wheregoes.com Open in urlscan Pro
2606:4700:3035::ac43:b70e Public Scan

Software

sffe /

Resource Hash

4baa280c316f80216c7d9dcb64f308726f23cfe4fd4ada8d36aee7c3ea101108

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 21:31:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131975
x-xss-protection: 0
last-modified: Tue, 30 Aug 2022 08:35:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 05 Sep 2023 21:31:55 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 114 B
727 B 77ms
22ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

cafe /

Resource Hash

6a2a2dbe0fa48f1113ca9405fe31993bdfd0ff541fc001294545f37fb7c03aa6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91
x-xss-protection: 0
expires: Tue, 06 Sep 2022 03:15:49 GMT

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
672 B 85ms
18ms Fetch
application/json 206.189.25.121
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=468239&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 206.189.25.121 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-ldn-11.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: 51b6071eddc4a7b28e00147e130df385313f14ad606d3b9d4530a24d01621382

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 559
vary: Accept-Encoding
content-type: application/json; charset=utf-8

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
873 B 59ms
21ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2551
x-amz-request-id: tx71de9a623ae143c39231a-00629f978d
x-amz-id-2: tx71de9a623ae143c39231a-00629f978d
last-modified: Tue, 10 May 2022 09:57:32 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qDFAybgmH6XjZtpcBh8g%2F29zqFxrqxLKZpWFtTByWV6sNXrdW%2BVQywEjZ4EA%2BscZl%2Bs3t%2FqoI6KrLV7t0w4mq8NRjyQirPm8aDc1E8yUj%2BAwOmmnDygI65Xp%2BdQRyQTUKT32tFAyubuZ%2FvIC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1652176652152482
cf-ray: 74640adf5d3f419c-AMS

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 74ms
35ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.10.0&cb=76032207011&lsavail=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:49 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
360 B 53ms
16ms XHR
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 40 KB
16 KB 164ms
144ms XHR
application/json 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

20d4e8497d502068ffca44509afb5f79d265c3b37540ac376a6ecbabf7c03a81

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 06 Sep 2022 03:15:50 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: daa2064b-6289-49b0-ab96-22a3e63b60ca
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 prebid Show response
mp.4dex.io/ 0
256 B 174ms
131ms XHR
text/plain 2606:4700::6812:372
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:50 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 74640adf7f5db81b-AMS
x-err: Parsing the Prebid Request. ads.txt not fetchable or parsable
expires: 0

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 7 KB
4 KB 635ms
302ms XHR
application/json 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_7.10.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: de98609c235193bd446a711449d96a01a1899c642da120382a88106de4db688d

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 06 Sep 2022 03:15:50 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 3574

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 373ms
139ms XHR
text/html 34.224.253.29
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1662434150265&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&measurable=true&bids[0][bidId]=32cba6ec9f9d694&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_ATF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[1][bidId]=33881f1e43c3b16&bids[1][config][property]=WhereGoes&bids[1][config][zone]=Wheregoes_S2S_Sidebar_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[2][bidId]=3468a1d456300ee&bids[2][config][property]=WhereGoes&bids[2][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[2][sizes][1][width]=300&bids[2][sizes][1][height]=250&bids[2][sizes][2][width]=336&bids[2][sizes][2][height]=280&bids[3][bidId]=357eba4b3c09e2d&bids[3][config][property]=WhereGoes&bids[3][config][zone]=Wheregoes_S2S_Sticky_Sidebar_ROS_Pos2&bids[3][sizes][0][width]=300&bids[3][sizes][0][height]=250&bids[3][sizes][1][width]=120&bids[3][sizes][1][height]=600&bids[3][sizes][2][width]=160&bids[3][sizes][2][height]=600&bids[3][sizes][3][width]=300&bids[3][sizes][3][height]=600&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.253.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-253-29.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:50 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H2 200 adreq Show response
ads.servenobid.com/ 755 B
700 B 301ms
226ms XHR
application/json 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4365
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6bfde5b839e39982ea64aee37f30c596b7424190f801ef459f2b2c6085d407bd

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 358 B
705 B 61ms
23ms XHR
application/json 185.255.84.151
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.151 Ivry-sur-Seine, France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

579e3287f1dc2c8673d943a9fca6aaff56da1f6b23476b8048558e61d5823694

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:50 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 8
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 358
expires: 0

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
291 B 116ms
73ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: f5df2613ac90f895bc9cf411f06b5e95098f64bcb30fb30499ba007edc5e6be5

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 140ms
96ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 1fbf988238f71cc8e7ce850a80886258cf080bcb819e5574ac49f52f3f77c98a

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 124ms
81ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 4bd3f75987302562dc687a008afaf80f344e1912bdc1de1bdde413eed370841c

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 130ms
88ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: be1559dd0f1ab46aca9e64524c5e2a489e65247b71284029ecc60d802f87ac41

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 132ms
90ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: b5742e9bc74fce68cb1d4151e280b82ea5c536e7364d67ecc92a062ff6ed3db8

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 155ms
113ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: fe257fe560b097a04d9544228ece5234bf095c5d4349f9f180d061000d1735ca

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 168ms
126ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 6fa447186f62fe461783cc6e275a7468d9b793a090be1347f922d83ee658d033

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 152ms
110ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 227f7277a6895df9628e9cc66f4ebeb5705dc9e268b87fb4b16a41fa322b6e9a

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 125ms
84ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280cdbc80018&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: d0ee14c470e8d08c379128de7a045cdd34709cc9f667d6b86d00fc32d5b5ea28

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
906 B 146ms
109ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: d85f1a6f9640b8510ba69307b7fc7d06333e600d6b103c13aff94f908060457e

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 353 B
1 KB 117ms
70ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&tk_flint=pbjs_lite_v7.10.0&x_source.tid=03d09f17-9c55-4c90-83c2-aae7844748ff&l_pb_bid_id=73dfdbe8eee95fe&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&slots=1&rand=0.7192330569535035
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: dbf9ea42df2f988018b11dc1922d43d6efd8829c984ee3f1de3cb0ebf86b5844

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:50 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 353
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 331 B
1 KB 120ms
72ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&tk_flint=pbjs_lite_v7.10.0&x_source.tid=37f616ac-d684-4cfb-8220-8c6ce506e4ef&l_pb_bid_id=74e04332f5b8336&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&slots=1&rand=0.3910942941893112
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 899d5f0272b139bd8a99c34aea9678affdaabf8eea3b81609a1b2695afd6be46

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:50 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 331
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 363 B
1 KB 120ms
72ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Leaderboard_InContent_BTF_ROS%23bsa-zone_1641318314037-7_123456&tk_flint=pbjs_lite_v7.10.0&x_source.tid=732f36e2-fc95-4883-a911-697a724ff3c8&l_pb_bid_id=7523332e3957d7a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Leaderboard_InContent_BTF_ROS%23bsa-zone_1641318314037-7_123456&slots=1&rand=0.8707015527894213
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a5d6ca48a92b69186c036cca0495499d651ee2741c2e310509c894d921200a72

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:50 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 363
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 362 B
1 KB 129ms
81ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&tg_i.pbadslot=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&tk_flint=pbjs_lite_v7.10.0&x_source.tid=03ac7a37-f71e-4847-a4d8-805a0250a296&l_pb_bid_id=762d5bf5dc57114&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&slots=1&rand=0.9339276952327009
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 3f3de13410344029a01c60b30a74495ba2d460fdcf592f150ca11e257194c8f5

