmf-DQEi_BkInZJd3WtUF7m3Toi1CMqZ2Tkmsky9dhZZf2YBUSbl2QwJTu47gl8a6s6evwpbBCtwjKGtmW2WpclxizAoMmZ_a1pzpWaRdMwPTF47Do1ixmIXKOi1rDUCURE1oHvTNjeqX8xpv4Rjj58_t0UtnVxSrLr1ZXmUMte-FsXNX5NMnjydWpCrb31rlJCS8lzPNfE2yX60tlR_dfwGgePFG5B7IJtC21DJZ7tfqWoXTg9IQe-Oj2GSgvTLpnIhwlZ-YPRED5Ak49NnduMHQUgk1hlWQiXfs-TmUuE7jDuk-o9l3_6uaToMnYRxy-G8RkYbdTyJ5qmwy7d5I1rKZUviFcklIbxAycvHwnZEYT5jomjwYKDdxFuSiie-yIRMgiT8yz0_q_7uJaKcbYEiWHrz1bPmBpXl9nbPjjhz_cBQTQEYk_FDhZ2tboYjshhNzX3lwMG9QnGH46oh5MG1keiUxU-eztlcNolkWJqHKUgGLPD-ghRWdpuQDvTqYoN-vjuWkiuwcje5n1ldYnYGozKz85T5C5PBpPuy9AkHtTFkaAUtNCz8raPQKwqfXLVjhbrMTSSj_ykhHzOjip28SpMnzTxO0ySeUKBXVOhdPRt_Gi3Bmw0awTSWE4F5-g59ySDLGH719DnlJFkcYDfPRbv6A_Oh5ytHveccyXWl0_Ki3z3jhiu_Gk4UqIdDtCzCmGZtTT0os8ij_4GmXjsU13GZQ0nbGimilCZYYfczyNm25YSQyiE-4xAmZlZygnVnHlXjV0G2wRfWFhtELKDwPyh2gQ_VJIN3U_7STJRBSx9RAxU4oAxyGFGjF6njWdzzFSchCx4vFh0OYCYWUUrYPEUw0-NtY8K3xeiMssOccle6KO4LnglD1He9cPdwDAN8Lp167M01mHo4WOvH2rbx2BEB5A7GGVt1qevgR3bGc4e_bxCJ2X5HVCsLtPAmMNokfw-xZvBlPCgO9BJcoZfCF4fJ89Rtq0s_IOoyTVVlpHR61ec7MpBOOswHL-Xkqh_2UqwpqdKqWa1YDJ622uUGOeAF4maoOou8WgB1FNSStRQo6ZO4wStHiHUxNX28czbEC_DwkzrPaHBX_XuHK7GaNqXyWTO8sI0ufYboEVp9Q4wuhoc5qwRwYHT5u3CBn6laKOJc0zjp_43VRmIbLRU7f_JSUEDewrUCYgROb7IYcuTtyQ5zJDhrGj81zGU044yTqJf6CMX8F52duoxByg2X-OTzsdYDKPtATJ8tOhAEGwItSIu9uB2-O_48fPCow1Wt9tSB4_FHO5mpPmFeQv75jbLQH5RIe_vwZMvuAZTzlKHr_eMfQHMQTBl6zv_n31rvX3JNL81v_l1de-3x6vGPiQLZdDP6E7tYC1JXGUuk1QH4Q18dKoz7rkQqWn7nhvwu1EV5Pmfh2LWqU9o4tyVUD63cfW9XELolawAAAibLbZt--1QLZTNgAdfhyErG7yx1AN5gRnK7XDdpU4IiJLuDx3MTUhI-RGF4GJdJJqIVFKzjmHwVYy4tVOraxKE4QHjG1ksFxuOc9f5uA8OthDtAFkjF8_nJpg9DyH_plVoI1I7ZQsJpCBiRFJFu-qBYSNTn8a7rXQgaYJNu-uy1bC6SjW7XyPRos9sEHi8nvG_J2s_Oyrko2UIRjeqE8AbL-22tEMDOo6Y8JOQvEFDW9rmRQdWDj7Jics4UNzOR5VWeUuwcA0stwaj6yo78CI_yZr4CcyRnRDg71dIxi9zDtNgjalp92w3AcHMeB7ahdLxSdF-KvjUb4Xc-NWgps-gQA6bZRHOcQlVsUXvc0RdclohntP4UZqBuCt0nLze-8jfHfHHWd4fWK2Tgy6m_5GkALp4s0pSqXOd3FqKPO9pLNleegJTYwPOCCEqT6NvvGqjOgAxYim0LVPOqTcrGvNh1_eqPeatJR8vsgDTq_M-30kxazb9sJ6u86vVSFTuPgcPmBE9B2SG-NUjcxZEq8N8vyfN1iFBhE0DWanj75RJ05kOGRfmxN2PGT8Mt9pE4wZfA-nblFxXZtG_imt5w6KwEQim9Y9h4wfVhKrlYxf8Fu8P9pRCOXeDBNs-ixMOIjCN2msXSk-OXvryN4VMC9xHlNhwCN3K8t-nXteAp4-Dj1lMLlfGsSDWw9oVKdG25YQxQTPWGJ7gG15qlbR0w_vcYN3VFtekl50HXYGEwCvVaZC0voLICCVcGLd5-A5ZzjTUSYF1AIfmTj_PdJdTYyJz3xULVxci2TTbRPnmJpbRskcKra8BckCr76aglZGWY4lm6EoQn2kgdchRNFqxj6HOjcOvTGTqunA6zXGfDiQDQNjSXqe1M1BDcyzCtSwFuWPdLry2SrF2VbajvXZnxWHcvL3Dz7PGqcFd74AKrpgTThj-Gt1A7c6ktgLxpg1cFO1lQLjEn-DzdxzpzdavegJgMpfuxNXdbKDB7tCYDICV0T81FJ9c0cVTnfkk4HnXLWchppRoh5NPvr0Vy1d_2xCv3W2vxHReoDM5NgzcwmN2regqzGbLa2MLz-BsdhZidbmW-v0-5Lc0btCBstSHkt3M4Dt2R3AXgjC5GbLEWQgeDhK39amebkIainyFaCBWRHC1iyytAexRLUf4M75JQis1Af5OHihnpWgE0QHO2wGrHB6H7dfYSo1u19Cx7n2b7YgDDAo6OjJ39jUAV1eIoAVrP2x_rjCZA41EIUwMgTPrczxytswlUHpcOBaakANPCkUNsa9zpnWhYiZc8B_UIjSqQZITIRgqWRke-kUTP0G_RdcCwSN_76MUfgz6ugm9ayyU1aUAxbrUmTg3p27hxXnJaMpPdDLovwhl61P9UlN5BDVOGakftvPmKy7Zgq2FjehKGNftriZHnkw2ZKbSlxgfHpWITcVhUh4LaBFADi46SGwvZLVqnVwXlnNrw4x-d_L3vzIKQ9HkVgUe50Xia3XyFIPdLztDjCiHMyu3iZI-u0IlixgWHDMs2oYblr61NqaC8o1bu_aG3CkC-ClVNoUzWTRRMxKnZIuABywe1EfxfU3a5bQ9RS0Jw0YmXS_mflJyoWE-Y7nqdRJkc1lKZrqpkuVwFzaHz0KuXbwrarQFuHT5eERKCLige4BH7l0u9IlWhJreBEn-rtSWxOqCbNGUIZDUew9Ew53FP4jGtQXiyqqYYvly5ACUf027C0gdTKXFOIpcUzOZsKKdFmkFAhfwSMXyHKvq8I-dlhKO5Y1ExJk1psocjqaRvvjh6wWMO4aoL5IVE7OW9dfofkZMXdjb1dp7qiwZMdrSRblR4Nm3ASHAXNJVM7wwccsbDQAHp6vkHzOY24gAmIGKmenEZiS-_RKZgJzPT1jfNSJ9EQ8p4VcCJtg-CSh2ZbxmON9Q7aFDWVvgksBqn5TBS0BXWkA4Z_NK-9K91PTJ1yOCOUzbYxGpmAaZsBVWVodM5IAMBXn7RsdAEQdaU6vHTVbFHr5NVsIaH8jIe_Nv56U7b09A32seKn2J1oadkH1plrXB1IYvijeOSZzrHFz57Zub1gcIPu7BNamhvORaMcsJZq2Fre11XJXhx3n9G9N1JsOh8RniMr0rTUe8EpW5wudjrzG3NFiVealjghTkHkT3JzZ5DBapMF067XumYG0Nea0ltecOMWQfM_3nmZbBIjbWY-iwJ9ErQhtB4yKFdep_73Te5jAVI0Mms-Ad5n5hE2d9rip-STQk8rE8EZfhUEvX1LFBkBHYy1SOlaF6jgUBeXfZ9JdYh3ZFfSZt2A8BLoq7h_zZiMbeaushaLeTUXuox2PNe-9MWNiZbL-&cid=CAQSOwDUE5ympZNO3FUuB7ZGaUh4falS5fl2Gntpr2hA84z8KjO-cmfEkK2Pbk-9ZpupcIk0z8WLVXGL67I5GAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freturnofdisasterclasshero.com&ds=l&xdt=1&iif=1&cor=7347711312252080000&adk=1307391552&idt=117&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:08:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 22:08:36 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/ Frame C30D 28 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f9909775d48d612aae837f0153817e8addbfa082f901254471bced4d8c72691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:17:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49541
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10810
x-xss-protection: 0
server: cafe
etag: 8766511519597269738
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 22:17:55 GMT

GET
H2 200 oba_priv.sjs Show response
imagesrv.adition.com/banners/270/ Frame CD55 2 KB
669 B 22ms
21ms Script
text/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/270/oba_priv.sjs?oba=&domId=obaButton_7192559320039620967&btr=true&pos=top-right&cid=627838&aid=627838
Requested by: Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 074bec79664e9a3d860651a51a0f0894a522f745d1e530a808b90bc14294a814

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
content-length: 610
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9C9B 1 KB
643 B 8ms
7ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 13509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:18:27 GMT
etag: 48472445140208031
expires: Thu, 26 Jan 2023 08:18:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame CD55 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a39bd87812ca61ee7325919c95e0af3b8122afa33e8030700322efcecbe6d2ab

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4CE9 0
10 B 26ms
25ms Image
text/plain 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?THXNqg
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 AditionH5_ClickTags.js Show response
imagesrv.adition.com/js/ Frame B084 753 B
407 B 21ms
15ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/AditionH5_ClickTags.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5a0cecf509251de7b796c7c34ca1374bbb3fabe582e9e9394f1a1ebd9d421997

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Thu, 20 Aug 2020 14:03:40 GMT
etag: "1134380014-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 330

GET
H2 200 gwdpage_style.css
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 55 B
136 B 21ms
16ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdpage_style.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
last-modified: Wed, 19 Aug 2020 16:11:36 GMT
accept-ranges: bytes
etag: "2479477782"
content-length: 55
content-type: text/css

GET
H2 200 gwdpagedeck_style.css
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 731 B
256 B 22ms
16ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdpagedeck_style.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Mon, 17 Dec 2018 10:11:15 GMT
etag: "1290437402-br"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes
content-length: 176

GET
H2 200 gwdgooglead_style.css
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 24 B
99 B 23ms
17ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdgooglead_style.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
last-modified: Wed, 19 Aug 2020 16:11:35 GMT
accept-ranges: bytes
etag: "1181855707"
content-length: 24
content-type: text/css

GET
H2 200 gwdimage_style.css
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 303 B
185 B 23ms
18ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdimage_style.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 4e17f25a33727defde4f0e88b24844c00e48ed88484c4440d978025a82567287

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "659303641-br"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes
content-length: 106

GET
H2 200 gwdtaparea_style.css
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 157 B
234 B 23ms
19ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdtaparea_style.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
last-modified: Thu, 09 Jun 2016 07:59:31 GMT
accept-ranges: bytes
etag: "1827606775"
content-length: 157
content-type: text/css

GET
H3 200 css
fonts.googleapis.com/ Frame B084 5 KB
671 B 26ms
22ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:800italic,600italic

Requested by

Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e623fb84470c4897c59668165e7d2687c9760f9c054ac65ccea5305885bf8e6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 25 Jan 2023 10:27:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H2 200 googbase_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 400 B
302 B 24ms
19ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/googbase_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Mon, 17 May 2021 12:56:47 GMT
etag: "554705530-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 223

GET
H2 200 gwd_webcomponents_v1_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 20 KB
5 KB 32ms
28ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwd_webcomponents_v1_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: bddbf7e9ab14ce92ecc37640bf54fcb90d8a02da52d87ec12e252cfde4432e66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "3994037045-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 5439

GET
H2 200 gwdpage_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 3 KB
1 KB 40ms
13ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdpage_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: da1b1dba110f3d97894949bedfc60fe7fec3659813c957f88e51d550bc95ad88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "581922522-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 1130

GET
H2 200 gwdpagedeck_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 8 KB
3 KB 41ms
15ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdpagedeck_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: cfc5afa3cbf80ed8a39987d2f4cc9215f915cfde9c83e86d5ee4a874bd69a401

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "2693507592-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 2773

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame B084 136 KB
46 KB 98ms
26ms Script
text/javascript 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf6ec42c97f86957a324a484a37dd528b568a9ff2570965be53e6ec4b0dfdae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 11:54:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 575
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46978
x-xss-protection: 0
last-modified: Mon, 06 Jun 2022 19:45:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 12:09:01 GMT

GET
H2 200 gwdgooglead_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 13 KB
4 KB 41ms
16ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdgooglead_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 6494566919e28711a1f36d6389923dfccb4750fb9522e9e6d1967ab778ab0073

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "2671864840-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 3848

GET
H2 200 gwdimage_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 5 KB
2 KB 42ms
17ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdimage_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "4139855138-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 1779

GET
H2 200 gwdtaparea_min.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 3 KB
1 KB 43ms
18ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdtaparea_min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: b0e4d6e13eb1fd414025e5c3c3f18b9212fd0cd69890e7f69804ae69dec5bbb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "867610568-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 1183

GET
H2 200 gwdid.min.1.0.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 3 KB
1 KB 43ms
18ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwdid.min.1.0.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: bab745658ba458848b2d2df5e0557b98b70867124fd5a059fd25f9801e01a87c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "216984016-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 971

GET
H2 200 gwd-events-support.1.0.js Show response
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 8 KB
3 KB 44ms
19ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/gwd-events-support.1.0.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 31eba576e56105b427cc5072fdf87a2334b63d15933402686268d75dd5d9c69c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 20 Dec 2022 15:36:43 GMT
etag: "2869160403-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 2553