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:50 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 362
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 54ms
24ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 197836
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx6e74bfe3022248d3b6d59-0062b3893f
x-amz-id-2: tx6e74bfe3022248d3b6d59-0062b3893f
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Un5TlEAoD2I9ysOpzHeFbNmHUgr5txLToGpjVRtQ8eZB5q6oYpctrnMdwqHf8LsqQPG6nRk1mkaszjFDrHt2tNgBcr34fr%2FFw%2FVadGHB7UB18zjQjZKlxAHWo5VnyPk36bBoXs%2BtxEuIMQOx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 74640adfad6eb7f7-AMS
access-control-allow-headers: Authorization

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 72ms
23ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 56ms
21ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 91 KB
17 KB 128ms
98ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=785618199491999&correlator=4175346619852996&eid=31069289%2C44772498%2C31067825&output=ldjh&gdfp_req=1&vrg=2022083001&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%2C300x250%2C320x50%7C728x90%7C300x250%7C336x280%2C300x250%7C120x600%7C160x600%7C300x600&fluid=0%2C0%2Cheight%2C0&ifi=1&adks=1696759606%2C2861055222%2C3878002045%2C3809685794&sfv=1-0-38&fsapi=false&prev_scp=optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.03%26hb_adid_appnexus%3D787c33a89b803de%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D728x90%26hb_pb%3D0.03%26hb_creative%3D78827815%26hb_adid%3D787c33a89b803de%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.03%7Coptimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size_sovrn%3D300x250%26hb_pb_sovrn%3D0.02%26hb_adid_sovrn%3D80b3095f63bb86a%26hb_bidder_sovrn%3Dsovrn%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D797ee735db826cc%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D300x250%26hb_pb%3D0.02%26hb_creative%3D4_1214669%26hb_adid%3D80b3095f63bb86a%26hb_bidder%3Dsovrn%26_bd%3Dbid%26_pl%3D0.02%7Coptimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%7Coptimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1662434150947&lmt=1662434150&dlt=1662434148848&idt=1077&adxs=436%2C1091%2C276%2C1091&adys=474%2C666%2C1127%2C950&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&frm=20&vis=1&psz=1182x1412%7C300x952%7C862x1020%7C300x952&msz=1182x90%7C300x250%7C862x250%7C300x600&fws=516%2C0%2C0%2C0&ohw=1182%2C0%2C0%2C0&ga_vid=1981093291.1662434151&ga_sid=1662434151&ga_hid=425989917&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4215f0254a9310bd04e43e781ec536bff74eea4d13ceac6f3119a42f48a21cc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17097
x-xss-protection: 0
google-lineitem-id: 5651215829,5650535185,5320060794,5320060794
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138344350495,138344350498,138305491763,138305458998
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 76ms
36ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022083001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

92458e1c6b3b4a4cd4d6870a8576e7374e7d2a261d714e23c912bfb661adee8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10868
x-xss-protection: 0

GET
H2 200 container.html Show response
90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2B78 6 KB
4 KB 89ms
21ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
expires: Wed, 06 Sep 2023 03:15:51 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 69ms
22ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F88E 0
0 52ms
52ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssLCo8xJ_YE8mCQ9ALU5OuWJSackHf-GEBGa_UPnXzxBtjwO3X2sgxuJrtG7pYPS-7PI4E624upyb6gFUtKeBfDNl5kX5i8s6o4p0mW9cxae96myXON-xcATdPzlVvyYMHbOlBJfb475aotpz6INihnb-Z2VLgtPYfFue-NsFmPTJ3H05HlElEaq3YEbQV1_5KYYNWDNrHBGJ-7s7jURVVb2g1nQ_PsofRQ0VMnfOLsb7e1Vqq8XTfdMC1-EdKbh2M4Du2qwb3UV6i0sjY6MT9NqxbUzUteuGepCk_okqeknbYxKTsN8ffcc_e_nc5YPzEKguEx-6OmW9nBVsd6heAYavSEu0g&sai=AMfl-YThgab5NyWYc6SWgROeSowGDo2RJHsPCsRcHX99E_IWGYSk0fcpfUDVXredOKi3kfWfZFVNGs4RCWUhhRho2Rxn0wIspBlCMzzxG7nl67GlIgKc3k3G3rGP_5rxzQ-7uQ&sig=Cg0ArKJSzKf6UHML3xKnEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame F88E 26 KB
9 KB 22ms
7ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 21956
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 8874
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
x-served-by: cache-fra19143-FRA
x-jsd-version-type: version
date: Tue, 06 Sep 2022 03:15:51 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F88E 142 KB
44 KB 70ms
41ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 23DE 0
0 52ms
52ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst5nHkJRO8-56O_JnochcAd82YS21Nx9WTmjyuB-RID_ZkllM_A1lTSZyoB0bP97XgjnGRgKHlKOeJ8FTXBlpFu-OvDBnEnHbwnb3nHau5sfHpTD4VYhh5BjyO2zzJgSlrcOiP0wIPXU38q7d2V1CCpv_0qgDCBMORV7jFeA2Ez3_eTbcimnQWWCOeoW_lC3YtseYM0OeGe8QQtXwptZFaf1cOWicAU43OO09pb6sPvZIcSOyJXjjNZ_VpzljVWn9rycl28CTC2vg06-fHzjUUZEShz8W0lP0j3AzqYPTRhk1n_P4jTyFyr9ZhB4H7hZdClcyqQM79fXcHogPuKVA8GKoc&sai=AMfl-YRLKnUuBhjYUAP7JVYndO-nU7WgaUhvheV9WllRtYkThwN5wLPKjBpavOUfh1ZtoUN4bI-JCb0uTOJUwt9x48edaWmuwySHufgiJU-06apPuRnpQDVnStVrrBx-uMj8Xg&sig=Cg0ArKJSzKASXuf3A93LEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 23DE 26 KB
9 KB 15ms
7ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 21956
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 8874
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
x-served-by: cache-fra19143-FRA
x-jsd-version-type: version
date: Tue, 06 Sep 2022 03:15:51 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 23DE 142 KB
44 KB 76ms
55ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 container.html Show response
90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 95F1 6 KB
3 KB 42ms
14ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
expires: Wed, 06 Sep 2023 03:15:51 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A9CE 6 KB
3 KB 39ms
14ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022083001.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
expires: Wed, 06 Sep 2023 03:15:51 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D890 13 KB
5 KB 45ms
14ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 23582
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 05 Sep 2022 20:42:49 GMT
expires: Tue, 05 Sep 2023 20:42:49 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2711 783 B
1 KB 60ms
25ms Document
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3c78e387ce4c6cacf1d8cda1caac884b00c75b337382f43f2a8a9cc0b534be52