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame FC6D 170 KB
59 KB 43ms
42ms Script
text/javascript 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
Origin: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11011
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 26 Jan 2023 09:00:05 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/elements/html/ Frame FC6D 8 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6GmB8XG8Q6VcriC0m8vNTUZszbKA0te0LxXqyNWEwm3ClGPpSkzEFbwm7FNPj817_7MJaj4AfApoiKAgySR1cJaFH7caJ9C2WMNcGosAvIkga2f8Os5BauMCQM1l-CuY5D_kuxhJHvj5sMWJ5fynjPihyCYRuDVkl_HqCz0iekOk2m6k&dbm_d=AKAmf-DE8MAHPFZwhtrgK7p2Ed_09P8DlxrxG2Ly-F-EffjHub9r-OGNyY5aRnUTK6A9fzI1pafXGGs7KdTF7-0P5P4XLlTaPaArDOtQszwQ8X2d6mpauw-9955eLksoKFim6PLFOBJ-tkQ83IdG3QeUCUSfkbfzGNX6ooLDELX87ix2D_CUYU7pkVwxoNiZ9MCSS4C4UemJw7LwrVwo2jUIrMUYZLrCL-7K4q1LkL_hot01j3Y24AxMipCIgVjvsSpiVOghquuJmvutlGzBVBCit88Qcbpag8v-zk-RwKiDC9VdL1nbRBQaWGy5JcWgLbkjFbffc19TIU7sfGYLli8UXMuPJ3zBrrnC4Mn5mXSxHfFlcdSsA1a9ewlzxR7b9QPkmhBHUNGoBXkmS4nv9Q4R1g3xkjwrNzPy9MQwnggIym56c2ygB4uXynnRqFLDLPDmnY_KR1hO_7xf89iGzfx9PX7kz_4uJc_4d-iaaekBiOkd-ifmnfHTL9da1_UrkkbJBvOE1pzEwaZUWArIsw3RXwPQeQSknjEiY0frupaBowo8nNMb5bHU5jno4Z-Cih4nsTGxw7e9KWUBUU685X7DyhJDdYfW935VEZ2Win4NNh7CoFZfFTH8QktVLPpYB0rheI6RL0UQjeE-tCvuMZ6_7JYvr0m-KdK_TIA6SekL3IT_aXyuE7uxMPIJQr4g2yxqW3uJ8Dr27bbr807VrjgeCfOcMwb0AON3GqWoqe-4UGQywcUsP7-vGPxromkV1Spk478beQgBEVlE-Z77IV91avz8zjT-sSsHHoBqh4C87V9i-aF45Kl6V3nm6LyMPqK47wqIM7WF1-HsFJwyMR-rkoL3FSGuWkuyDMnYSfBS0RUeLE8rnYj2bvkMhWddZY6xDFln0hzIC0UhdPkLXcGcuAmvxdk3b5Incr_P3PTVp5xwJOAXt0b1wKE5HWYVJN6eRPm_r8MFEr0MGmRnGSme8lw0ZCQfg0XE1o90SG-6v2QeZ1UUw0C_e0bVBrQupHB25Itbi8WABBf_75mokbsqYfVwUGXc33InaJL-coPDO9RCYufejonfUkaHNzfAulvPA_uWOOq8EnFOrTi_YMAVGVuuoIv5s-kx182OOzFh6PZ2xq9D96IKLihwNnFXj0fJ2kw0-EjnkuKsRSlYZZKzux4TeggV2354905UKBU47ZnbOt62YxgJs9blrhiEbwVi4jp0XTguVzWjXNYOQDmR0Nzn1g5WcusMLR9w4Aj43Zsn6M_Aw6dYdEFKulPA1TBsKI0B_eNkUiQTiilnr-Zei6fAAsIEyzEyyp4crZmU6TUsv2Uskn5v6Gqge9HsBKvtn4nZ2ov9MOv-U23Q4q9ZFjtfy4HSken6dyIWBF38EyD3pha0pciLN-krdhTzKSMoHBhIqrDxjeGEhtGBeXFOpvfrqyWwYUGhloC13JdEK2gu7PHUBYVez99TRMDP8A9wT04A-K6b0_YNgouPJKULSCBPppZyqt8uaTEBTUANi5aU974NlISEq-hcAX3e7Etwvg31n43robYYBIMycUw95xkLrX4frnvP09GGKovV8QM8HjieylRESwVt7kzUqwxo4xE3kK0y7c9d9fIYgT4ZvciahXTgAdqEexV6kG6qr6MaiZ-OfcNSFkU_cxJC995mJ2OCAT8k3-hPXRmVzQtOnAtuYKW_ig-qP0Tytz6We7B0wg6ngA5DuN9tA_AfQfwNgnjS7MddEwKKSFHB1gW2wUuRhrCCEUFVrQlnxtWcUC6pMwwyrGV2VjfOIgrS1ZAVKbn7DHyyKiqdOGU9UOpLWlOcnI6dLedIS2JyVt3TRJH2Bya7uQChvg59eQXKqSjbUn1TO4CekMIfEW2mOw9jJSnL-znNW2XZt7TpYT3s24_FqMR2csefuBsY-z_9CM1kUZPc-GJSiF9L0nywrOSzIixyt4j_5WoE4GnnhR5XSCs9KTqQmAVqLtFsngtozpa49Dj4mmpdRFV2Y_mLYb4wICr5j8QmYP062bOWdTJPaIjHv1D5syIHrIikJDhc14TurntezlaE5uusfqIHOkNgwb0u5t1Bw_NMgtvLdjEoPLaGSPIbyBX6qbR1k7CkwLO1gO_HMUJXtSj2AqYQy-gw550m5A5HSe71nyP-fy-jbbJg8X2rNAHMqZfcHs9bVBXdDyg99pbxfaBbb44YDi4E-otcqHqz3kutgb08afuWJfdiQIWrIiUb7R2omPRMfCBiSlSGjBFS0NkPCJiVdATFKB7X64KWbnimCdGFfN4fCVr5i8deUnr5GHdVtQG-8CBP68fENCllgK6WHRZFJjQEr7_p9_qI4LZ6VRV-BR0_SYVSCCOV0Pq2fuNf7kzhB5ACNT6R4Lcihj6ODlG6GO2eRbXgeSR8krslOWR9hikOO1pvpKotOOr6ffApDmvWCmuL_nbUd7zdFhOou5i9K1euQ-0GY9LZXOr_26WhECamZDxvivMLa2Y5OREGiqVRNA_lGXGoAm9OSbAb4JpxFeTrkK_Z_KAVk_iML3ZOnBBP0CYfQ-CUEvn5WquMbyxQMmWsCOZKAm4R5jGJEZ4Ho89VfNjn4BakZimRwb8k1PzUxbgdcy_tOl5gOhH01A3n598abiHmiyAmgsMK56IuVv0zBKwg9mfZKNx6Op_COoIUB0cmhOpAozegLvwBirm4cd9q9nUO7pf1HrSioimFovabTZvZyz2SH4xa76EknSUpmaiDdHcOjv1bEuomWcEtA5v15VyF83PJI-21e7s2PcAo_EcNTVNIubLijZDsfkiGyn6lIZy4oIIMVPQbs7w6ltfeG1Aex9FV27j5E8VKCvzblvAz7Uypl82my6FRvRQYy_vA_E2sPkLPu8Wh39mYRy5NE-l1aH3iX5OziHg78p0xAxeqJE7Bq4R8p8fFBbn-skmGJlGK-TNCSDXT7P5Cvl8zGm0bZEbgir-I0Wr5p9hjjKeKf_mXtRA12P-tSgcapF8a-v-tmIaWvucBynubC76kpxKZD-c0T3xlh8k6w8ekKtUxYx5dNpG1FMnbIFrgchA0a3KQseZn3TmZfFRoFPKrhdE7Fozrf1MOZg3Mi76LLNHcwzk4kyShI16T0ORTP-mvWcV98C_GrfN0S8XiX2uxvNi-PSX5h7Nqaaaioica4yLcJnUOSVyyuO2ggxNtdZ3d3tYLvSw8eEuBWFNGS9qxI6He5yWA75XSyY7uWosA3ru00ndY3fliSOVvxHV8uraXGLAsYDXTkZ3xhOwWm4Q38TPuaoEPlzATO2ELG89jmQtQFtkYvrv9Ati1zg83YagU1AijkJY3Jrpj_0ZtEcyhtfQkj5nVIC87f7-EjqJamfulPpfDQMgi7eQAEqBh9UHyOkX3pus3DzQqcMLa-zZNc9z-0r6KMUflgJPgsEUVjmWa8GQdxu0PZo4RqbI7d2O4HxySMRaVJv0HMseJu7SJTSsCfYpcUgzS_8gsdjxEhrKYvTZuVNWVbOnbFVCOZc1dq7l0qd_Lo4WxAAmkzpnQh2eTcFElHb998uuL95MRal3ZiRGC6xuo7xGuld6MzHnhMVv-Rh8aufkE9y6F5QHxQBibSZgg&cid=CAQSOwDUE5ymysX1CNes-BWBp7dCP8FImmeXcYgo4zqdeXYMbQj3SS-_l7H8sqhh7l_O83QQiEatJSgvuQkiGAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freturnofdisasterclasshero.com&ds=l&xdt=1&iif=1&cor=1069454614765414400&adk=621368861&idt=176&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:08:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 22:08:36 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/ Frame FC6D 28 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230123/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f9909775d48d612aae837f0153817e8addbfa082f901254471bced4d8c72691

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 22:17:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49541
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10810
x-xss-protection: 0
server: cafe
etag: 8766511519597269738
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Feb 2023 22:17:55 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 893E 0
127 B 14ms
14ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 adplayer_privacy.sjs Show response
imagesrv.adition.com/js/adplayer/ Frame CD55 20 KB
6 KB 59ms
59ms Script
text/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_7192559320039620967&title=PIA+Advertising+GmbH&text=nutzt+u.a.+die+ADITION+Adserving-Technologie.+Mehr+&url=https%3A%2F%2Fpia-advertising.com%2Fopt-out%2F&linkText=Informationen+zum+Datenschutz%2FOpt-Out+&pos=top-right
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/270/oba_priv.sjs?oba=&domId=obaButton_7192559320039620967&btr=true&pos=top-right&cid=627838&aid=627838
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: f7e896b282351aea58912d278843b5663b8c04d9214d83cd9214faffc01125be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
content-length: 6043
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7E6C 42 B
64 B 113ms
112ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstlqwBka8HbNZB9avCsx6hrWZ_OmQ3A2yaDl0Ki4EB93ZPhnnLqtksoi9edj9W-OgUePdmsAcivOKdybEXr5DoNNpQ&sig=Cg0ArKJSzClDFtNWk_zTEAE&id=lidar2&mcvt=1033&p=0,0,600,120&mtos=1033,1033,1033,1033,1033&tos=1033,0,0,0,0&v=20230123&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674648214739&rpt=281&met=ie&wmsd=0&pbe=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 9C9B 35 B
464 B 27ms
9ms Image
image/gif 2620:116:800d:21:c5a4:625:6563:a5bb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF0tqKAGbjf7UCDUKpjxIes&google_cver=1&google_push=Aa02lx9X1PYaaaR4RJw2FKJ4D3iEDl32yHl-iEgo-q_5V5_VeConBxIQt7zMlm_sXqEy89EjC-k5rgr8DPQo4NCNPg7fVvk-nQ0

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:c5a4:625:6563:a5bb , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C9B
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJv4WDDigq8qet7tGguut0Y&google_cver=1&google_push=Aa02lx9ljnTR-wweU8-NA1MUQlYPuSl7rTXMgUF1K4RmERK8lN_35-27FId1Y6pQYh-U1IVi5cA738QxSw_GpXLTfw4xNZ7...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx9ljnTR-wweU8-NA1MUQlYPuSl7rTXMgUF1K4RmERK8lN_35-27FId1Y6pQYh-U1IVi5cA738QxSw_GpXLTfw4xNZ7ADfM&google_hm=eS05bThqTmUxRTJwSE1DWmd...

170 B
188 B

49ms
48ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx9ljnTR-wweU8-NA1MUQlYPuSl7rTXMgUF1K4RmERK8lN_35-27FId1Y6pQYh-U1IVi5cA738QxSw_GpXLTfw4xNZ7ADfM&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 25 Jan 2023 12:03:36 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx9ljnTR-wweU8-NA1MUQlYPuSl7rTXMgUF1K4RmERK8lN_35-27FId1Y6pQYh-U1IVi5cA738QxSw_GpXLTfw4xNZ7ADfM&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9C9B 0
12 B 44ms
43ms Image
text/html 142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KI0Q7DtDIsnhrVg1kQBq1kg_EHqK27Up-NMHI

Requested by

Host: e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
URL: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3A28 0
0 116ms
116ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2023012302&jk=3043263596147497&bg=!uLulu__NAAZSrDxfcqw7ACkAdvg8WmcIppcn5wZzMIu87E5C6Iem-z5gKulubLggTRF17Yau9rdPEgIAAACQUgAAAANoAQcKAD0rLxdPigtzKuH7S-9hzSaALzGkOV1FcWxmQAm_IX01KRCnAbggfWFNFg1HAgucxcN_kOqTzXZsD434GwL9mQLezIyAorBy7-wrtRj-xfxD0dcqICSDi3VNOw1-bs70hbW_sKxUr74dypgFRmuuN2Oj2eUh6F6qzjTsoZIntHTdc5u6Y1HXW-aSqDYqkHGpR-2cdUX_wYHGEHSM2ZdYy5zeyEI7oj7eeCC9kqWFtzcjtEio3bN-5ombP6_KEFz-ZPNtkfNXJf_sJbOrCOj6q6UrCikjk6D8RhgNaLrWsz_Re7cN7MS4JPcG0sY4Zdd21JmEIyAaiEP1zDtPdCf4B0aKZDY_k_fwEwUO3JfLrHQuTgkFDfQwrhxk6LsxGqrz98QtqAcPPRGsKErvdPNcsiMOtq_iIkqoDNLGrIU-3SgfpAU-_w8YrEwFRfBbUkozPDITBM4MCPXQe2s37qhRFCM3r0h13kzzXCGd9PKTBOUJ7aeYHhXdNOvL2_eA70fYRv8IB5NgqVHCZ5KujG0ScGjIz_ImTpLEfFCopfLzg-TJNiroiVXm49iAl6Sosd2ZlpGV2nTAW9CB4XYRaVQuyZ8WEY-jwRrIbG8_jtT9Z3PyfTVGVNhEmhdMrvCW8BxGF65T1xubpP75_-y-xLXaCNqsR3rpSCwuXhsQwIqXSmeTobYHQA6gg_dolnrnxs1K_Xat7-apbYV3OeXz3VPZKsK7IvVjuPlslKi5yODsUfZzca8sfcWRv2rR7JTrP2CufeL1HXykJQTXCKJn2XulXq4Q0m3RCY-vqmYHSmMOAWQVO1KQab7t0W-5iAmk-SVSZuDDEDG8oC08cVhgyvoTFgY6EkN6Ec71-Ijn8DeArFUNoH7YhZ8D3lGg9vl6b2pX8OWWI5ewI1jV69RD6NQN_q3OyRHtJa0Jgt47IM82xluQZSGQCL37L1lrJcQs2dP_ybzLxdzHNciOD-3clOo-HVtYeNtPxyf4IXcuVAf9aJmabf8bAj9TWlALjT8OcKabKGMaxAheIZ8HphZeMc_ysSDgSGRNnEIMDyAWEYqWd4Q
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C30D 41 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11011
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jan 2024 09:00:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C903 1 KB
643 B 9ms
8ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 13509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:18:27 GMT
etag: 48472445140208031
expires: Thu, 26 Jan 2023 08:18:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C30D 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0867a133aebbd9cea783e20a4bf845f019b34e5c6d1c4837abb0f5be27a2c527