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_4wCEOUPfbmiDSajTv77MQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-_4wCEOUPfbmiDSajTv77MQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
expires: Tue, 06 Sep 2022 03:15:51 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 0351 13 KB
5 KB 60ms
25ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76119
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Sep 2022 06:07:12 GMT
etag: 12223946614886178233
expires: Tue, 06 Sep 2022 06:07:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 5895 7 KB
4 KB 59ms
23ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13385bc296bb2dc9cac61d19963d6868de43445187fdb91b6980e892773a1c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 02:30:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2728
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3151
x-xss-protection: 0
server: cafe
etag: 3095951791532391640
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Sep 2022 03:30:23 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/227/ Frame 5895 85 KB
29 KB 36ms
8ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/227/trk.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e8962d65caa8b6f0dc72b61fbb38446161265efab5e41ca343cedfafd139a4e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
Age: 497872
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29299
X-Served-By: cache-lga13622-LGA, cache-fra19161-FRA
Access-Control-Allow-Origin: *, *
Last-Modified: Wed, 31 Aug 2022 08:56:29 GMT
Server: AkamaiNetStorage
X-Timer: S1662434151.188599,VS0,VE0
ETag: "6a0cd0532ee3ee4311615d1638090572:1661936189.164265"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Thu, 31 Aug 2023 08:58:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 1, 1223833

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 5895 0
819 B 28ms
7ms Image
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwheregoes.com%252Ftrace%252F20224364602%252F&e=wqT_3QKTBugTAwAAAwDWAAUBCOb22pgGELPH06iXt4-gRBgAKjYJP_89eO3Spj8Rb38uGjIeoT8ZAAAA4FG45j8hbw0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreLHZBYABAYoBA1VTRJIBAQb0jwKYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQzNjQ2MDIvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1ELVFaYkJxZ3JubnJRY1NNb2l4bUQtaDF6cVcwdGU2UmFvNng5U0hPTEJnblppNUlPWU50cy1pS2xWZktKNnpSZmMycXZaOWw5Q0pvdC1tUURxUnFVU1lfcUxSZyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM0OTE3OTk4NjU5ODMxMTI5MDExIgg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdOxv9HTutbTW8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbVE-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDExNzA0MzcwNDM3NLoHDwgAEAAYACAAMAA4ugZAAMgHsdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfC_AOKCAIQAJUIAACAP5gIAQ..&s=8c7d7e5e9dbc1c27082468cd1574bba50af6c440

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 19b13d14-ec88-46c1-80e4-2c2c856c386b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5895 0
20 B 79ms
48ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-As0adyaY7PEIl_AEEwp2aQ8NEns1VgLhx3e3ZxxWO5Tfpqn6Dn0nmowU6VINB4H3G3qlcP9PvrEIYQf6DGz_Nbc1t0jw

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

simp Show response
pool-usw.creative-serving.com/ul_cb/ Frame 2407
Redirect Chain

https://pool-usw.creative-serving.com/simp?buid=&guid=&ic=p3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8TQcj6U6...
https://pool-usw.creative-serving.com/ul_cb/simp?buid=&guid=&ic=p3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8T...

8 KB
8 KB

162ms
162ms

Script
text/javascript

52.9.77.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pool-usw.creative-serving.com/ul_cb/simp?buid=&guid=&ic=p3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8TQcj6U6rQr6Zn6WRD45fG3ulcgEi9-yUzEbH51cCMZATvPFS05uC4EdI0qtGXwVgzxI02LbWc2qFh7MxxcykJ6fHUMLk.2p7xlNajwLyLosIIxYO6HDHwIFER9G9Pn-vS6N...9b-M0IQeu9rnloRNyrXT47Xg0oDOAP0Rv5jhAf-1I9gApUjJVlUrJTJR0H5N5ibymu.pdrLkHzGyZfMTkkizleMLTvwa12BqTYAsLitxTt60tVlny7rs5oRu-wX8PqunsCcZxYq30.dOa.cBMWqFda9i0L0ZI23w2l9n2SC8PHynpSPq.cE7GkSuy8bKMaJ9dwq8rvZ.1totOeNFezYpEaVwOXiBu8T41lNaPPsFxlYdj71mig3FCypkNAZXrgT3JPenPer.JkmBrDKb9lfk3b-GRwchPQBIRCWFmpUG4UqYN0XuuKYSZ73dcvABUem9z4SMQvD3DS4IpLZpTqkGYN3RapmDWS8AtYDwIwHIbfiuwtrgffKLwOPXwmhf7z9IfjhPBB3e1kd7YhQ4OXvBcf5vF09oA4LE6jQjzWzp68p2Nhl-zwsuaXiuMcqkvYxgM8u4G6Lk8faGxyePr5k4CwxXjpeBUCbohRDXvwefQjWgclkIM-M0Acsl742JzA.x4LYbk-nq67FlFAM-lxKMM7PAlthhzfxv5-90h.XhF6VKxUwYZarqWZSrjIwO0x4LS6gZcCMhAiHajz5S71CAqbhl5AhSHiVN2j0BzFxIjQlI9dvSexqRvffFTSuhHOiTQ4XoQSb3uzPvjo5JOyVxHSeYyAjSiu9wwOI8phO7S753-nLH3ohDCakHPoeiIxRzPazR4UBti-Mg2c1R1NM.M0KJM7EjjTG.nuya7Nqjh3uI9AfqOn7nKxkS86EodgksBotFnMAgkxwTSnqPia4QMqT5oInGQF8WWqWKskEK0SyOzCiqZJqLi8rH2CN6c62JLnqU0pZNCrntAAeofIAKR569z7SAK5gYGSM3qBCVV7V2wWI71i1ei-b04f3.kj1CH-QraRyHauooRprVACI034BzxpHzMiF.278X5LrQ-LOdKOr9SKwl80JLEQOt-5OvvKpuSD1.MLuQw64X0AnH2W.4hM.ceLuenq8cqsXsv0mF-3G5IKetjJKKWKc1lsQ7tcWQlrMNAzhYIH9EIUPDRPFI-8caRvsCoSoZo2anS0nJRI7AkmCGDmLC73OZD4amrfwt5oQzez1skDoMcXtWy4ly.9hqJ4zUUZKA==&t=adj&ssp_click_url=&rd=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: HTTP/1.1
Server: 52.9.77.73 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-9-77-73.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: 98ebd364fb182e04074c84347dce23122a614f28df743d33a67dc1a675b575d5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 8046
Content-Type: text/javascript; charset=UTF-8

Redirect headers

Location: https://pool-usw.creative-serving.com/ul_cb/simp?buid=&guid=&ic=p3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8TQcj6U6rQr6Zn6WRD45fG3ulcgEi9-yUzEbH51cCMZATvPFS05uC4EdI0qtGXwVgzxI02LbWc2qFh7MxxcykJ6fHUMLk.2p7xlNajwLyLosIIxYO6HDHwIFER9G9Pn-vS6N...9b-M0IQeu9rnloRNyrXT47Xg0oDOAP0Rv5jhAf-1I9gApUjJVlUrJTJR0H5N5ibymu.pdrLkHzGyZfMTkkizleMLTvwa12BqTYAsLitxTt60tVlny7rs5oRu-wX8PqunsCcZxYq30.dOa.cBMWqFda9i0L0ZI23w2l9n2SC8PHynpSPq.cE7GkSuy8bKMaJ9dwq8rvZ.1totOeNFezYpEaVwOXiBu8T41lNaPPsFxlYdj71mig3FCypkNAZXrgT3JPenPer.JkmBrDKb9lfk3b-GRwchPQBIRCWFmpUG4UqYN0XuuKYSZ73dcvABUem9z4SMQvD3DS4IpLZpTqkGYN3RapmDWS8AtYDwIwHIbfiuwtrgffKLwOPXwmhf7z9IfjhPBB3e1kd7YhQ4OXvBcf5vF09oA4LE6jQjzWzp68p2Nhl-zwsuaXiuMcqkvYxgM8u4G6Lk8faGxyePr5k4CwxXjpeBUCbohRDXvwefQjWgclkIM-M0Acsl742JzA.x4LYbk-nq67FlFAM-lxKMM7PAlthhzfxv5-90h.XhF6VKxUwYZarqWZSrjIwO0x4LS6gZcCMhAiHajz5S71CAqbhl5AhSHiVN2j0BzFxIjQlI9dvSexqRvffFTSuhHOiTQ4XoQSb3uzPvjo5JOyVxHSeYyAjSiu9wwOI8phO7S753-nLH3ohDCakHPoeiIxRzPazR4UBti-Mg2c1R1NM.M0KJM7EjjTG.nuya7Nqjh3uI9AfqOn7nKxkS86EodgksBotFnMAgkxwTSnqPia4QMqT5oInGQF8WWqWKskEK0SyOzCiqZJqLi8rH2CN6c62JLnqU0pZNCrntAAeofIAKR569z7SAK5gYGSM3qBCVV7V2wWI71i1ei-b04f3.kj1CH-QraRyHauooRprVACI034BzxpHzMiF.278X5LrQ-LOdKOr9SKwl80JLEQOt-5OvvKpuSD1.MLuQw64X0AnH2W.4hM.ceLuenq8cqsXsv0mF-3G5IKetjJKKWKc1lsQ7tcWQlrMNAzhYIH9EIUPDRPFI-8caRvsCoSoZo2anS0nJRI7AkmCGDmLC73OZD4amrfwt5oQzez1skDoMcXtWy4ly.9hqJ4zUUZKA==&t=adj&ssp_click_url=&rd=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Date: Tue, 06 Sep 2022 03:15:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK /
ghent-gce-or.bidswitch.net/imp/0.0347/BSWhttps_A_B_Bpool-usw.creative-serving.com_Bnimp_Cbuid_R_Jic_Rp3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR... Frame 2407 43 B
748 B 542ms
194ms Image
image/gif 35.212.198.217
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ghent-gce-or.bidswitch.net/imp/0.0347/BSWhttps_A_B_Bpool-usw.creative-serving.com_Bnimp_Cbuid_R_Jic_Rp3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8TQcj6U6rQr6Zn6WRD45fG3ulcgEi9-yUzEbH51cCMZATvPFS05uC4EdI0qtGXwVgzxI02LbWc2qFh7MxxcykJ6fHUMLk.2p7xlNajwLyLosIIxYO6HDHwIFER9G9Pn-vS6N...9b-M0IQeu9rnloRNyrXT47Xg0oDOAP0Rv5jhAf-1I9gApUjJVlUrJTJR0H5N5ibymu.pdrLkHzGyZfMTkkizleMLTvwa12BqTYAsLitxTt60tVlny7rs5oRu-wX8PqunsCcZxYq30.dOa.cBMWqFda9i0L0ZI23w2l9n2SC8PHynpSPq.cE7GkSuy8bKMaJ9dwq8rvZ.1totOeNFezYpEaVwOXiBu8T41lNaPPsFxlYdj71mig3FCypkNAZXrgT3JPenPer.JkmBrDKb9lfk3b-GRwchPQBIRCWFmpUG4UqYN0XuuKYSZ73dcvABUem9z4SMQvD3DS4IpLZpTqkGYN3RapmDWS8AtYDwIwHIbfiuwtrgffKLwOPXwmhf7z9IfjhPBB3e1kd7YhQ4OXvBcf5vF09oA4LE6jQjzWzp68p2Nhl-zwsuaXiuMcqkvYxgM8u4G6Lk8faGxyePr5k4CwxXjpeBUCbohRDXvwefQjWgclkIM-M0Acsl742JzA.x4LYbk-nq67FlFAM-lxKMM7PAlthhzfxv5-90h.XhF6VKxUwYZarqWZSrjIwO0x4LS6gZcCMhAiHajz5S71CAqbhl5AhSHiVN2j0BzFxIjQlI9dvSexqRvffFTSuhHOiTQ4XoQSb3uzPvjo5JOyVxHSeYyAjSiu9wwOI8phO7S753-nLH3ohDCakHPoeiIxRzPazR4UBti-Mg2c1R1NM.M0KJM7EjjTG.nuya7Nqjh3uI9AfqOn7nKxkS86EodgksBotFnMAgkxwTSnqPia4QMqT5oInGQF8WWqWKskEK0SyOzCiqZJqLi8rH2CN6c62JLnqU0pZNCrntAAeofIAKR569z7SAK5gYGSM3qBCVV7V2wWI71i1ei-b04f3.kj1CH-QraRyHauooRprVACI034BzxpHzMiF.278X5LrQ-LOdKOr9SKwl80JLEQOt-5OvvKpuSD1.MLuQw64X0AnH2W.4hM.ceLuenq8cqsXsv0mF-3G5IKetjJKKWKc1lsQ7tcWQlrMNAzhYIH9EIUPDRPFI-8caRvsCoSoZo2anS0nJRI7AkmCGDmLC73OZD4amrfwt5oQzez1skDoMcXtWy4ly.9hqJ4zUUZKA_R_R_Jt_Radj_Jprc_R_I_WAUCTION__PRICE_X_Jssp__click__url_R_I_WCLICK__URL_AURLENCODE_X/Bp7GCuvddZDe5TVikCljlKCsnueoEy5UqutbNsmFx_Q4lVaqLRPCo-pAlvLlTrZiuIXevW_JrlEahptw3naTwFMhIQyxjx_6oKZKtgnyAj4F78iMdong_buPjw8wb8GFdK8gwauuVq2z43UnUhCqGbq7qI54iyc4tani4LuhyCbf9O3XjIj9Dlsh4xaOTJE711IoJXdv6-UBmBeyHjlhx2hGzu1fxLqM3PecWnEbSqphaxwtZltBpnHe4ILQhB1Cc89IbKHHGazwCfxjVWxwrmeQWF7EG_7I1a6GPgyBfvspFFIo3qu9UU8iK4AGq1lSR--2kGauRwGDwN63sZVU7mysX5iUAik1e_7KY7_Q9SNuGHO2Ne4BXlMkJqZ-3RRy1VndVDMV207sWtMWo-KMo81sjk1vWdfQG15vlnU5edBwxa4-p1vy_570sh7-di6wNBH2AU-ggp14nVidomJZHmevy2c2TfYK2T5y4u1ZpSc21tc4dRS4l1ys7LStqgYaVD9CyStBGus6fOYCvnKXWWvsTuLpKO5xhRbRGqOV0BDuVLdPyvlhUpwoel4AdkHENxTKkzjwoHuwTrJZ0hovZvGkkwRAay3KIOwSsfymGptA3zSxm-AXxGgSg25lM0cyD6UG6wfCIOP99DBVDyp6UKXxkd7IYd_SYrONkJRT3NL9DHP2wXx3_1PCKV8QwY3oEhCRmdyvWPVWlKsP0DskPJSmhm8YGEGHURB3pZFfLdSti_c4YVa7kIg4okK1ra2nwu64IRruJRbDaWyaiNBkduTb308VEhTvmT6gfchVw6yarIplcsIvEObmUjvJ1uU77mA18nYN6dcIWf92UNW9SKwVsoMKyzmtRFhJr2PJaBO67C4nMkU4O-p7Tkcw_HnDrXkb77jzdZ0q4FgjDoNDmUtGP-tzU6vj_UqCherBSfrKXrHIjWRVckWmEBxk8zv7V0WM7-iDWJu4V2Dd8OSo3Yi8oJ3vp_OeWHPiasMfeHEkZL0M_pKHLAqxlLTcFZmyVelzIbI_y7IpLvbgrl8MIhJMEi-tTZ55kAXx3aALMyzUulM25rRcY0N6C7aOO9U/
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.212.198.217 The Dalles, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 217.198.212.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame 2407
Redirect Chain