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 4 KB
2 KB 26ms
25ms Document
text/html 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_276.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84eb4e7e7af68737ec8e7fb0d0ad2361bf863ca510ccacce2c241983bb010ab5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 427801
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1524
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 20 Jan 2023 13:13:35 GMT
expires: Sat, 20 Jan 2024 13:13:35 GMT
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C30D 0
0 75ms
52ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsueYLd2C6ZIH1ARIxmWaIGDutU2C8RL6MZhIdGIo9awBQXDbOmavKO7S84Pcgxq2XtAls1RhIW-6D6EthoA2uGuPuz5Tu-Qa4FEkHGzCNbPM2l9Deac1KhbcFE3KqAGsKHfC-k7z52hRQ9pC6RjYGJhDftdQhdtXxDdkhRrVM3evNHi4ASFfWPvtKUc-VB4ktwRU85p8a-RQ7arfFb8Oakup1OKEGB-dYMtt8Bxqb_ObsYjq_hp7mSmPpFvEjco_dVYjGM6kUQfu4hQ-UWwbRSfvKq6LqgkYZOXp7F8tZMD-azmWY8BJgzzKXYzANFcxqnOXQNBuZ5lLnV5f_5bYDNMeX0s4_WHfWeliB0_-qodfqpR3xBbPrZNueEwRipbmj8QM10CJbtOmOQHO_8Tlo-iJwgYPJO_UB1_pehzLjmM98nzmYGqzYEeQcbt4OItBr80J3iqez5bhXN7tNOEvNCPJj0EFjG5CcqAz6X9vMbS95vG_W0a5mZl9O0T89L2BofT9_twO3ol4cp2_IlfNbext9ScVpxGmwNaVmy6Y8rbnQOBjEKr1uCAgPE2XRowyxeXFWdXqGvv0v9kuRHPO1WWHJfaBoVKeoFf3MeLZWeDO96gQ60gWSEPG2c35RVc0Yv8ieoMABKNHMWBqp7vvnLA8LIeMBogyRkxtyIj7Uvw-weK_h6CgDvbVri3vLEfXvFEaUdYM0yjshXzAoAxB8DDEQBKFM6_FvvOQTKL3TmitWU0LZj4jwW5NctdrmR2ByKu2KGQoKiyFy-8QPPfNUuos5W-uZlePvEpokaIAI9rz04H0mATZpeP-WrsPdZ9VyW6uBIf8Tblf0C5_J3QjA0Zst8nKqOt1PVAfILfqeP22-sJV9ARSvE4YY4sHrrqis8cqL46d9DXbAxXyxgqUSFa_3RyWVtuAPxALQJiDixc42_upw9nE598K3N6S3qxlj2vH3zJTyC6t3Mkz5FTyYN0X5QMAOEoHCTlPiSQWzhKvXn2ZjmT0VSOYuPtarf7Nv3NwY0LeTUQUfZNg3-1dBXewtVP-tqr20v9FloVI4zAZdwWurbovx2-kX8cUuLm85CwZMHARpqMspa_-aK-pRQc0fN9yPBcUKRzKQt6BZMDmUS_ccc-Hfoym9xIz6Q3a8aLwSDweaKanNgPc9D0a8kS5plIcKaPBZ41421hzhVAWs3hKJf4XsZbK2-6QI8JQUI0tRiVI__RCX-ZAQqLAtrlMmvgpMF2LFxN-ejFqtWpgv1wUyAJmYp9BhBiLuLiVusHSXhgsj9DthldQVYqqG2Ec6nykypu-tAa1I8xTVg2AGw53QL6VaDknGpVR56k6xPyR3JA1yvzfC7K2Ls-2MHK2aJlNuvuBsgF2Mh5lwbME84IfeawHBJLJ9_R6WjMyFRzS3SiZUi4WiL7IxTCvdQ6VHJi4gVW33HpZwTwsvVDFiKe_kNRS0K7dFedrpPtOTep5useI3pk-dL3omS64JKoSLlRPxiB6Lnq-a68ef0IVbtdvyNJtKq_bh_odnz7hNY&sai=AMfl-YRL1tsECPImPODT-WWbxcQCqPMHL76ZsjBkOfnu0MBjOps-XZFufp8BMqDrXt_WMSpeQ1TDC4lXRPxagtzVOmo-KwlhpD_GSPpIXF__Ck_uEsUv8dhejTT8KPRLLvf5wU7YMC5bHiJfAVlkLkAy6HDf3a8ld7NymoGOc_O4ysgZx0uew5nBteZ7etLYBwN2PaT7QTd7xxevUKAiAZTNaEl-sFMFeflkxDuC9Fvc18JEptqTWWMQmISVE2yyLhcVL8oB15wMctcZYlt9ezQX3t2Acj7yqMmkb6Fc&sig=Cg0ArKJSzPNxTKt9n021EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=249&cbvp=1&cstd=245&cisv=r20230123.13159&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H2 200 300x600.html Show response
s0.2mdn.net/sadbundle/9449438672546955264/ Frame 19E2 45 KB
12 KB 60ms
60ms Document
text/html 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a271850a259b8fc2958e0368e90b8f57319c36737c6c385d7d1511ed948052e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:36 GMT
expires: Thu, 25 Jan 2024 12:03:36 GMT
last-modified: Wed, 14 Sep 2022 11:47:00 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FC6D 0
0 60ms
55ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv9lxnVEPK5wS36Jx0NkoHYe86J-IGXtDNLstKBe9-dE3axgpnOBLiAMIm31GL8OE_59LnrEZRDwkS8SYbOasYRaVM5vVc7V7TK1_4oxnzzzrKuc7JzMh9tWzpg96bqnemVHxCQcXdIQg1wnujblrLvtQ6WgSnU7WpgqU57myA5PqoJBW4K6B-MZ3JBsFksSz9RgBGWG_f1UBHBxAwcqkhwDhF2MLqQx4WFM9cPt7qoiy4-f7CFaujK7W_WbgzfjYX7dBe2SyXaWcx-giIOpwzmP2UNK2Pzx6t1RB2hGkoIF9dilu3IrPl-oQw1Uaf4xF4KhecGidVgGx84MTkyMu7uk01PkcGN3x0HkspREwPfpch1isbHf57fydPN18_kNr1gmCsKfjsqCUpislABDlQrkw2QMm_H5KTayK7qWS9itu1UbfBbTwx4vBifb8aRAaTN4veWd8TLvkedseDE7n10JupRYKZYKCvkyLIZ2CnF-DC_gfZx0x_Ou80106tdh1ku9TPA1ttZF1ul9qmU2JMS7iud2hAqamXpOQ4aN7qoigrF7AmckUpE410X6LrpunNGb5lPlT9Q_HdlZRDxcjP8wiZTQz-NxqUjN7GD8ml1bggEhn3kqGulMlw2LQ2WwwjHa-CttuGrd_CJSFTw9RDQmwfkEcOJ_ygR4wVdAGVKH5od5EiyjghZVtEKOdkw21LWieh3LuyilrLnXeA51iXPG-nNySij0zV6t17JspPKlpx0nQoxqyW5EHf0N_nc2jp73PgikzYsRtXYeNONFEECHW0r62eN5c718caqxQGC-RWySHANYLRnJFJNoYgWePJbu2-VUF69j0a8ffts7mX5LE3WObJGwtVsb3Al2CzHo42OCKkU7IhuDzICC3ls0tzjY3F6vi62kB25ZhDGKzOawyAfXcMwFSSTOTZS5FxPRRKHjIt-ptEar2QGrUZMSZeF-hKs_vPSYdgLomSPDNyBL3GPeodER6hk2Pl0Ljqu-tPm_zK99R-a8unu8n0Sq5XmCqMydtnleePMQmy87eDiyHskcNa4L6fMC1jMB6UHPRcUPFDgnQIgE6SL2gBYHB_mbuDp6vhbwTa2TG6xQVXanNZIJkrK2ic8BBQ77DpgP_rdqxOVEC7pUGJw4RbjsvzNekZwOWPQRmHqEzA7tWzpurdzTdBP9ZmaRIJBG4s-XktGLaURJMFJvcrpNYNMaxsm-QwySJWcyblHZpJRR7pjQROku-OrjGUTjh5_smg65na2n7LgPonXCNnHD2jVAQEncsj3RfFVvUCwTcNzqZnSmRCSiPcqg0qb5vmIuvSvkGHWP8gk1jeLcfigr9TvY2-k1VAkwq745lHk2xdTMifBdx5ofpRY6XxQ96hyTmEjOWe1_epoD19-LDM&sai=AMfl-YScQx1m6zPgz__HeQ63GNoL7UBzWjSlu8wSnFumXZJX-ghUPO7zrfgMEcAk2LbVji7xGNW8nmrLdxFyPgRvtyFTACcIBKdamxH6dV2P4W0R_7HibHp2jvcMU3XK8_wDZa7Pvoj3arFlLemYq8hEkDEsLGkNjLo7KEiI-TS5JFk2IiGJ3aZyiIsLNsiCvQbbvz3v3vXmutOPmo5H-XVgqGuLKL0Z5Z6bAp2mCcvHxTy2vTMRyQK51IdXKw9Hyt2Z-UUdFQHhhNw&sig=Cg0ArKJSzPRhgHyVvAQXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=162&cbvp=1&cstd=155&cisv=r20230123.14901&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 25 Jan 2023 12:03:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:36 GMT

GET
H2 200 adplayer.min.css
imagesrv.adition.com/js/adplayer/ Frame CD55 3 KB
998 B 58ms
57ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adplayer/adplayer.min.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_7192559320039620967&title=PIA+Advertising+GmbH&text=nutzt+u.a.+die+ADITION+Adserving-Technologie.+Mehr+&url=https%3A%2F%2Fpia-advertising.com%2Fopt-out%2F&linkText=Informationen+zum+Datenschutz%2FOpt-Out+&pos=top-right
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: dc1ca4850a9ee967d6ebcb561007bdea073f8380ae5a0a4f634945e3f9b59b87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
content-encoding: br
last-modified: Tue, 30 Oct 2012 15:33:13 GMT
etag: "524465627-br"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes
content-length: 918

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 89D3 22 KB
8 KB 28ms
27ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11011
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:05 GMT
expires: Thu, 25 Jan 2024 09:00:05 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 3 KB
777 B 24ms
23ms Stylesheet
text/css 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30cb911f391484b8e21831b552cd54f77d259e1b58e9e098d84adb968c8600bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 19:30:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 145996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 748
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 19:30:20 GMT

GET
H3 200 background.jpg
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 1 KB
1 KB 24ms
24ms Image
image/jpeg 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/background.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8298887ec48e74ce99f322a40fc502ca42608dc8c10e72585fc491c074e896dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 05:31:18 GMT
x-content-type-options: nosniff
age: 196338
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1410
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 05:31:18 GMT

GET
H3 200 pfeil-gruen.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 1 KB
2 KB 24ms
23ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/pfeil-gruen.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97eb9d9456306290083a819d78d5a4b60bbac8dc0329fd71a091039fdefb1a12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sun, 22 Jan 2023 05:00:04 GMT
x-content-type-options: nosniff
age: 284613
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1534
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 22 Jan 2024 05:00:04 GMT

GET
H3 200 pfeil-orange.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 3 KB
3 KB 43ms
40ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/pfeil-orange.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0180ddb41b42c5332e99d3e4435c0cf4a60f7722c09444a7285f88fb4de32f84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 17:54:45 GMT
x-content-type-options: nosniff
age: 151732
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3319
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 17:54:45 GMT

GET
H3 200 h1.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 29 KB
29 KB 31ms
29ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/h1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bed37a9e40c349fa54d80adf4e18be18ccd88bfb0c264465bd2441d09a52ae2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 17:54:45 GMT
x-content-type-options: nosniff
age: 151732
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29757
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 17:54:45 GMT

GET
H3 200 h2.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 15 KB
15 KB 28ms
26ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/h2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb01433163c883137ad42e1ee9b18712a11d8d487ece10948f5eef21c57a16fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:17:24 GMT
x-content-type-options: nosniff
age: 143173
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15602
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 20:17:24 GMT

GET
H3 200 preis.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 2 KB
2 KB 39ms
37ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/preis.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6a0d5063fe80caa8661eb856f667f7ada976a0c4cb7ebc1fc163ec924a70067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sat, 21 Jan 2023 07:38:53 GMT
x-content-type-options: nosniff
age: 361484
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2063
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jan 2024 07:38:53 GMT

GET
H3 200 stoerer01.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 9 KB
9 KB 37ms
35ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/stoerer01.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bd573e2a3c35112ed635d837e02b3e4e53f61a246ccd55b91525e6d28489f4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 20 Jan 2023 08:31:10 GMT
x-content-type-options: nosniff
age: 444747
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9684
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jan 2024 08:31:10 GMT

GET
H3 200 stoerer02.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 4 KB
4 KB 47ms
45ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/stoerer02.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8200a46b28b1526743481d9e2f62d8a905548d867253e55ce86b0e421d2ea922

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Sat, 21 Jan 2023 06:21:15 GMT
x-content-type-options: nosniff
age: 366142
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3993
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 21 Jan 2024 06:21:15 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 4 KB
4 KB 46ms
44ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

506db66aff67125a930d91b90c4d401cccfb7b00008c26a518445776970d7626

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 20 Jan 2023 04:29:17 GMT
x-content-type-options: nosniff
age: 459260
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3735
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jan 2024 04:29:17 GMT

GET
H3 200 laufzeit.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 675 B
702 B 42ms
40ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/laufzeit.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

510c2d0b252c733bca479c67c5ad6ba03821ca6177bc4ddddd3568d2bf833e50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 08:33:31 GMT
x-content-type-options: nosniff
age: 99006
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 675
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 24 Jan 2024 08:33:31 GMT

GET
H3 200 button.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 5 KB
5 KB 43ms
42ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/button.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb435314ce75681a6c9a45a996bbacbb97001cef5c442e9cff6a7d552c28443f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 20:17:25 GMT
x-content-type-options: nosniff
age: 143172
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4845
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 20:17:25 GMT