https://us-west-sync.bidswitch.net/sync?ssp=fmx&dsp_id=4&imp=1
https://us-west-sync.bidswitch.net/ul_cb/sync?ssp=fmx&dsp_id=4&imp=1
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=fmx&bsw_custom_parameter=dedcc7c7-365c-4a8d-be24-02066c0593aa
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=fmx&bsw_custom_parameter=dedcc7c7-365c-4a8d-be24-02066c0593aa
https://x.bidswitch.net/sync?dsp_id=4&user_id=d8bb75c9-7df4-4705-bbbc-95310194720f&ssp=fmx&expires=30&user_group=5&bsw_param=dedcc7c7-365c-4a8d-be24-02066c0593aa
https://ce.lijit.com/merge?pid=26&3pid=dedcc7c7-365c-4a8d-be24-02066c0593aa&gdpr=&gdpr_consent=

0
316 B

53ms
14ms

Image
text/plain

216.52.2.48
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=dedcc7c7-365c-4a8d-be24-02066c0593aa&gdpr=&gdpr_consent=
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: HTTP/1.1
Server: 216.52.2.48 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
expires: Fri, 20 Mar 2009 00:00:00 GMT
x-merge: GDPR Optout true
pod: X-Sovrn-Pod: ad_ap5ams1
p3p: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: //ce.lijit.com/merge?pid=26&3pid=dedcc7c7-365c-4a8d-be24-02066c0593aa&gdpr=&gdpr_consent=
Date: Tue, 06 Sep 2022 03:15:52 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK sovrn.containertag.new.min.js Show response
vap2sfo1.lijit.com/res/ Frame 2407 44 KB
11 KB 480ms
159ms Script
text/javascript 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://vap2sfo1.lijit.com/res/sovrn.containertag.new.min.js?cid=3&zid=995483&v=4&tid=a_995483_af06a3b3d55f4361a859b922c9f7da79&gdpr_flag=&loc=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e858ec2fe7af529951698da59d296133faa5965abd132fb7e4711304e2b51b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"62db18b4-ae7e"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Transfer-Encoding: chunked
X-Sovrn-Pod: ad_ap2sfo1

GET
H/1.1 204
No Content t.dhj Show response
pxdrop.lijit.com/1/d/ Frame 2407 0
199 B 54ms
8ms Script
text/plain 23.205.243.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pxdrop.lijit.com/1/d/t.dhj?dmn=wheregoes.com&pn=%2Ftrace%2F20224364602%2F&pubid=buysellads&v0=54916
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.243.158 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-243-158.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Cache-Control: private, max-age=3600
Connection: keep-alive
X-Robots-Tag: noindex, nofollow
Expires: Tue, 06 Sep 2022 04:15:51 GMT

GET
H/1.1 200
OK impression
vap2sfo1.lijit.com/rtb/ Frame 2407 43 B
552 B 490ms
164ms Image
image/gif 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vap2sfo1.lijit.com/rtb/impression?i_data=E0WECuN7OXiZZtAABXuP36czgiWMWBpv4grlunDcVtpM91pvpr-I-kb6UHAPbAPcPWrmuGBw6a5um3qzFrLsSOrmuac9t8Sm027B74Br9kch2kGpJ4EJ1AbEoibPprGKlx9baTySdi6bIkjs1Dj-oXaWRcZVVEdO0aMik6my7QCmY0HkC4tBC5miSz1YoOZE0Jbe6d8QD3rPnNEKqty-Zyxc_it3l2xyr7nWQzEaNJQFdXVoJflK8hwnRkP18DUTxMExsozmBRG1WE3Jhn-c9M-p8Jv2Jj6fqqtuCnULYARwe3lMb4WMx2eXK85Pxg53J8Eo3Lro9IPg_uc2ao55&bannerid=40972&campaignid=1769&endpoint=PREBID&prebid=prebid_prebid_7.10.0&rtb_tid=fe3c14f7-3d28-4796-8035-abe86c902d3f&rpid=26&seatid=4&zoneid=995483&tid=a_995483_af06a3b3d55f4361a859b922c9f7da79
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: *
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2sfo1
Content-Type: image/gif
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 95F1 22 KB
7 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 09:18:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410214
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 01 Sep 2023 09:18:57 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 95F1 8 KB
4 KB 27ms
8ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=2049382849&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsv1cFgq5vcuP6oWr7QcKqxkd88g2Q7BGbjNoYOLmc7hz-wFdJCcRa5jXxiOGrShxrpAyCkCCM4W9NH9zERZtzTB-x3Iwpomv1gtT-6V-4oxL6uOf2KfOjoq8WD5ARv5xpC6dsPMvJ28Yqx97VZbihpq2w9Yo4h0Xzd1s5V4zTNPy5MQqBipYeXVEKZL2uiGgwtTLOVn7dYf8uCsZAWo6ggsgfiM29rTx3HZIaMAM1B-tlRpcvh1Yt7fDayTzcaPW9FEwGuLiF5Lf8uhZ1Q4VwfiQqaH509rxk9Ni_d-2zaYWQiMRS7Wmtoe9WhLjYMsRLbZaboK2lXvHFSoiGYogY4CHM82PMPAQz7aJA%2526sai%253DAMfl-YQVRguSpKSVMwNVhn0ep0THuSqAlJmUJcwlBoX85vtvtqd1NEHvrqJgEUmMfZYULUBKtUf06WhwvopvuyN2Qgp_83pNSWRXM40meRyolTsMPcmITHvSCY7986aToaQWPQ%2526sig%253DCg0ArKJSzLiE7nrQ4VhGEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

159711ca97da64d4f85e67e9d18489eb27dabe7e36faa941e7545e911bb3d235

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7dc63778-1412-4bd4-8536-38475c0e134c
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 95F1 142 KB
44 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame A9CE 22 KB
7 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 09:18:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410214
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 01 Sep 2023 09:18:57 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame A9CE 8 KB
4 KB 26ms
8ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=120x600&cb=487345716&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

0d3a6929cf8c803a95663dde22d7b06c9521dc43a21ca27e66325a69c43b9301

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7fd95b1f-203d-438d-af27-92dd9c6bb908
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A9CE 142 KB
44 KB 51ms
49ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
DATA 200
OK truncated
/ Frame F88E 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 146bb0f3969e9c5206047fc73b4a25f938c85cb48805572f7dd25eaab07af1f7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 23DE 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1553ccb943cea39c2aebb3bdc69c1f40db78295d5f1b1b27f24ace967710226f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK rd_log Show response
fra1-ib.adnxs.com/ Frame 5895 0
819 B 7ms
7ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&e=wqT_3QK7Mei7GAAAAwDWAAUBCOb22pgGELPH06iXt4-gRBgAKjYJP_89eO3Spj8Rb38uGjIeoT8ZAAAA4FG45j8hbw0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreLHZBYABAYoBA1VTRJIBAQb0XgGYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQzNjQ2MDIv8gIMCgZIRUlHSFQSAjkw8gIMCgVXSURUSBIDNzI48gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIYCgpJRlJBTUVfS0VZEgoyMTQzMDA5MzY58gK_FQoLUFJFX1NDUklQVFMSrxU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBoPXRoaXN8fHNlbGY7dmFyIGs9QXJyYXkucHJvdG90eXBlLmluZGV4T2Y_ZnUNjjxhLGMpe3JldHVybiBBcnJhSi0AEC5jYWxsASksLHZvaWQgMCl9OmZ1Lj8AWGlmKCJzdHJpbmciPT09dHlwZW9mIGEpCVYRGgAhFRpIY3x8MSE9Yy5sZW5ndGg_LTE6YRGYJChjLDApO2ZvcigBvxhkPTA7ZDxhDSlcO2QrKylpZihkIGluIGEmJmFbZF09PT1jDWgIIGQ7CXEcLTF9Oy8qCgqeOgERzDggbChhKXtsWyIgIl0oYSkNTgggYX0JEwA9ESgQKCl7fTsRDQQgbgE1BGE9KRo4PT09YT9kb2N1bWVudDphFUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJV5wZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTshLBRiPW4oYS4RfAQpOyEpBCl7ARoAZS66ABkXBGY9WlMAPCxnPWsoZixiKTswPD1nJiY-FgIUc3BsaWNlSRV0ZixnLDEpfWIucmVtb3ZlRXZlbnRMaXN0ZW5lciYmUhcANCgibG9hZCIsZSwhMSk7UiMAYjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAFtPhQAACg2agAcYi5zcmM9YztaMQEYLnB1c2goYi7RAQRxKCl8BGE9MZI0LmN1cnJlbnRTY3JpcHRNGgAoMjkCLG51bGw6YSkmJiI3N2FJbGEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FHfBGcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTt5KwB0FeAAaAVhDGM9W10FCQRkPQHGDDtkb3tBexhiPWE7dHJ5BQwAZUGTGGU9ISFiJiYBJFAhPWIubG9jYXRpb24uaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AV4IZj1lGRcAZgEWDGlmKGYpeQBnPl4ADDtkPWJ1HyH0NUIkcmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_TH19d2hpbGUoYSYmYiE9YSk7Yj0whdUAYZX2dC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAK04AD0ddQApoVsUYT0xO2E8sYBMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBoGash1WXlAGclFiUCBGQ9MgQBHDA8PWQ7LS1kodhIZj1jW2RdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBkFeYEJiYBzAE7BDswQWUlWggmJmQFSAEbCCk7YwWtEHYoYixntegUYy5nP2MuBfoMOmMuaQFAAH215gB2oaEcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQq9-gB3dUkUdCgpLGM9-Qo8Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4IKX19Dg4JFtYIKCAwPD1jP2Euc3ViFmsJHCgwLGMpOmF9CeAMLnJmbC7oBw01aGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQXMwYWR5YVk3UEVJbF9BRUV3cDJhUThORW5zMVZnTGh4M2UzWnh4V081VGZwcW42RG4wbm1vd1U2VklOQjRIM0czcWxjUDlQdnJFSVlRZjZER3pfTmJjMXQwanciIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRp8ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaEQwIiQE8KWo2CAEW9glQYWRzLmcuZG91YmxlY2xpY2submV0MQY8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dJCgge3IzcHgoJzIxNBqdDBwnKTt9KSgpOz3rEIQTChBIAZ40UE9SVF9QQVJBTVMS7xKRJIqVAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTE3OC4xNjIuMjA5LjEzNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wTY0gX3N0YXJ0PTEmoXgRvX4JDhAmc3ViXw2aAGJBofB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1KWHRhZ0Q1RzdRQS1sZzBBWkZnTkFHUmJUUUJzSGswQWJwNk5BRzhlelFCQTN3MEFVMThOQUZaZkRRQkJIMDBBUmg5TkFFZmZUUUJoMzAwQVloOU5BR05mVFFCbG4wMEFaOTlOQUdoARAAcAEwGGJGOU5BRzMBEAB1BRAAeAEQAC0BEAB4ARAYY1o5TkFIVgEQADIBEARkcAEQAGgBEPQ2AlMzTkJBVkJ6UVFHQ0hfZ0I0aDVjQXZpaVhRS3k5NGdDZVBtSUFrZjdpQUpqLTRnQ0owS3FBaHhFcWdMd1Zxb0NPMXFxQXRCaHFnTDllS29DbHBXcUFvQ2JxZ0tCbTZvQ2dwdXFBcUtvcWdLNHNLb0NHdFNxQW16WXFnTHUycW9DVmQ2cUFzbmlxZ0tnNWFvQzUtV3FBZ2J4cWdKTzhxb0NzZk9xQXFuMHFnSk8tS29DNWZpcUFpWDdxZ0pCLTZvQ3hfdXFBdlFBcXdMM0Jhc0NUaE9yQWdrVXF3S0JGYXNDYVJhckFxOFhxd0lER2FzQ2ZobXJBZ29jcXdKakhLc0NlQjJyQWxJZXF3SmRIcXNDZ2g2ckFvZ2Vxd0tnSHFzQ3NoLXJBc0lncXdJVUlxc0NOQ0tyQWxraXF3S2xJcXNDQkNPckFoTWpxd0pWSTZzQ0dTV3JBb3NscXdMYkphc0MxeWFyQWtvbnF3SWFLYXNDYVNtckFyY3Fxd0ptSzZzQ3J5dXJBdnNycXdMLUs2c0MwQ3lyQWxjdHF3S3dMcXNDX0M2ckF2NHVxd0w2UXR3Smo0cWZEc1BZb1E3TW9UVVJPSlg3RXZ6SC14SlV5dnNTemRIN0V2ZjYteEtaX19zU1VnRDhFdjBBX0JJNUFmd1NSUUg4RWlNQ19CSlBBdndTaXdMOEVtNERfQktnN0k4VFoxM1FFME9pNmhSb291b1VZN0ViZUEmZXhrPTIxNDMwMDkzNjkmYaFTBF9jrU3wsER3VmpwSkpITC1IU29nTnpmdjNCMU9GWngwZU5hU1d1