GET
H3 200 border.png
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 192 B
222 B 44ms
42ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/border.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07faa617cfb2a9cf77d9a06598ea37fa4c88cff217e7e73515318aa2fdbb9d74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 12:27:02 GMT
x-content-type-options: nosniff
age: 171395
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 192
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Jan 2024 12:27:02 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/ Frame 5F6F 64 KB
23 KB 33ms
14ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.10.4/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b765b0cbd95391f6db0b565988eeb70ea68aa77bb9f8f7c8a880d96474c2aa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 787684
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23292
last-modified: Fri, 22 Apr 2022 16:32:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6262d89e-5afc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0hKjX0GKtWAN645DFi7VwoQ8P0CSZ%2FypYrmHM%2FTq4JnyFxWSToGuCH5%2BXJAfRYew3Lh8FmFyrEXpQDSYbbn1UOGRjWzoYUybFFcQTvv7fl3GpP%2BV3el0Jdu0SwNvsO%2BS8PfVil6MMUdl%2Bbc6N6F7xYAn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 78f0dddc6f1bbbef-FRA
expires: Mon, 15 Jan 2024 12:03:37 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/ Frame 5F6F 3 KB
878 B 28ms
28ms Script
application/x-javascript 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1268a7c49ca62060aa5314ae7bca4562d746822a92135be2e24da556d53fd8d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6252691857520443421/202212_km_10GB-24M-999-0AP_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Fri, 20 Jan 2023 05:24:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 455923
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 849
x-xss-protection: 0
last-modified: Tue, 20 Dec 2022 13:18:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 20 Jan 2024 05:24:54 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FC6D 41 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11011
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Jan 2024 09:00:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A3E3 1 KB
643 B 8ms
7ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 13509
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 08:18:27 GMT
etag: 48472445140208031
expires: Thu, 26 Jan 2023 08:18:27 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame FC6D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a7947d98f03d314ddb7b56e2c5d4bc3bc2fd10a33bed42ef5f353a30e7d2647b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C903
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF0tqKAGbjf7UCDUKpjxIes&google_cver=1&google_push=Aa02lx_nEuSmc0NoQaFutjq-V-iqisJ-aDOySWx_7LBDV1_HIoWUthD905...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx_nEuSmc0NoQaFutjq-V-iqisJ-aDOySWx_7LBDV1_HIoWUthD905XZROwQOS7mbHpWPr8AspN2NhzPSC6DSVfMiF7I8T0v&google_hm=gmYAOU-6n_nW...

170 B
188 B

46ms
46ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx_nEuSmc0NoQaFutjq-V-iqisJ-aDOySWx_7LBDV1_HIoWUthD905XZROwQOS7mbHpWPr8AspN2NhzPSC6DSVfMiF7I8T0v&google_hm=gmYAOU-6n_nWlrnDUo9bjA

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx_nEuSmc0NoQaFutjq-V-iqisJ-aDOySWx_7LBDV1_HIoWUthD905XZROwQOS7mbHpWPr8AspN2NhzPSC6DSVfMiF7I8T0v&google_hm=gmYAOU-6n_nWlrnDUo9bjA
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:36 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C903
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJv4WDDigq8qet7tGguut0Y&google_cver=1&google_push=Aa02lx-LV8TRkdwy3BWizWKmGDKuBuApo5vEz2rJxupH8U8A2OTRbxGGgQkYXx_Jya8nZPIFsNMolStd2kLsPbojT9TyPQb...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-LV8TRkdwy3BWizWKmGDKuBuApo5vEz2rJxupH8U8A2OTRbxGGgQkYXx_Jya8nZPIFsNMolStd2kLsPbojT9TyPQb3QCnR&google_hm=eS05bThqTmUxRTJwSE1DWm...

170 B
188 B

50ms
49ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-LV8TRkdwy3BWizWKmGDKuBuApo5vEz2rJxupH8U8A2OTRbxGGgQkYXx_Jya8nZPIFsNMolStd2kLsPbojT9TyPQb3QCnR&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 25 Jan 2023 12:03:36 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx-LV8TRkdwy3BWizWKmGDKuBuApo5vEz2rJxupH8U8A2OTRbxGGgQkYXx_Jya8nZPIFsNMolStd2kLsPbojT9TyPQb3QCnR&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C903 0
12 B 44ms
43ms Image
text/html 142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JavaH8_zrERh4Ih4Ej6VhPxqdZ2UJzZmoo6P0

Requested by

Host: 0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
URL: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:36 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v34/ Frame B084 47 KB
47 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:800italic,600italic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://imagesrv.adition.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 17:36:17 GMT
x-content-type-options: nosniff
age: 152839
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47952
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:22:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 23 Jan 2024 17:36:17 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 19E2 118 KB
40 KB 23ms
23ms Script
text/javascript 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 09:00:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11012
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 26 Jan 2023 09:00:05 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 19E2 63 KB
25 KB 66ms
65ms Script
text/javascript 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 12:03:37 GMT

GET
H2 200 oba_icon.png
imagesrv.adition.com/js/adplayer/ Frame CD55 3 KB
3 KB 15ms
15ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/js/adplayer/oba_icon.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/js/adplayer/adplayer.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/js/adplayer/adplayer.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:37 GMT
last-modified: Tue, 30 Oct 2012 15:33:13 GMT
accept-ranges: bytes
etag: "502461915"
content-length: 3262
content-type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame ABA8 22 KB
8 KB 26ms
25ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11012
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:05 GMT
expires: Thu, 25 Jan 2024 09:00:05 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A3E3
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEF0tqKAGbjf7UCDUKpjxIes&google_cver=1&google_push=Aa02lx9W5dF-8cr6kCHkysf5d2Qz8Q6TdywoFZcGREHugmRrSkD-x_sW1f...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx9W5dF-8cr6kCHkysf5d2Qz8Q6TdywoFZcGREHugmRrSkD-x_sW1fTZLXv0Zp0FIT2ASdapB5-p5xWj-vm7eZmn249qLDIM&google_hm=gmYAOU-6n_nW...

170 B
188 B

46ms
45ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx9W5dF-8cr6kCHkysf5d2Qz8Q6TdywoFZcGREHugmRrSkD-x_sW1fTZLXv0Zp0FIT2ASdapB5-p5xWj-vm7eZmn249qLDIM&google_hm=gmYAOU-6n_nWlrnDUo9bjA

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=Aa02lx9W5dF-8cr6kCHkysf5d2Qz8Q6TdywoFZcGREHugmRrSkD-x_sW1fTZLXv0Zp0FIT2ASdapB5-p5xWj-vm7eZmn249qLDIM&google_hm=gmYAOU-6n_nWlrnDUo9bjA
pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A3E3
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJv4WDDigq8qet7tGguut0Y&google_cver=1&google_push=Aa02lx8tVlage-TUVJbyKMNhH6McISIXodPC0XcKWOURvf2gnZ1vE2dSJno8hPKEWF5Y8Jj3HrjHBYI5IsgZrZBrXK3NkK7...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8tVlage-TUVJbyKMNhH6McISIXodPC0XcKWOURvf2gnZ1vE2dSJno8hPKEWF5Y8Jj3HrjHBYI5IsgZrZBrXK3NkK78rEJ4&google_hm=eS05bThqTmUxRTJwSE1DWm...

170 B
188 B

46ms
46ms

Image
image/png

142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8tVlage-TUVJbyKMNhH6McISIXodPC0XcKWOURvf2gnZ1vE2dSJno8hPKEWF5Y8Jj3HrjHBYI5IsgZrZBrXK3NkK78rEJ4&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 25 Jan 2023 12:03:37 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=Aa02lx8tVlage-TUVJbyKMNhH6McISIXodPC0XcKWOURvf2gnZ1vE2dSJno8hPKEWF5Y8Jj3HrjHBYI5IsgZrZBrXK3NkK78rEJ4&google_hm=eS05bThqTmUxRTJwSE1DWmdCWHRDWVRnVzBUR3l1TndYeX5B
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A3E3 0
12 B 44ms
44ms Image
text/html 142.251.39.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JGtj1Nnq-AwouthAZyYpkZFFKgeBtcEY_QFFI

Requested by

Host: cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
URL: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.39.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C130 0
0 115ms
114ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2023012302&jk=4291472681348779&bg=!mpmlmd3NAAZSrDxfcqw7ACkAdvg8Wpy3lmxMAZLO_Tw5mIYfoTZd4_Gj8yusP3nf3hr_2jKu1oFMvQIAAADuUgAAAANoAQcKAKgbco_MHH1dOU_9HpIQTqLDRxaTMBply5f-59FjziMfpwbKShz8xgMl14fwmi3Va-wOhGTcsmST1wrljVmJtSZIXgo7FfAhKCtS2wTsBJ3WNI8tTEwKB9YoV76FxBMg2M9GABcMBZ33lbFa2A8i6A1ARWK2LgSyG3YTxRvky3IQ6k-tvKYL9p-mhfKEG_PD_TrN8zcNRnyfKNhQs2y-YZ1b7psJr_LMr-mZAsjJclJZntq47KPACLCKY39e0egG6c4psd-1do4iPlC0uEHEIVkSW5eR9IBWbbvQXmDwyisrgIjr4UCLEV_frDxmL1AT0hBmn4S5xH0-JAsr9MN9fZQLGOIxMeL6ptni1bJYWjooZhF7Q-PWJtaJ6a9HAixomnqlLCVTWdVBZe2tjbNoqEH2lGFUv6yszNJjBKzM5EM7USmfPCGTpKC5ce7fVhCl_Dga0W7_5f31ZcN-c7bFgV5DrzQbxOGG0zbHcbdlnw6Ehea1WB4zLqIID1nIVMdc37HRCSSBuPuOJ2OuD53QkuOthlYy-v1tbz7xClG-MDmJmfJ7gsIe45-2XRE7G_Ef2GtRUptCmGf0-Ff8bSanqxw1w28snZPaEv2bjiBZaCmJqLli_3s6UKKx0iI7omEJxahjDIYaXhraVY-gbeCh_wB4NjPyq4eoCIxjIzvDl9RwbUFMvVZyVMQJvFyQnRx8AvvctDbHgC40WzZlVtTYVjKqZoLbJ3dIar1mnWhuKAWExgG97c_92tEh5wnYaHUFUrgiwxWjmgoyaYTvH1UA2rR1yTXspNYcfR3jTfW2Hma1R24noGOWZdXuDYY_lH3FR3S3BP7VSMJoFiowefO3BMPbe2pcCqadq8ZMDa2mxMw9dnr1Yvx-FTYhdmHP2j7D-GjKaOh_6BCiB5pHtouCFnMlliY6MUZ2iYOmbPnM0mLzkES6ewQSN41KY4S0g50GFyDQGhgrWyUfhaORVzSDGF2cK3ElscIi8TaSufCpwUgJ2Al8FA2R4eMQGtQX4JsYm8qK0NplrZawLBQ8TBlsn4lM2YM-wPZA9NRzpnj58wIuxJz8SU34D00DSME-bOgkM_D5SBtp1yO33TqaOLIRoaTQwfyH8FwTA0sxO9oLjlYGSjs4bduIqCr_j_oiogCLDBOJwm4xf7nMTNovclINwkuJfRnl
Requested by: Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame 89D3 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0598 0
20 B 119ms
117ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzebLmBrRY4bHDYuE9u8Pvt21uAwAAAAAOAHgBAI&bg=!qKulq-_NAAZSrDxfcqw7ACkAdvg8WjpRDpdWB5-xSNz9E8YeUH_aaqO9H96q9EAWkaGyvrruRe8bqQIAAAHMUgAAAAJoAQeZAyVOUJeazkuyqlWa-9dyfwKu7WHvZsb9b-YwMiPXTSM3pIj3AaYwznS4p7uZugjZPtHuRM514QYp3XJugcalNChqMx5wd1TlGMa__AULN3B1sz-AV8ugrLKoYzCuzsD1xh32NZjnY7Ptfwr5oJFFaVOEe5tdGQxxJPr25tPIQUsce0brKjDUs7DlAcM53Dpqo8ejh-U4mcLfXm6NJJI9cpa0nunKXazGen75HAk3ngVgH1sm0IWPhvKhkX-U9xkHPSGP9uyi-3z_m-V7z2aFxUt9vrLIg1FYDtWu6Wv-POTTURMemuD3YijfkP5X1PTy3d2XdYOs8BuTdium9U4S5RKsO3XieqfFa2Hu0W7dlkyPUkpWtOMIHR7pU4usMBaxwfHY-PjR5ZsKvf7Cd7zB8RiWkIxEp3RGjnm1d2NDNWpICQv2GstbzN29Us4X7w0yrz6KY9BbiFrYK0qDGFqgmpNKM9HbnGHAQ4bY80HM_RLdkph_UgYm3pFWlNnKUW-ICRUepJiLW81YzGHAPy9omLdJ1frv0df6wB1En2iMUDwj9eahrhNnh-fjbm93DSmr0D_eLiOwN5WppYhfw4Q8_J_eR9a6GlWY8nwMcex3Vt9K4jnipNH87LzIc-FvbC7pfzT0Fnn-dqLCD9RuB4ZYtnSZbbLluQxqFnEi3PcYVktMyQLwbXGFV5q73AwAc9nzJoy0lFco_AXQov0snfw7TXDLFlJu12lW1uubl7fzGo7Bg5_qnI6Junt1j7gxZ8r3wT266SRX6qVeZV8K2cvhGv_RthQT6Sn0vov_2-UI51IKXATOVi0Co0mNz5fch7RROZXiEH_8N4qISv3AglO9PViCFj_7-yhhVXFPbV_Gs7k63kN48rv3j2MYvRF8D44MRovNIPHGdI42-8dgIsOanZDrJPZCAfpp_XlggyGLa7u4UiOKKWdnttGeA-zsbXnS-PsCbAZzNcW9puX4kcJbvTbF8dsZOL7CRypaZPVOm32RnH6xgYHk9Gx63eGs-apqNkTty-XcViihszGtMzoiKiICZghcMmY7zOM4B7z713sO2pxT8rab