alA3X2tuV25CTGVWRU44SEpjVVhHblZaWHVZNGtCeU5Rcy1qQUVNUVFzeUtGRXJBLUtUMGhSTzl3QzRtbEctMHNtbDhRN2dzdVdjQTQzZkhkZU04LWdORzRSWjFGb0ZRdnREMjQ2aW5WT3VRaVJTa1ZSWG9tZUlHRjcxLTZ1SVJGVlVoU1hDam1mbXEzUm5oVc0NAGQNwPQCBkFiQXRpMWl5dHVDTWRWSV9Fd3BZVFBhQmhuellncmFRc0hRV2ZQcGREN1c0QVVfY09jbi1HSFZpbHA0X1pjZGJuaDBkc24xNUF4QVhhWG8xbnFRWmlWaldRd1l3RkR2OVdNblNNSmxtZzlQcC1aMGY0bUxiSTJQZXp5NjVSU3lQR1NxUmstS0VnSmNEM1FISzVLTUVoLXFuM0lqdnctR1JBOWdUc0RlNWU5ZFAwS2VKNWZCcWlBME56dUlxX251MzVXWVFaVUpreno4YUZOMFRKMzVGRllNejhxSEJzbGRZVkxDU3VHM2h5WGVjVklKSl9PVjJ4YnRoNkpLcmRNZ3lxMGxHanV4cTBzQ210UHhlMk1BSFdNTVdGUFZkT2I5LW80Z0c0SE5SY25JSzE4Si1FNWw3M19PdjdTOE9ua3Y4OHVRd1lsYzNzOXBObmVrWU1rLXVIWXZJLVB4YXFmWHdGaGQxM0tUYi1sQnZGWDlyQUk2NjBUZWxFRmpOOVpGeGZ2VzhNd25KaUVIZXI5dUV4TWZnTlZVS3pGRUwxaEdXV2ktT2JqSmhCNE5MTk81OTdWZEI2TUdJb08wU1Vkc1poMUFFTVVtRnppRE9CS1REZ2dFVWRkanZSQ0dVMldnZ0VRc2FhX05PbGw2cFVlNkFJUmtGUml3NHVRb19Ec0VRTi13eGtjbS1oS2xxQ2FEbVBsVHp5UVR3djhkQlhMUVhhZTBCeTBVaGpoZWRFcXpYX3F2WGpHNEw2RXFueURCYTVHblZTSkhjRi1MbUR2bXlWeVhlNWkzaFRFeEdVWkRFZl9lSWZsSXYzV2RiNWhUc0FlQW5EV182ZUZOaGo1LTFsSU9nX3RrUnpBQldqYzVQbXJ1WF9ERXRTWS1vQVVkV0t5LUs1VnpOVUE0NUNDOUlDc09KclVDN1N4dW9FZnRFNnphb1Bvd2hhQW04MEVzc1ZXWC1uQnloeVIzRFpjQ1c2QjFTX191S3RlTkhlVXBKMFlWM09JQXhpUmZBS0xuTmtUZHBDRXFpUk1fOC1ZeDZha1BUa09VWldWWHV4WlF6am80VFBTSThBSEZUS2NqZnNPMHprUDlzNmxCWXVtazhFanhlanlMdHdVbDNESmI0MHUxOXplRFduVW12NTVZYlNuUWswYzRfcVhlTE1nYXBvcUJ1VURzT041TmhFSTAzMmJ2YlZjQ21Ld0lzcU5uQzh0b3Q1bUpOVXhCV25LS19VN2xxZHJJVzlrcDEtdjdaN3JXYWRuMkJjOENkcm15cHBOM2JTSU9SVnZ0NlZZWHdzZmE1eUl0MUpzNTNfVm10cmM3Zm9OR2dBT1NyN0JpY3VLdW9sQV9XQjNuaE9ENXg3bFdBVGxYS3IyOWc3dkZsX1p2X2tPWkZ3UkVJZlVkdmhSclc1OVRWcVc2NmxzaWg2LW9PLTJBQnlUdXk0UzBiLVAwSUV4TFRUdm5IbFZqeW9FaFoycU1SU2Q3Q3BGVk5tYWtHcEFkUVBucTV3Wko2aENoa2c1dzl0MkszNDAzWHh6R1BlVnFCN2c0SWlfSDh4Y0ZrTWlkM25pYlEmY2lkPUNBQVNCT1JvNnNzJmFfY2lkPYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdOxv9HTutbTW8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbVE-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDExNzA0MzcwNDM3NLoHDwgAEAAYACAAMAA4ugZAAMgHsdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfC_AOKCAIQAJUIAACAP5gIAQ..&s=9470b4fe5788e5fe9b67aad788db8b26f2d8acae&bdref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 349929fa-44a6-4a3e-ab9a-3050dbc1d01d
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 95F1 0
0 51ms
50ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssc7RfcRcBZBXtLgaDnWmzAnA9o78pqyg9hiiozgmyxs00IlrS40isri4HG2nUTJXjWQlG8nljrzCwso-j4B297YnUcG7kWwnGyNbjlk4nYcnB_6J_9iwUClmT7BUKHypzS6TfElzNot6O3fN7VKrsUOZ5jQlXbAF7Efee_imp0Dj_vLykVYvZRRNAvslaUeXt1T9EiIYWd3tH4vu3kv9W4neHU6UNplQTiqQKnAMpRRlUmfh1kMvBzjqLrs7n-3OFO4uJY6atMj3XCxILHWFE-Qlarr1BP0y2rEf4WfRKtihlsobpLtDoRyoAU6DetHKRAoqkVoGrFNRkD4PzaKCSL17SPA7YmLuzJRMbEhg&sai=AMfl-YQxo9OxEQu5nEUjR0YK-cF8_-HDl85dyyjSXYJcD_73SgJ0BchRXw9rA28jwK5Omeg4-699phu3ItkPZSr-plF-P80aBlJl9P62YNr1YgpP5ScpV7vHL6aUwAgwe5_hAg&sig=Cg0ArKJSzEWh9ePCdK7iEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sync Show response
gum.criteo.com/ Frame 95F1 51 B
308 B 40ms
13ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=2049382849&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsv1cFgq5vcuP6oWr7QcKqxkd88g2Q7BGbjNoYOLmc7hz-wFdJCcRa5jXxiOGrShxrpAyCkCCM4W9NH9zERZtzTB-x3Iwpomv1gtT-6V-4oxL6uOf2KfOjoq8WD5ARv5xpC6dsPMvJ28Yqx97VZbihpq2w9Yo4h0Xzd1s5V4zTNPy5MQqBipYeXVEKZL2uiGgwtTLOVn7dYf8uCsZAWo6ggsgfiM29rTx3HZIaMAM1B-tlRpcvh1Yt7fDayTzcaPW9FEwGuLiF5Lf8uhZ1Q4VwfiQqaH509rxk9Ni_d-2zaYWQiMRS7Wmtoe9WhLjYMsRLbZaboK2lXvHFSoiGYogY4CHM82PMPAQz7aJA%2526sai%253DAMfl-YQVRguSpKSVMwNVhn0ep0THuSqAlJmUJcwlBoX85vtvtqd1NEHvrqJgEUmMfZYULUBKtUf06WhwvopvuyN2Qgp_83pNSWRXM40meRyolTsMPcmITHvSCY7986aToaQWPQ%2526sig%253DCg0ArKJSzLiE7nrQ4VhGEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 587364
strict-transport-security: max-age=31536000; preload;
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 95F1 9 KB
8 KB 126ms
125ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1662434151&bdh=cldp5P7AevX2WRR0KsOMoRPI_Ik.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=2049382849&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv1cFgq5vcuP6oWr7QcKqxkd88g2Q7BGbjNoYOLmc7hz-wFdJCcRa5jXxiOGrShxrpAyCkCCM4W9NH9zERZtzTB-x3Iwpomv1gtT-6V-4oxL6uOf2KfOjoq8WD5ARv5xpC6dsPMvJ28Yqx97VZbihpq2w9Yo4h0Xzd1s5V4zTNPy5MQqBipYeXVEKZL2uiGgwtTLOVn7dYf8uCsZAWo6ggsgfiM29rTx3HZIaMAM1B-tlRpcvh1Yt7fDayTzcaPW9FEwGuLiF5Lf8uhZ1Q4VwfiQqaH509rxk9Ni_d-2zaYWQiMRS7Wmtoe9WhLjYMsRLbZaboK2lXvHFSoiGYogY4CHM82PMPAQz7aJA%2526sai%253DAMfl-YQVRguSpKSVMwNVhn0ep0THuSqAlJmUJcwlBoX85vtvtqd1NEHvrqJgEUmMfZYULUBKtUf06WhwvopvuyN2Qgp_83pNSWRXM40meRyolTsMPcmITHvSCY7986aToaQWPQ%2526sig%253DCg0ArKJSzLiE7nrQ4VhGEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