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C30D 0
0 49ms
48ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsueYLd2C6ZIH1ARIxmWaIGDutU2C8RL6MZhIdGIo9awBQXDbOmavKO7S84Pcgxq2XtAls1RhIW-6D6EthoA2uGuPuz5Tu-Qa4FEkHGzCNbPM2l9Deac1KhbcFE3KqAGsKHfC-k7z52hRQ9pC6RjYGJhDftdQhdtXxDdkhRrVM3evNHi4ASFfWPvtKUc-VB4ktwRU85p8a-RQ7arfFb8Oakup1OKEGB-dYMtt8Bxqb_ObsYjq_hp7mSmPpFvEjco_dVYjGM6kUQfu4hQ-UWwbRSfvKq6LqgkYZOXp7F8tZMD-azmWY8BJgzzKXYzANFcxqnOXQNBuZ5lLnV5f_5bYDNMeX0s4_WHfWeliB0_-qodfqpR3xBbPrZNueEwRipbmj8QM10CJbtOmOQHO_8Tlo-iJwgYPJO_UB1_pehzLjmM98nzmYGqzYEeQcbt4OItBr80J3iqez5bhXN7tNOEvNCPJj0EFjG5CcqAz6X9vMbS95vG_W0a5mZl9O0T89L2BofT9_twO3ol4cp2_IlfNbext9ScVpxGmwNaVmy6Y8rbnQOBjEKr1uCAgPE2XRowyxeXFWdXqGvv0v9kuRHPO1WWHJfaBoVKeoFf3MeLZWeDO96gQ60gWSEPG2c35RVc0Yv8ieoMABKNHMWBqp7vvnLA8LIeMBogyRkxtyIj7Uvw-weK_h6CgDvbVri3vLEfXvFEaUdYM0yjshXzAoAxB8DDEQBKFM6_FvvOQTKL3TmitWU0LZj4jwW5NctdrmR2ByKu2KGQoKiyFy-8QPPfNUuos5W-uZlePvEpokaIAI9rz04H0mATZpeP-WrsPdZ9VyW6uBIf8Tblf0C5_J3QjA0Zst8nKqOt1PVAfILfqeP22-sJV9ARSvE4YY4sHrrqis8cqL46d9DXbAxXyxgqUSFa_3RyWVtuAPxALQJiDixc42_upw9nE598K3N6S3qxlj2vH3zJTyC6t3Mkz5FTyYN0X5QMAOEoHCTlPiSQWzhKvXn2ZjmT0VSOYuPtarf7Nv3NwY0LeTUQUfZNg3-1dBXewtVP-tqr20v9FloVI4zAZdwWurbovx2-kX8cUuLm85CwZMHARpqMspa_-aK-pRQc0fN9yPBcUKRzKQt6BZMDmUS_ccc-Hfoym9xIz6Q3a8aLwSDweaKanNgPc9D0a8kS5plIcKaPBZ41421hzhVAWs3hKJf4XsZbK2-6QI8JQUI0tRiVI__RCX-ZAQqLAtrlMmvgpMF2LFxN-ejFqtWpgv1wUyAJmYp9BhBiLuLiVusHSXhgsj9DthldQVYqqG2Ec6nykypu-tAa1I8xTVg2AGw53QL6VaDknGpVR56k6xPyR3JA1yvzfC7K2Ls-2MHK2aJlNuvuBsgF2Mh5lwbME84IfeawHBJLJ9_R6WjMyFRzS3SiZUi4WiL7IxTCvdQ6VHJi4gVW33HpZwTwsvVDFiKe_kNRS0K7dFedrpPtOTep5useI3pk-dL3omS64JKoSLlRPxiB6Lnq-a68ef0IVbtdvyNJtKq_bh_odnz7hNY&sai=AMfl-YRL1tsECPImPODT-WWbxcQCqPMHL76ZsjBkOfnu0MBjOps-XZFufp8BMqDrXt_WMSpeQ1TDC4lXRPxagtzVOmo-KwlhpD_GSPpIXF__Ck_uEsUv8dhejTT8KPRLLvf5wU7YMC5bHiJfAVlkLkAy6HDf3a8ld7NymoGOc_O4ysgZx0uew5nBteZ7etLYBwN2PaT7QTd7xxevUKAiAZTNaEl-sFMFeflkxDuC9Fvc18JEptqTWWMQmISVE2yyLhcVL8oB15wMctcZYlt9ezQX3t2Acj7yqMmkb6Fc&sig=Cg0ArKJSzPNxTKt9n021EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=603&vt=11&dtpt=354&dett=3&cstd=245&cisv=r20230123.13159&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:37 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C30D 7 KB
5 KB 51ms
50ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=latest&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80f162a762dea93c843164cdfaa8b2e89c5f4f82f39d212a107c3e2b5cbac129

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5536
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FC6D 0
0 45ms
45ms Fetch
image/gif 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv9lxnVEPK5wS36Jx0NkoHYe86J-IGXtDNLstKBe9-dE3axgpnOBLiAMIm31GL8OE_59LnrEZRDwkS8SYbOasYRaVM5vVc7V7TK1_4oxnzzzrKuc7JzMh9tWzpg96bqnemVHxCQcXdIQg1wnujblrLvtQ6WgSnU7WpgqU57myA5PqoJBW4K6B-MZ3JBsFksSz9RgBGWG_f1UBHBxAwcqkhwDhF2MLqQx4WFM9cPt7qoiy4-f7CFaujK7W_WbgzfjYX7dBe2SyXaWcx-giIOpwzmP2UNK2Pzx6t1RB2hGkoIF9dilu3IrPl-oQw1Uaf4xF4KhecGidVgGx84MTkyMu7uk01PkcGN3x0HkspREwPfpch1isbHf57fydPN18_kNr1gmCsKfjsqCUpislABDlQrkw2QMm_H5KTayK7qWS9itu1UbfBbTwx4vBifb8aRAaTN4veWd8TLvkedseDE7n10JupRYKZYKCvkyLIZ2CnF-DC_gfZx0x_Ou80106tdh1ku9TPA1ttZF1ul9qmU2JMS7iud2hAqamXpOQ4aN7qoigrF7AmckUpE410X6LrpunNGb5lPlT9Q_HdlZRDxcjP8wiZTQz-NxqUjN7GD8ml1bggEhn3kqGulMlw2LQ2WwwjHa-CttuGrd_CJSFTw9RDQmwfkEcOJ_ygR4wVdAGVKH5od5EiyjghZVtEKOdkw21LWieh3LuyilrLnXeA51iXPG-nNySij0zV6t17JspPKlpx0nQoxqyW5EHf0N_nc2jp73PgikzYsRtXYeNONFEECHW0r62eN5c718caqxQGC-RWySHANYLRnJFJNoYgWePJbu2-VUF69j0a8ffts7mX5LE3WObJGwtVsb3Al2CzHo42OCKkU7IhuDzICC3ls0tzjY3F6vi62kB25ZhDGKzOawyAfXcMwFSSTOTZS5FxPRRKHjIt-ptEar2QGrUZMSZeF-hKs_vPSYdgLomSPDNyBL3GPeodER6hk2Pl0Ljqu-tPm_zK99R-a8unu8n0Sq5XmCqMydtnleePMQmy87eDiyHskcNa4L6fMC1jMB6UHPRcUPFDgnQIgE6SL2gBYHB_mbuDp6vhbwTa2TG6xQVXanNZIJkrK2ic8BBQ77DpgP_rdqxOVEC7pUGJw4RbjsvzNekZwOWPQRmHqEzA7tWzpurdzTdBP9ZmaRIJBG4s-XktGLaURJMFJvcrpNYNMaxsm-QwySJWcyblHZpJRR7pjQROku-OrjGUTjh5_smg65na2n7LgPonXCNnHD2jVAQEncsj3RfFVvUCwTcNzqZnSmRCSiPcqg0qb5vmIuvSvkGHWP8gk1jeLcfigr9TvY2-k1VAkwq745lHk2xdTMifBdx5ofpRY6XxQ96hyTmEjOWe1_epoD19-LDM&sai=AMfl-YScQx1m6zPgz__HeQ63GNoL7UBzWjSlu8wSnFumXZJX-ghUPO7zrfgMEcAk2LbVji7xGNW8nmrLdxFyPgRvtyFTACcIBKdamxH6dV2P4W0R_7HibHp2jvcMU3XK8_wDZa7Pvoj3arFlLemYq8hEkDEsLGkNjLo7KEiI-TS5JFk2IiGJ3aZyiIsLNsiCvQbbvz3v3vXmutOPmo5H-XVgqGuLKL0Z5Z6bAp2mCcvHxTy2vTMRyQK51IdXKw9Hyt2Z-UUdFQHhhNw&sig=Cg0ArKJSzPRhgHyVvAQXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=510&vt=11&dtpt=348&dett=3&cstd=155&cisv=r20230123.14901&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: returnofdisasterclasshero.com
URL: https://returnofdisasterclasshero.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 25 Jan 2023 12:03:37 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 56ms
55ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230123&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

045cc9333310e313639851bd87b49ac3963757ae4949ff0a5fe37c4be4f68d51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11163
x-xss-protection: 0

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame ABA8 36 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 19E2 47 KB
47 KB 23ms
23ms Font
font/woff2 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 11:49:24 GMT
x-content-type-options: nosniff
age: 853
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 12:04:24 GMT

GET
H3 200 OnAir-Light.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 19E2 46 KB
46 KB 26ms
26ms Font
font/woff2 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Light.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:00:30 GMT
x-content-type-options: nosniff
age: 187
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46936
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 12:15:30 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 19E2 7 KB
6 KB 78ms
78ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21177b781b056933167e45a4b9a4b4e21c9c2592fcdcc5020b73564d785496aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5695
x-xss-protection: 0

GET
H3 200 60005582_20230113042919496_ASSET.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 19E2 44 KB
44 KB 29ms
27ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230113042919496_ASSET.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

112fab27155368829c57d8c144fb4e1a5e360b4e147ec90a210778f00fb6d220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 24 Jan 2023 15:35:38 GMT
x-content-type-options: nosniff
age: 73679
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45355
x-xss-protection: 0
last-modified: Fri, 13 Jan 2023 12:29:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 15:35:38 GMT

GET
H3 200 60005582_20220825085151068_300x600_BG.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 19E2 61 KB
61 KB 44ms
42ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220825085151068_300x600_BG.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c384e161dd9d69bfc6e872774aadc81b3bd7534a97c5541d20a83c120704dbec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 10:21:13 GMT
x-content-type-options: nosniff
age: 6144
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62713
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 15:51:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 26 Jan 2023 10:21:13 GMT

GET
H3 200 60005582_20230113052337010_300x600_INTRO.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 19E2 47 KB
47 KB 40ms
39ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230113052337010_300x600_INTRO.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ac736b755d1e73b248cacf82a532914045934b6166f27d849c5c48853039c63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 05:53:48 GMT
x-content-type-options: nosniff
age: 22189
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48056
x-xss-protection: 0
last-modified: Fri, 13 Jan 2023 13:23:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 26 Jan 2023 05:53:48 GMT

GET postview.gif
portal.o2online.de/nws/img/ Frame 19E2 0
0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C30D 17 KB
6 KB 72ms
72ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:37 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 113ms
113ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:37 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A90E 0
0 114ms
113ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2023012301&jk=1449949795513544&bg=!aWqlai7NAAZSrDxfcqw7ACkAdvg8Wou39VvNLWjZNgkS92yrOAEylIcmwgjmhgtQffqCH5KmQDkQWwIAAAEOUgAAAANoAQcKAFlGefkc9TB5jz5e95RFJBgH_fqvX4s9bVIeWdl186LkHzfzLJeKVAJOE3owtPiZ5obpYa7n-jEvjlOHwrB0g8yFy-DofoQF_o4ibNkdVglhINVMipRhGKJBR5kC2qi95UZRX2kE9a_DNvbnPN4Oqqbtdom9t6Xdw49EE8MqGwukSumGNw3XCy8H9n5dVGzAsGH-o6HfEmZZtlraA6Nno8ziN4tgfTelDntSVnI_OsiUXU_MICu6QW1q-WeqPS_q6aE6a-5FyNRB6JM4y98XOBmQzS3Ky8z1MGsPJnTBDLtgUbSCwGwrVM4MlKXoh-2-X3Fuj4UtwPbXqPx9CfC3F_KN_tkq7Pi_C5Xaa7LmZYSbKlLmPwrbu_QoQdSUfBs9kb3v0Hu1rXqPcljIl8xVvrcxX3tltvMSNF-RduOtfQuoni_NtUgBnsW7RehPSBdoKP5vhyLvyMhOzKdbEo1UrDI7uwvKDhvgi7jkz9UFhUWf3TBBf17REoyRjsCcdVqwJzh-8FX2mDg6G9smdrocsZe3K5H7bMMJ63IZz1RvhwjrejGy4oMF4sgnkfieMeUCAoyihB9X7h8fqJufQl5Z3R5Eygo9JunsFOHm3Cbiy-83FbKjT5MHh-UUuk0KtIXDZQLgeos-VN6WKOQ4RSu3LXkbf1lP-SwB8m1PFeXRPTtvxE3yP7VM0rCx3S9wF7i6LeHrJ0LItyrEax0SL9NFEGRv224GbIUcCkbZlzMzwUbqNbRSZIdyzHTk5fRjlCyvP4k3IwOYHwx36zARVBDyWOnqzAOBiicNydNzZrKIUM3P7MJquxIlfmlf8jPeqCfljj15-9zumCxEqSSAud8VyCXsDxcp8sIm0L8-yrqHEyDhp73rjqnsN7ibKJX5MsQZszBl4RzhOG6pFOVbLo3vlABf06mVs3XbPfmRk8J2b91g2ExMcZsvVa4r7FcGlbro1Vg3Oe_p29MRdYYyMnAAt2q5S_Euz4ne2Ik1SUAlHiqriO_JDP7I39dLZEYY_8RMONPHtdccW7iPGC7LQkA0GPKuAHRE8icpUfzOksOqL6PEhi4XxraokyAq9-t9SP9PqpMdXgTzFKM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/creatives/assets/4085730/ Frame 19E2 26 KB
26 KB 23ms
23ms Image
image/png 2a00:1450:400d:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4085730/bubblespritesheettiny.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:806::2006 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9449438672546955264/300x600.html?e=69&leftOffset=0&topOffset=0&c=54NSXytjwO&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 11:52:47 GMT
x-content-type-options: nosniff
age: 650
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27068
x-xss-protection: 0
last-modified: Fri, 12 Mar 2021 15:44:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 Jan 2023 12:07:47 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 19E2 17 KB
6 KB 72ms
72ms Script
text/javascript 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 12:03:37 GMT

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame B484 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1859 13 KB
5 KB 26ms
25ms Document
text/html 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11013
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 09:00:04 GMT
expires: Thu, 25 Jan 2024 09:00:04 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E9BF 783 B
536 B 18ms
18ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0f2f32c1e0c19e11c18902b586d90dd93d14f04ad96f609dd4176dc5f626fe74

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-N9SnGczb5Jx7gSS8RLMJHQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://returnofdisasterclasshero.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-N9SnGczb5Jx7gSS8RLMJHQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 25 Jan 2023 12:03:37 GMT
expires: Wed, 25 Jan 2023 12:03:37 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame DF9F 36 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CD55 42 B
64 B 114ms
114ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvV7DLitrmgaRiFDAKGzruVqGMDwu7bw4oixz1NMPVrRvT-8oX9fsvfP10LgxS0Dbaq2aKToUKJwH-x-ZRw7z7A9WnLoXuMnPJrLcPhqypJEtvrUjs9EL7GfLdh&sai=AMfl-YSL0vdxDreGfEyHoENv68iXfHbna7vVyKwEl10V6O3ZNvw3tRRqONch7xQw0nZS4hajAyylCuFx3xwlc6v8eO9PBMpENdGHrmkJG7Hrwhx40MZ5OZnMwQ7tTT9tBw&sig=Cg0ArKJSzLAQ8QCbezVPEAE&cid=CAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat_PNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw&id=lidar2&mcvt=1048&p=1105,436,1195,1164&mtos=1048,1048,1048,1048,1048&tos=1048,0,0,0,0&v=20230123&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=101534194&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674648216010&rpt=637&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 89D3 0
20 B 114ms
114ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQPsPmBrRY-HaH_mS9u8Pvvee8AQAAAAAOAHgBAI&bg=!bm2lbSnNAAZSrDxfcqw7ACkAdvg8WmEk-FXAgsLmtonohxqgsQsCDElPDwJnn2CklBBiHBzDDbciPAIAAAHqUgAAAANoAQeZAy3aansN5lFw0vFBsx5VihR_cts16K7w9LjgnJJVV5SWIHzrlUx7Sc8j5zKvpBNFPwwNbRX-Rdw39KcR0V8rV8kchvxIDZDc58DMEfFa_bFcubapKZq16lF6lXHzSJ6ct4XGfHLgbTSco4MqsEa--DRncXsqeFEPlT9IhvnZTRK73iHuL_tolmFyUVCjv-VDD9cRG6519HL5n9SUk5cPqaBWDrI9j9ZS2XBL23BeDiKCJOSfX52HvZobsxYnVl4n2v9g5_iXR5AOJO4MwSqwFYUCK-_QcCTuC5RooM5uzwRgX76t9qyBxq9REwv2c4eB7AV8expVjzumdfJwdBtRGZ9zXSJ6i1jt1WTnazSGJ6xNTCF6OLGyapYlK7lRaKyZfZfWQP1dPxLoNviqQFoYGd_kws0dDtYau-D1MCxCZgbefbDcV3CpZSt_CC8c7d2NBk3qXfN9n6EAy1EnBmXHN8q4NvCdBmY9eh4_UcMl-FcXLHuWBo3bJ1gTR0Hwna3kqncTMSe-Ce15zYAXHY3rBMoH6m6ddW6r6ZAKUSQ5on3ZQQQ_Dpqh2q4RfkwI56dNe9CdpMhbakw4-0DtE_2BGgS4Np-T04dl8hEmtR7YjE3k3OsezjRE7PtJCKxylE_K-YQapf1F7Pe3ouDL2vDxQIlOZyQSwX3rTEEwvMXstQIkYUE1hFDNAMx20FbGR8T0XfM2QGmSOGpK8OfAEuknRR0yDyzkqpPma41wDhKvfroipt725iHmivdH-zcx8VhKS_ujWd2Xi7XUBvZenyY8bkkMNT5H6P1kH7zGJ6Iwxi7XEMkO4G5RilQzq9WURW_Gx5dxHoO66243fIsPKKBeiGPP-RR0GSuEDe_WtPqbfKkW1R9AzWtGCN0mZiQVC40gdk8Uv5gVJjwdOBozSG4uF85IdwxWRiwFC5FXFitkDjybqZ7A0kmMgLOsbxIxEupG2hro7C8Ob4KxzZIQAVJaAdT-R3dggBQIBSRwoiXI6hdIwmmCK5Gqj4D4tNEIgn-zRVtLoceWlLp0YmbinIRAMNISae856xcHjRpRRb-DU88GqVPULCrKjmcJgSuCMeI

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E9BF 0
0 108ms
108ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230123&jk=787854871938832&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ABA8 0
20 B 115ms
115ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BNHYLmBrRY-6aI_G89u8P8MOSqAwAAAAAOAHgBAI&bg=!Y2ClYCTNAAZSrDxfcqw7ACkAdvg8Wq2ca-4uZGpS3J477tEReCYYUdR8uP2RlBPauFMYGEJ55C-FwwIAAAG3UgAAAANoAQeZAykK4C2IehEhVTUKJ8rGURbFwLUC5KHo4nLYkjkT6emi_OmXjK76YLjlc3rb7CU7UowmhZrL3EtoyDTVErF3QUjxsrvJIzhCqctk5Y_SmVfVOz0aNV2eP0Sx9MluAlkSHQNyCncMXToDk1V19Qe25SrjmJSTWr_JjDgMrGc9BbNCvsQMsMIB3-z-2YnSFB_U90207Jol0GeZkrLlRY9WVcU3s8SSyWr0pzMHHoKq4zrNGOJ3jncgLDVp8hOB-nzx1xaq9YbWrwpTHhnYFFOs57GA8k9hXdhrldvUM_TJpHz7mcby8SFQEkgTJBZXM_s2AE4wmsIbK6p5ogRXXHvwrc9zTbOZkVsWi6sIrT_EeSkHSWNLFSsBWXIEkREFT5xs1-oGYNokAfNpzm2M1H4E9nipard3KtKT71DO2KAwAqTvIs-zzCGqhXIJVWXLlOx8-nKPqP7Z3gi8BvsbXRhdGYThvN2ASlmK_gyxXYxLt3eSRfYtbnyIX1NMUv9rZ07Fm36cQEDprlqcWtcnoTwjFrkQ8afPbnVlx56EnLIQhUWWf-DtGWqj4f-4ASVbwI0Zs3ZTHNuzxa2SK_PqL1JcAtz821TIuS61LkLDMfAvlpp3vsLqKN4uxgAaOjIA7bPf2OIlyJNrOqFJk1mZaJiEP5sZu5bO8M6-5b6LBJ3VgBBBQL-Bbw1_7prOMwFywu-FFXrF8slNdGSz_2F5admTCjruZmsacVdhS1llMB5T6nf0UgTqyLWIjrieOSy9sSMUTdX80skp-mPfaMYP5WwH3G-F3H4tuj1S3ClZg0i7TzHJgnBc2TfI7xLbt2MiDZ9SoRTdvfv8QRetgJe9tl2fgnPUHWjQBVId5Q6YmNdQiAYkPaKKkJlZX4q4PCk-T1uQsz-iLtqc1LkgIkNhgavJSn_EbC7Mj3w4Xg3fpWPVx1WxxDpEGcYU-CuBiSpeCL3r0XzpjFAryMifKIPA9-vG1Cq1uM5DOTWZ1PDqAc19yB-7dTCo7trM8zGFHKIH06_SWhU07CC7PgkJSPDRY2t7CQUD6MHm-o-Qj0jWPqrRGp-6XKOqWc6_YQlZXA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js Show response
pagead2.googlesyndication.com/bg/ Frame 1859 36 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ndpca2HbatLwKNxS7dvlJFKe5fdM9rHtoHQTHStku2E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 07:33:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14214
x-xss-protection: 0
last-modified: Thu, 19 Jan 2023 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 Jan 2024 07:33:11 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C30D 42 B
64 B 121ms
120ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstW-DPM9788Cp_euMgIijbXgeQ6V85gl7OX42-PSRUqG6XEkxlEPFr_NysL7CGq1cseWZ3wJVh5m0OuqQIguqOVaKlDBY_zp5rQ4bokLwtMprNAESUIFpi2T2HOXjWgRCRmWK5uyg&sai=AMfl-YQNUZPGC2_l6ErVtekLWON6rU2r2nT0EMm46KwsAxeh_HkLfXQ308W8wIvi5i03mzuYxDXEZD0qVfNZKyn2xrRfOlISlhNwwZKmOZrGY93dyTlTZJVekdCMOjbctw&sig=Cg0ArKJSzPZfln0rJe15EAE&cid=CAQSOwDUE5ympZNO3FUuB7ZGaUh4falS5fl2Gntpr2hA84z8KjO-cmfEkK2Pbk-9ZpupcIk0z8WLVXGL67I5GAEgEw&id=lidar2&mcvt=1027&p=527,749,567,790&mtos=1027,1027,1027,1027,1027&tos=1027,0,0,0,0&v=20230123&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3575694295&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1674648216240&rpt=561&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD55 0
20 B 108ms
108ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8284791658584&version=m202209210101&ct=77&x=1&cor=740343352990812300

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1859 0
10 B 25ms
24ms Image
text/plain 2a00:1450:400d:80a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?bP0B_g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:38 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C30D 0
20 B 108ms
107ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2584239916365&version=m202209210101&ct=76&x=1&cor=7347711312252080000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FC6D 0
20 B 108ms
108ms Ping
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2011544756524&version=m202209210101&ct=76&x=1&cor=1069454614765414400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 Jan 2023 12:03:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg
static.criteo.net/design/dt/8721/230118/ Frame EFCB 4 KB
4 KB 20ms
19ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0d3ae56dcf523334972a0a7c3041767a11b5312fe165903ac6565389a8ab2f1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:38 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fd-ef6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3830
expires: Sat, 20 Jan 2024 12:03:38 GMT

GET
H2 200 30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg
static.criteo.net/design/dt/8721/230118/ Frame 893E 4 KB
4 KB 17ms
17ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/30bd665ccc0b4d6b874e3e7632511e8f_cpn_120x600_1.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0d3ae56dcf523334972a0a7c3041767a11b5312fe165903ac6565389a8ab2f1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:38 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fd-ef6"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3830
expires: Sat, 20 Jan 2024 12:03:38 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 115ms
114ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230123&jk=787854871938832&bg=!yMuly4_NAAZSrDxfcqw7ACkAdvg8WtAmeV21P6wgMp2_gj66qwauGxQxl4iqlKdl31CvhzOPzmbYHAIAAAEoUgAAAARoAQcKALpsdlq4bz1LN7_M_KcMNSVwmQiqgxTkjPIiiu9CcHwL2mcMuy5Nc14cKW7jnP36LBVcBmkQjNrGUfb91dDjBfTz4ZF2w-MrOdkK0RZaDAi9X3xlRAAzLk1X_JMpF-Ze1rmGhsKbkVveY68Vm9h-KPTe4h8zjgBZ74KY26xQAaCtB3yn7DAEZp59eBYL990xC7emr67daRFesrY7ogrOM8thTiymunU3pgG9jZQxg7YMBbt5XWsFBZXggdmZArN5Co1Fag8yNzO4gBZG_4bb4wR0uSKtDd73riDsXxFY3arkWV_H9xmz2OjngrLa88aiNlPEqo8xGWVNeGr_sD2VevPSaPaw_NwDika2FyObyJNAY8CwbR4EMXcnw7Yzldx1F5X2I5OcWZsLVR9dVCerqlsaGtadC16R7rsC9yaxoMiN-jarvDK0f_T53ejBnYqsXRx07pw4boSlpB78W-E9v99ikC2UQFLGmIBzBnr0CpjokiqvCLC6FOWWAXgTYQ1n1m7uHKObYKM8S10pcJq0FR9AMZGZgKGRW2j3wmnmMbGaVZPqGyyynTArGoJXU1rGdH7_lG_7_aMqazfQBYg56OvOhDDSlGJgsHQCgNDxN2jiNjN47oRiK3hWxJMRb3WQusqritI8uMEf64QfrFlrrUXJnoc8n-JIb_I2_Yg60M158X2dym6usV5_jBgKsKE02EbgVEuwKDV-GT0qIaekZrQd__jiDgbpXPdkvu1Q-5xPLabHhHopiIXLQttdPpaXHfUEMl21bWupTdMyn5S1Vc6IKjIdTMl15cW0xNi2f4o8bLOeP0OCouFoZBpb9pmzKvK7zoa1irea1mAtB_-R4dqkQ9ZLIK8ME8GnYwDFGZF_2_Y8W1PWINZqHH3DZ0pAfw0Yu6ekRXCts-FYVUqqPzG4sPg6bJK1GEVrwTWedK1vkd9yMDsyX8vFIFUW7C5uMk5q57rS5Lye_UWJyH8e5pvQFDBtcGZVnzlEv3x9H7bcKrOSKgtCIN8U49udflMDsrx7Ra4rYRbbFbRcJj4eQvlzrpWIgMDlEWmnBvWijXM1LcCqWNCkWXpZLE6XmC4Bt3ujGJtIO9lyz3ttYujURMNXDrbQE82sFZ_bCEnA62RjORs-gPUBV07B8apGNLHW6InQftZoberNbrgd07pp7Cwy
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://returnofdisasterclasshero.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

GET
H2 200 logo.png
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 6 KB
6 KB 15ms
14ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/logo.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 05dc922859ded432bfb81de6d270b70ba28e892733aa26260d2f2a812f20ad93

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:39 GMT
last-modified: Mon, 19 Dec 2022 09:04:58 GMT
accept-ranges: bytes
etag: "3091995877"
content-length: 5999
content-type: image/png

GET
H2 200 wecker.png
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 36 KB
37 KB 28ms
28ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/wecker.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 438c30c5f92a624793f41bd96063c8b16ff78cf33082bdf0824c727f00ada4b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:39 GMT
last-modified: Mon, 19 Dec 2022 09:04:58 GMT
accept-ranges: bytes
etag: "822976168"
content-length: 37317
content-type: image/png

GET
H2 200 schneeflocke.png
imagesrv.adition.com/banners/268/01/06/25/34/ Frame B084 8 KB
8 KB 41ms
41ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/06/25/34/schneeflocke.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: d09d06605335dca5ab3af7d22ae237577d0143b234a03c7da171abe42b3c4516

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/06/25/34/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCWRHClxrRY67wLPXBiQbPnLzYBafZoqRu9rvsouoQjv6i86I4EAEg8tO5e2CV2oiCmAfIAQmpAtSmKH7oSLI%2DqAMBqgSyAk%5FQiYlY7ci0V98I3lfpbQIp2SrDMFzUsRZVcjMKbbbWJziyVQvBzWkY5lVY492KE6NkJbnBBlb9j0YoEfWJgXEcw8Wsw99vr9CEqrbESUEWOxkbI8R5nceOkV8WHlxP1VoPTl0ifO5SZaZo1OHAW0gfz27N6l3JiU6DHwnHqxO11yxdItVoYI%5FFW%2Di0TD%2Du4IBVQ1lxU%5FlCY4rgHrXC%2DJ52cAoAc8PMSI9HD7ol0YWrJen%5Fgzy0UUsOlDmBKcdK3eemd01197BTUlDzBMWafL254OKIwqOX00KntoGAqUqqSuqAt6lhweUjLOFnwD0ml2Vp38FKfMTVB%5FIGoD3cd2in7eYZcQSMiGPvv0PMPe5oZewk8UCNvGwOYVJgfb0fiajCvtrAEKevqoX3SRs%2DYJiNWcAEvuil55EE4AQDkAYBoAZNgAfE%5FbDvA6gHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbAT04boEcgT%5F%2DDX4QPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwDUE5ymJIm39H3hdbOAhjkj8vjyhjEQTlVYpomSlat%5FPNcNF4BCJBruU64utwOR2sWsES4XKynVGF5AGAEgEw%26sig%3DAOD64%5F2jQOgPOKBq6xellpwMVy7mZAa3Dg%26client%3Dca%2Dpub%2D5413329544040947%26dbm%5Fc%3DAKAmf%2DBHoJKMpaUy%5F6sITw6htf3Kqvidp4n8yA58CAGK%2DgXOurrKwe7uuqWHQA3OC4YKhH%5FgEwffl9vEKG9haAEzkb7s91pe5wX15T%5FLySUcP%5FVnRhPr2bR4C7Reg7kNrOhhfYhf7%5FwWJSQewxhPxjTGcFVO8mdqDCBpVmXXVIPkJuqyZknytGg%26cry%3D1%26dbm%5Fd%3DAKAmf%2DDrSKBV9CSCQNmJd6zGS3eAK0OcDENm9MHck3%5Fg5kIxuOLeMvTbnxXP%5FgLOz%5FIeUgG2atm0XfLrqBRCR7Uc9gePEpfDHpvXJ2Hgz%2DejTt8ybKntby5IgpeQ9%2DoU%2DEzyfj6%5FODpqnNeEQ%5F3A69bAgpU7LmTi41FYI%2DIIJCeGL%2DoKcUVfKLSRnyCVKCowj%2DMPL2L1F%2DQvOs7x5Yenoaqm2rSnCHv1QBunlvfOFw9SaY3OKURkR60o8zEnwkm54tbx7iJzClGJgll42pnEI2rVzZI8FnVJ9dvLp%2D6zJUCP9j54xYUM2z%5FxYm0MJOwgkJt%2DVK7crXkC2NoZ9F8DYARRB9i1BHi5LBNY9hw5lFHLtFUk2qz7kAaXkHbMNwzLyUWtqZ%2DrlabST8MNOGX2Z58%5F3Pno9nVDbh4d3Otec4ga7j3cs2%5Fg5EG7sU%2D1L3RgyImFTLLz69cCfX0Mir5H2G58BC1QuCXtBR28pVYAEdj7eTCHEKtCN%5FL4JU1Nyh30NMtekx3Qw3OOeUYn4K%2DFAq8Jm6LO2FgXKrv1j%2DoGXoDBG%5FHEOqBkz4vLT78TmGpNRCFK5bGqRIva%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7192559320039620967%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4789020%2526kid%253D5642381%2526bid%253D17182597%2526c%253D9757%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7192559320038507734%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7192559315748714650%2526sid%253D4389191%2526kid%253D5623783%2526bid%253D17179956%2526c%253D60885%2526keyword%253DPACS%25255F4789020%25255F17182597%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:39 GMT
last-modified: Mon, 19 Dec 2022 09:04:58 GMT
accept-ranges: bytes
etag: "3358988723"
content-length: 8098
content-type: image/png

POST
H2 200 all
csm.eu.criteo.net/ Frame 1231 0
127 B 15ms
15ms Ping
text/plain 2a02:2638:1::17
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::17 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 Jan 2023 12:03:42 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg
static.criteo.net/design/dt/8721/230118/ Frame EFCB 4 KB
4 KB 23ms
23ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c5a5d91081fc38f56495852489aabf23d3a7ef52d1df443141e630b59a54f1c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:42 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:26 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fe-f12"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3858
expires: Sat, 20 Jan 2024 12:03:42 GMT

GET
H2 200 24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg
static.criteo.net/design/dt/8721/230118/ Frame 893E 4 KB
4 KB 17ms
16ms Image
image/jpeg 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/8721/230118/24a03414b0d34d02bd2d864f7f37bc5a_cpn_120x600_2.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c5a5d91081fc38f56495852489aabf23d3a7ef52d1df443141e630b59a54f1c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Wed, 25 Jan 2023 12:03:42 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 18 Jan 2023 07:51:26 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "63c7a4fe-f12"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 3858
expires: Sat, 20 Jan 2024 12:03:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: portal.o2online.de
URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14112_PV&mediacode=29072291_4307561_354470166_170180369_PO0504A20230118&ref=29072291_4307561_354470166_170180369_PO0504A20230118

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.returnofdisasterclasshero.com/	1970-01-20 18:46:48	Name: _ga Value: GA1.2.1207468414.1674648214
.returnofdisasterclasshero.com/	1970-01-20 09:12:14	Name: _gid Value: GA1.2.1895677716.1674648214
.returnofdisasterclasshero.com/	1970-01-20 09:10:48	Name: _gat Value: 1
.returnofdisasterclasshero.com/	1970-01-20 18:32:24	Name: __gpi Value: UID=00000ba8ca13aa76:T=1674648214:RT=1674648214:S=ALNI_MbZcnQPVEQgw3dUz2DIJS6LMOBTDw
returnofdisasterclasshero.com/	1970-01-20 09:10:51	Name: _ublock Value: 1
.doubleclick.net/	1970-01-20 18:32:24	Name: IDE Value: AHWqTUmoZnB3J8vCsKFqdvJ7pIyn_74V9Y8L99KVfRUo-uB6ZKWWbMDnNnkExV1-DLI
m.exactag.com/	1970-01-20 11:20:24	Name: exactag_new_gk Value: 1743a7e86fd84c6fbad496601196a6af%7c26.03.2023+12%3a03%3a35
m.exactag.com/	1970-01-20 13:30:00	Name: exactag_new_uk Value: 10d60d0583e848dfa5f6eb87516e1677%7c
m.exactag.com/	1969-12-31 23:59:59	Name: session_session Value: 7818181148574bb6b1d2bb4f
.adfarm1.adition.com/	1970-01-20 11:20:27	Name: UserID1 Value: 7192559315748714650
.de17a.com/	1970-01-20 17:49:12	Name: guid Value: 1.8099702916400509210
.mathtag.com/	1970-01-20 18:36:43	Name: uuid Value: 833563d1-1a97-4100-ac5b-7a11973c9963
.mathtag.com/	1970-01-20 09:54:00	Name: mt_mop Value: 4:1674648215
.1rx.io/	1970-01-20 17:56:24	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-f41f8c48-9cc6-4627-aa0c-4edcd39376b8-003%22%7D
.targeting.unrulymedia.com/	1970-01-20 17:56:24	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-f41f8c48-9cc6-4627-aa0c-4edcd39376b8-003%22%7D
.returnofdisasterclasshero.com/	1970-01-20 18:32:24	Name: __gads Value: ID=53fa6cd834f0043b-222fec0568db00d4:T=1674648214:S=ALNI_MYts-JwrE8eZG5nK9yi53OKmYfIDg
.casalemedia.com/	1970-01-20 17:56:24	Name: CMID Value: Y9EamNcM3V8Avk1UwdegBQAA
.casalemedia.com/	1970-01-20 11:20:24	Name: CMPS Value: 5125
.casalemedia.com/	1970-01-20 11:20:24	Name: CMPRO Value: 5125
.adnxs.com/	1970-01-20 11:20:24	Name: uuid2 Value: 1510809215144162371
.adnxs.com/	1970-01-20 11:20:24	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVH@UEHj!@wnfH8K6pQK`!5=E<L5?%M94^AMqbP6uAT+CHfA2`@2GZ)k@.-dx/T3T8bpRzqF1`*b^xI)te4s
.adfarm1.adition.com/	1970-01-20 09:10:50	Name: lv_5642381 Value: w=4789020\|t=1674648216
.adfarm1.adition.com/	1970-01-20 09:10:50	Name: lv_5623783 Value: w=4389191\|t=1674648216
.quantserve.com/	1970-01-20 11:20:24	Name: d Value: ECEBCQGRKIEA
.quantserve.com/	1970-01-20 18:41:02	Name: mc Value: 63d11a98-be18e-6912c-da853
.yahoo.com/	1970-01-20 17:56:45	Name: A3 Value: d=AQABBJga0WMCEAvaGQwVELtMOcb6Ix_X49cFEgEBAQFs0mPaYwAAAAAA_eMAAA&S=AQAAAoqQSmuf1lmhJupG1M5gN8A

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20230123/r20110914/zrt_lookup.html?fsb=1(Line 21) Message: Origin trial controlled feature not enabled: 'attribution-reporting'.
network	error	URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14112_PV&mediacode=29072291_4307561_354470166_170180369_PO0504A20230118&ref=29072291_4307561_354470166_170180369_PO0504A20230118 Message: Failed to load resource: net::ERR_CONNECTION_RESET

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0e7049a908ebaac5a84e2ba0cfb21e37.safeframe.googlesyndication.com
ad2.adfarm1.adition.com
ad4.adfarm1.adition.com
ads.eu.criteo.com
ads.servenobid.com
adservice.google.com
adservice.google.de
api.purpleads.io
bidder.criteo.com
cat.nl.eu.criteo.com
cdn.onesignal.com
cdn.psdn.xyz
cdn.purpleads.io
cdnjs.cloudflare.com
cf6b2bdc12c68d69881bc1e0bf838e96.safeframe.googlesyndication.com
cm.g.doubleclick.net
cms.quantserve.com
code.jquery.com
csm.eu.criteo.net
d5p.de17a.com
dsp.adfarm1.adition.com
dsum-sec.casalemedia.com
e15c1a89da7a5fd643b21715dab11da6.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
i.imgur.com
ib.adnxs.com
imagesrv.adition.com
img.onesignal.com
m.exactag.com
mp.4dex.io
onesignal.com
onetag-sys.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
pixel.rubiconproject.com
portal.o2online.de
pr-bh.ybp.yahoo.com
prebid-eu.creativecdn.com
prebid.a-mo.net
prebid.media.net
returnofdisasterclasshero.com
rtb.fr.eu.criteo.com
rtb.nl.eu.criteo.com
rtb.openx.net
s0.2mdn.net
script.4dex.io
securepubads.g.doubleclick.net
silentinevitable.com
static.criteo.net
sync.1rx.io
sync.mathtag.com
sync.targeting.unrulymedia.com
sync.teads.tv
tpc.googlesyndication.com
us-u.openx.net
www.google-analytics.com
www.google.com
www.googletagservices.com
www.gstatic.com
portal.o2online.de
13.224.189.16
142.250.185.98
142.251.39.66
146.75.120.193
147.75.85.234
178.250.2.148
18.204.127.105
185.184.8.90
185.29.134.248
185.80.39.216
185.89.210.46
2001:4de0:ac18::1:a:3a
205.185.216.42
213.155.156.165
213.19.147.44
217.79.188.21
217.79.188.46
217.79.188.59
23.35.237.56
2606:4700:20::681a:9a9
2606:4700:3035::ac43:da9c
2606:4700::6811:180e
2606:4700::6812:e134
2606:4700::6812:e234
2620:116:800d:21:c5a4:625:6563:a5bb
2a00:1178:1:4b::1a
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::200a
2a00:1450:4001:812::2002
2a00:1450:4001:829::2003
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2004
2a00:1450:4001:830::200e
2a00:1450:4001:831::2002
2a00:1450:400d:806::2002
2a00:1450:400d:806::2006
2a00:1450:400d:807::2002
2a00:1450:400d:80a::2001
2a00:1450:400d:80a::2003
2a00:1450:400d:80d::2002
2a02:2638:1::17
2a02:2638:1::1a
2a02:2638:1::2
2a02:2638:1::4
2a02:2638::2
2a02:2638::3
2a02:2638::c
2a05:d018:d29:3605:675d:6b7d:32db:18ea
2a06:98c1:3123::
34.107.148.139
35.186.253.211
35.244.159.8
51.75.86.98
52.211.92.106
69.173.144.165
85.114.159.93
85.14.248.91
0180ddb41b42c5332e99d3e4435c0cf4a60f7722c09444a7285f88fb4de32f84
045cc9333310e313639851bd87b49ac3963757ae4949ff0a5fe37c4be4f68d51
05dc922859ded432bfb81de6d270b70ba28e892733aa26260d2f2a812f20ad93
074bec79664e9a3d860651a51a0f0894a522f745d1e530a808b90bc14294a814
07970172ef078d9a58aa9ed9e9b54dd1cfbfec021be21b0d0fc7484c5fd5a58a
07faa617cfb2a9cf77d9a06598ea37fa4c88cff217e7e73515318aa2fdbb9d74
0867a133aebbd9cea783e20a4bf845f019b34e5c6d1c4837abb0f5be27a2c527
08dad37537a1311944f9f3ec50cce1c5c5eca667645d78032b0b68d8a658a0fd
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
09b39faea4943abed73f1ca5095f3cbc2e61a10185d4a48b824fae621d11efc7
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d3ae56dcf523334972a0a7c3041767a11b5312fe165903ac6565389a8ab2f1b
0da4791b446818516f710c51707081aec7b23a7c5212fc0b2629c973210136a4
0dcf797aff8c8a65b44cea1ffd2c730b5a3b5706866924db258052344b2b9457
0f2f32c1e0c19e11c18902b586d90dd93d14f04ad96f609dd4176dc5f626fe74
10336fcca756b989a08d89e11f8657c0a9a3d2f4400ce1e1622b5b7ca3293c0e
110c7932b78e1f27d049f7a3718b9099a8aba3fba09a65e7e22d771661c58022
112fab27155368829c57d8c144fb4e1a5e360b4e147ec90a210778f00fb6d220
12542173538c65a44a029fc4ef9ba03f143e3319db24632336264bd4f50a4cd2
1268a7c49ca62060aa5314ae7bca4562d746822a92135be2e24da556d53fd8d5
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1690266a4def354da2feda545468781eefe065dab28c28e115ef23160308206b
1b765b0cbd95391f6db0b565988eeb70ea68aa77bb9f8f7c8a880d96474c2aa8
1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87
1de9e0d07a06da2a53b03c2b9072024cd3525253982add347b165c1d5f614cc0
20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394
21177b781b056933167e45a4b9a4b4e21c9c2592fcdcc5020b73564d785496aa
21c670994e1a8317d0cac7b9715a1c659573eb5d9f9b1327acad7a94f3abf12e
23e9a944e80cf479ba7a8c45b5019700991c39f60a328d6d53a5acc91e4dd823
25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6
2afb3cf38deea01d461f29b961c8aab0da4f121a84a9c843f49dc7cced99b6a5
2b19d446b1ef3db413971d8d02335dd5abc4faffec5a2cf867e2dff6dcc59089
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e
30cb911f391484b8e21831b552cd54f77d259e1b58e9e098d84adb968c8600bb
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31eba576e56105b427cc5072fdf87a2334b63d15933402686268d75dd5d9c69c
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32ab0a5c85cabdb695704b5128a8fb7c9a8dfa3242cc36ceda6bb0650a45b35f
340360366739b1523bc21f969f4a95b9dd94014c07afa9d4789f639b54094d24
34105da8973bdef5f096304c920c976eb20007ca983f322b4d1768d9bba9d1ef
34814f621b88ef58f44fac3b466fecf1d87834ca714efa7861095ad32777b89f
34aef5f748ce6ffc3bf62671ef6956485209b36b1f380e67dfa144eeefe36148
35da5c6b61db6ad2f028dc52eddbe524529ee5f74cf6b1eda074131d2b64bb61
36bd895003fb4975ffdaf712c3af10df02078bfe8848ed1922c14878f6cacb68
36e5fb48cee849a51910344f29460662f8b5703dfa6102042122b47d081ca73d
375e021eea878a252407f1cade3523f6f4533fa251cf0727c70c887898a42b44
3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b
3b8c82e1a32337e150164886ef2dd2761fc41c86ee4f6f98b6b3bc408623fc81
3f9909775d48d612aae837f0153817e8addbfa082f901254471bced4d8c72691
427b2be8291d45cfe36c8fabf11df7cf4ac2b690d0c3e56c00de12b24f9e5ab0
4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b
438c30c5f92a624793f41bd96063c8b16ff78cf33082bdf0824c727f00ada4b5
43e7c5032ef551716251cd76d2d271ff8a66bda855fbf366d176e1629f33f8e4
4409401d274e605a324c4235871c50361f98f05de3963a9a4ca2cba2f9223707
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
45d332aab81c93fed59ab2aa2e9cf1d2796ce6932205378d1174b0af747b4ce5
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4ac736b755d1e73b248cacf82a532914045934b6166f27d849c5c48853039c63
4b11a5a999e3e3045fc364bfe9c81bad4fa5934331c65dc2decb4d59a08ada84
4b1e93529892b7f06b60e94f67eb3ccc1d7c1c1e760bcc38de14a765fb7eb50c
4b3b4486cf5f4a098853794b725b196af8800dc64616122ca1e62854b13c1667
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e17f25a33727defde4f0e88b24844c00e48ed88484c4440d978025a82567287
4ef7cd3d4ed7de91e7eb3c05a31c6fa1da0b08d07cbfab8ae108c34d5e39cdb9
4f914a87cc3c1cc1c7350e318ae9a4ac08a5141abb0f165022d41d2be355197f
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
506db66aff67125a930d91b90c4d401cccfb7b00008c26a518445776970d7626
50d455c07f26ae94481e9cb2dd5129a6d0127a650d4e3609370d247b53e4f814
510c2d0b252c733bca479c67c5ad6ba03821ca6177bc4ddddd3568d2bf833e50
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a0cecf509251de7b796c7c34ca1374bbb3fabe582e9e9394f1a1ebd9d421997
5a42d00832679359932e0dc8aa8a93a2731f7f626a8c55641fb560cf695d6ea3
5bd573e2a3c35112ed635d837e02b3e4e53f61a246ccd55b91525e6d28489f4e
5cb702383dd5a7554ab4492cbcd649280b04c792ec2046a805f026eca3083558
5cc82541728ac4b6bb4a5d544f009c7004db65a48fed2552ea19604aad007e76
5e880c8de639677c2ec0a2759d646fc8a6ff41245d648994176a8f1f22c0dcaf
5fac38c45343239fc75d4df8825d8bdf25c61a380efae384e3e1ba7554789c50
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61d967df99ed6106c8a054df228d528cc714fbbb3be380501cd02f01de099cff
6494566919e28711a1f36d6389923dfccb4750fb9522e9e6d1967ab778ab0073
6546d25626026e24a037df961acca9a80bfd5ce00985f7681db5c6642aaa2be7
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
668617a2777896f805c70aa41a6ccc1dc1d64f0b9fed4bafa3e2c7c1f87c2ca8
67f9fc2b60764aed2f4918acff39b40e8f1e79526edead31b3f83d7970bf3d2e
682b9a643ebc5c5b7f54f802fe82d4d9117b6cdff3479110b81afdccfd6148c2
6c11366720a04c3215987caeea1295ef63e8d5c9c1dd28d7fcba12fc2469b9d4
6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f
6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41
6f546448acf820e74ae00f48af2b49efe00381ea2b178cc70b74146765993830
70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
752e5aeeee17ac71508d5b82c8ef4c1067100f4e80905c9ec2bfb0d8ba302c3e
76376278e4b868bf151dd8258598809c0ea5d932743a7f12833112d09ba8b5ec
79e66558ee620ce57bc0a6be17a96c32074065e763b49f0be5551799623943a4
7b4629d58a15c76cb0177c9cb33d8bb598f91f2c03d435e172b4bdc10ee8e3c7
7d84159abff8ee67a49b660d0d1aef9c838c6dcc7436c9b9e753a22b3cd294b7
7d9e1488be90235f9cec4b6690a0184ee3215fb123469bc141b82699abb6bbb4
80f162a762dea93c843164cdfaa8b2e89c5f4f82f39d212a107c3e2b5cbac129
81615952e40e467e5c96639d12f1e0bed25096356d7982f61a9c791e197cd24a
8200a46b28b1526743481d9e2f62d8a905548d867253e55ce86b0e421d2ea922
8298887ec48e74ce99f322a40fc502ca42608dc8c10e72585fc491c074e896dd
835f79262dd6633b91d8bbfeb62f78afa60dbd0a40072b402c1d3ed2a6d4a410
83c079e782cdd3b2edc325e9a5c8e7a67f4cd381d3c5f4eb79d3abd2cdb2de0e
84161c46238fff2c6920ebc28f02cddd7b710cf3d1107853f540b084320f6afd
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
84eb4e7e7af68737ec8e7fb0d0ad2361bf863ca510ccacce2c241983bb010ab5
85651f9563a36aec7d188d222ec08b7fe8c90f982bd29fe69451f0494656f0ac
863785adc44f68b4f6920d3225c986a719e0c97a6a54b1a9a03837790f5bbcbf
8810ba3440bf482ced33d2f74b7803bba711f689d8e4caa7da5c6ae6844a1b49
8a71642063b020952cadcf6d4c2cf6b48d594cbe4bf1ae5283bf6d10c4e95ad9
8aaca6dd7322bae522f4371583a03d7c81aff57b57b6bb20fea799768a36fc2a
8c6e197f9b0a3e11dbb9bf10f937d243becbe440d526e405ebf7e887cbf44f50
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f382e5a3a2fdde68f5ab33189073c34de7981996f006a6f8782c0620ddf6616
8f840c925238b7e3bb44db5daa9d97633d127e35308bd00ae975fb5ef6b2a357
90fef9d0acae0cc250d08d7b98da896c6c0dc6bb33999ffce7819fad76e5ff02
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
92ce40715e78f5d0435e3bcf57e34113ead0be54f46e77a1653f4780189696cd
92d3a001fdba54825896074c47c9d3283c2cbbac5b470efc9c4037e9bb543041
94f832a19fa507de1dac4e2a0cf8d775ed005c329bd5227615d063ad517752da
96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9
96eed42e394f5b00f1e02a12d1ce9557aae7cd751e4a9ae2b3e8fc392b1db945
97eb9d9456306290083a819d78d5a4b60bbac8dc0329fd71a091039fdefb1a12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc
9de8122b7af1078ffd18e7b4261ce781ec4e46f7ef9b7bc9356443fceb480f64
9e228c9570cf2d38a44e528040f24303e0cf87ba1dc5bfcc2720bcff90fd887a
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a271850a259b8fc2958e0368e90b8f57319c36737c6c385d7d1511ed948052e7
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a35f2e251d2e547a8a29bb5b422820656e0a90e38466bba16d4dbcd7008ad94e
a39bd87812ca61ee7325919c95e0af3b8122afa33e8030700322efcecbe6d2ab
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a53a1b8e09ad2a82953fa60923cfc5582a9beb0c903d58eb111314ab6115b534
a5c5983e49896f5993ab0ab4f248af3d9da907a93bc49a239f0e961f81d8a4c1
a6a0d5063fe80caa8661eb856f667f7ada976a0c4cb7ebc1fc163ec924a70067
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a74dbe391d1b70efea8cb0d538724a4a5dca381db7528d7b1de55352a9c74e47
a76aa393d6137493a19b5b34e4fe42f2af0dd2987815eedb9be47483355ff4ac
a77918c4a5338c8732e4229d76dfbeefe5ddee9f78c0d78ef431a4a92c8a85b6
a7947d98f03d314ddb7b56e2c5d4bc3bc2fd10a33bed42ef5f353a30e7d2647b
a7da90a6886dbe0df271f68772eef1e99ebab218c06e9a900cc586f0400d9ba8
a7f1be4799bd9ff90c7bf1ff5e2e9a84ab86a477e8347a61895b0716f05625fa
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
a93c90b4e3ca866781992d8b1ba96ff92fd1ca501d97e8a2f97a04a1c9f0d202
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
ab2c9ac63fdeb298fee5e857c1e2cedcfd86507345de7d8eb02197791389dc0c
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b03a4365b0142950c3af8f381502635ac094e23d885b03a4ac0cec1acfc8cb0a
b0a89ebadfa758790bb0724071f5538185d9f382fbedec2d75d14fa1c219c4d0
b0e4d6e13eb1fd414025e5c3c3f18b9212fd0cd69890e7f69804ae69dec5bbb3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b177393bb52a27d045184e12b1bde8a164ebf8d12319003fe72cc36a2325f5fe
b2ff39ccfc80daf66110e4b104956bc70911dec5c51764de1c19422439a34ba5
b380887dc66bccce51e2a65719bd79619ab197fad12c851ca31ea831a2056587
b46567af498cc5d9c06c3f03bdb3db3b9ca14bcda9625f864b57192f90bede08
b896b02caf801467476e5280340221ff164b7be0bdbec0be8250477f5e20c212
b8e78b48acc08ce31457aff168d6fb2c814d51a8739a97693cdba585d60f5b35
b9a363407218fa3804565855e7885286a7cc1068188a33638874062968e7a250
bab745658ba458848b2d2df5e0557b98b70867124fd5a059fd25f9801e01a87c
bb0c5ae74cc4811ef8cbd9b48cc1a822024574b300a44345c21fec42ae96c176
bc54379b6288f5970da471f0f64ca15f8c9e3a3819a0950608a45b7479d5a11f
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bddbf7e9ab14ce92ecc37640bf54fcb90d8a02da52d87ec12e252cfde4432e66
bed37a9e40c349fa54d80adf4e18be18ccd88bfb0c264465bd2441d09a52ae2b
bf29a0826e30cdf280ba376f1bd1088a711ceba035972f5b73af56c40c0f2de1
bf6ec42c97f86957a324a484a37dd528b568a9ff2570965be53e6ec4b0dfdae2
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c26af84a7972616bc72fb4c63097580f28f1ab28c755e71396971416bdffa901
c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95
c384e161dd9d69bfc6e872774aadc81b3bd7534a97c5541d20a83c120704dbec
c40754db0cdf6d076e637823f79a6da89bc1833883a8653572c1348651569726
c41c77ceae3327a4186c557d3c686d5679a7b9dc0e15fb6adafe53180ebef909
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c5a5d91081fc38f56495852489aabf23d3a7ef52d1df443141e630b59a54f1c0
c668f8859313a4e2dfc5109eab8a4348944e3e5ffbd1c631556848f6936d6767
c8a49489f495524cd96a24f7c2ff2c3ff8ac06c0d87877518834821872533ea7
cdf06ed6bd6c5c8b31c27e6a2052ac666f7d5792a0cb57523faa24d933bee1f5
cf98c19c125bd70626014b2f30256b2605e917cc01c7f31b89fb3cbbd2635483
cfc5afa3cbf80ed8a39987d2f4cc9215f915cfde9c83e86d5ee4a874bd69a401
d09d06605335dca5ab3af7d22ae237577d0143b234a03c7da171abe42b3c4516
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
d230fa6c14bf1f2df177f38c46f0d091f90ea57753e36e035616a381bd43a2db
d51105af85114f8e1637892f3971892eeaff4acb5d8ce2cbeb0eae526c1a1372
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
d8e1433257284d2d9c362ebc9cc5b2d9ab37d2fee70e29624955f6bd033efd28
da1b1dba110f3d97894949bedfc60fe7fec3659813c957f88e51d550bc95ad88
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dc1ca4850a9ee967d6ebcb561007bdea073f8380ae5a0a4f634945e3f9b59b87
ddcf0909c529a54c1ef1b830d132983b43262495b8a25068d167142c8e701466
e13459782d7fc46c73821602bedc17cc2b3a2dc5ec07e91e30ed715193698a94
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52ad60cf8269c44381d5e0833e69b9b8f3b9f9346b7066b1dc5a52b390feedc
e623fb84470c4897c59668165e7d2687c9760f9c054ac65ccea5305885bf8e6f
e777cb1ef56ba78f331b760f8fa333b91b1f7ffaf3c3ed0fce8a7bb3ccfef147
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
e91cfc81671ebe7a4184747ec2e76157af7458385f4baf64bcb54f9016c11e90
ea26064fffbbb526340d9e5416176537073f1a86c676041f2b7ad63ab9c367ce
ebd428520f34b12ff9ec27592a228a14b08075f8822c9b158b54ecc6d544fe62
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ed44e345a8354731787a4fc575c66363aac13eebd6007b88aecd8a1deea341df
ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf
edb79682e63246515260549ce35ef25b28017be72a0f1f7701eff54b6cc54f1c
ef17a9f91c061c1acd3ea44921065e1257b31be45858b6d00862e89fbb66dccc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef83e5eba3be9b463108cdf8c3e7735dea7c34fbd899658e0a2b62ac9c6d7826
f40268b52190ad94fe5a34b37958ab9666f1d99b2c35bee0c1fab24b38080fdb
f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f7e896b282351aea58912d278843b5663b8c04d9214d83cd9214faffc01125be
fa932d5932542e00a57bbfc82cfd9cc42dee289016dceb776d4eca8381e0c737
fb01433163c883137ad42e1ee9b18712a11d8d487ece10948f5eef21c57a16fd
fb435314ce75681a6c9a45a996bbacbb97001cef5c442e9cff6a7d552c28443f
fccfce221f5d033301592f4d78b9ca4b08c025aaff07dfe416201aaccf6d3731
fe71418a9f39fea16ad4a058d80c182b70fd3b81a310bc9bce0ddbcb36dbd82f

returnofdisasterclasshero.com Open in urlscan Pro 2606:4700:3035::ac43:da9c Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

450 Requests

96 %HTTPS

55 %IPv6

40 Domains

63 Subdomains

53 IPs

8 Countries

4598 kBTransfer

10498 kBSize

26 Cookies

0 Outgoing links

Redirected requests

450 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

returnofdisasterclasshero.com Open in urlscan Pro
2606:4700:3035::ac43:da9c Public Scan

Screenshot
Live screenshot

Full Image

450
Requests

96 %
HTTPS

55 %
IPv6

40
Domains

63
Subdomains

53
IPs

8
Countries

4598 kB
Transfer

10498 kB
Size

26
Cookies

450 HTTP transactions
9 data transactions