675c702c2aa831fd5017bf918b7defe48bd25725e8ec8fdfb194dbf13ead5fed

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
X-Creative-ID: 78827815
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e8af9eda-2082-48a5-94fe-917f7c19dac6
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A9CE 0
0 51ms
50ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsub6hj4bLDKmD7xM3ZnqFJqfvvF1suBhByD6r03pK-rbHJ0YyQiAQgiAVB1rfjOveFD94Sp7DLdKvCN7ynnx0l_hSmFuOKRPnCqAmKCadKzVAYImzrsxVtBtFlF3f0FdqwGPzp8OokAEVr3wbKgG9vIXt_e1PeZUDLRwBuk8v5WxfQm2Q06RWZSQqMFjV8w5K3uB1-6E8fYPVdWfyHNI0ffMAJqnMUheWpT4RhYy6BHBCza2WTElrIiUOGulZcSxxx8SBIEq406ZTfa_B8_etFTK-RPvdoEvaOkmSUck5wz9ZqRqKhIbT6UXC8KJu8gaNVHFFYDooBpN1Xj-5IAf-n3hCwTbR9vxA&sai=AMfl-YQFqgseS7k5b1jQYXkBw29Oqo3PpR62Sfomp6HhNAcDa67klnKP0dspOqPKjcHSu1fRlT41qbpl9f0G5aLEW8ykFw-YsUrZm06qv8KG25Sq7X8SYz-MdFToWMBNdPhHvQ&sig=Cg0ArKJSzP9GngO5LqBxEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sync Show response
gum.criteo.com/ Frame A9CE 51 B
292 B 35ms
14ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=120x600&cb=487345716&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:50 GMT
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 581100
strict-transport-security: max-age=31536000; preload;
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame A9CE 3 KB
3 KB 116ms
116ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1662434151&bdh=cldp5P7AevX2WRR0KsOMoRPI_Ik.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=120x600&cb=487345716&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

9ccb0761181f6adf938ca9da3d3eb4a0908bded345f80ed14579d4280a377407

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
X-Creative-ID: 56842500
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1e9980e1-0f92-4058-bdf3-98622bf0b53f
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2711 0
0 48ms
47ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022083001&jk=785618199491999&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 5895 0
839 B 7ms
6ms Ping
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&e=wqT_3QKTBugTAwAAAwDWAAUBCOb22pgGELPH06iXt4-gRBgAKjYJP_89eO3Spj8Rb38uGjIeoT8ZAAAA4FG45j8hbw0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreLHZBYABAYoBA1VTRJIBAQb0jwKYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQzNjQ2MDIvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1ELVFaYkJxZ3JubnJRY1NNb2l4bUQtaDF6cVcwdGU2UmFvNng5U0hPTEJnblppNUlPWU50cy1pS2xWZktKNnpSZmMycXZaOWw5Q0pvdC1tUURxUnFVU1lfcUxSZyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM0OTE3OTk4NjU5ODMxMTI5MDExIgg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdOxv9HTutbTW8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbVE-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDExNzA0MzcwNDM3NLoHDwgAEAAYACAAMAA4ugZAAMgHsdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfC_AOKCAIQAJUIAACAP5gIAQ..&s=8c7d7e5e9dbc1c27082468cd1574bba50af6c440&type=nv&nvt=5&jm=1003&px=436&py=474&bw=728&bh=90&sid=4068013851354147938&vd=ct~0|rr~0&sv=227&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&sw=1600&sh=1200&pw=1600&ph=2226&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/227/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 900d4d64-6d4d-4f63-adf6-ef89700fe469
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F88E 0
0 80ms
50ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuw1PN99F8Mu6cLhdtQ6cdm4IjWmvP-K2LsdprBkjHS-JEPU4oCM4YZWGkE527O429q01TPYb8kn7oAl-sqYRhBtvCQIex3bYD4TvmexhyP5WjZv8dqXt_Wqvx7e98lvC5_xzH5zFSQY4rEbwPR2LW9eiv75RakV5iLHiIRdTQYSGEcs7HImGGdCPCdYO1SYY5NsgvO6sVTI1QoKTBzkFoLr34nWzvXyiI1YMplp_LY1s7G1KejaG_S4pgxQU_sgB7xiGwulMXeMGabszC6gr42r13QMGXx5tFwROjGbqEAAwiQo3r2fTocg1rdIFiRZ3A9AWcWjFR-bV3VYnPdrxEgtt4X21Bblg&sai=AMfl-YRvh1bP83KUtjjyq-AMJDUhB-E6Xln1jIYtQpEk52QOCKBSsfMCkeSDzzKNydLDRXWnzmKhI_zPW6oaPTDQ9dxn4HGV2mdWRct1Ws4k4uR_BoNTXjI4yezTOLRpv1B2rw&sig=Cg0ArKJSzG-5FGT4A63EEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 06 Sep 2022 03:15:51 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 0351 100 KB
34 KB 125ms
97ms XHR
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56934d6c8bc976802dbbda198cbb199b40b79c4cb4c1be5287b677b78d343194

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34890
x-xss-protection: 0

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame D890 36 KB
16 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 06:14:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75683
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Sep 2023 06:14:28 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D890 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?JylKIw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame A9CE 4 KB
3 KB 7ms
7ms Script
application/javascript 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?id=9896220&psa=0&cb=1635817758&gdpr=0&gdpr_consent=&loc=,&pubclick=https://fra1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEDherQ_AAAAAAAAAAAAAAAAAAAAAHIah_3h0iloDvnzjMixVx5nuxZjAAAAAGMBHQHKIAAA5QAAAAIAAAAEWWMDmKoUAAAAAAAAAAAAVVNEAHgAWAJrrgAAAAABAgEAAAAAAMwABRUigwAAAAA./bcr=AAAAAAAAAAA=/bn=76463/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1662434151&bdh=cldp5P7AevX2WRR0KsOMoRPI_Ik.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=120x600&cb=487345716&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

fcaa2104248decb4d0694b044f0c550e42dc0850986311ade802e781d5cf1623

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7acd4b2e-66dc-4879-a75f-f8245f86c1e3
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame A9CE 0
819 B 7ms
7ms Image
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKYCaCYBAAAAwDWAAUBCOf22pgGEPK0nOyf3PSUaBiO8s_niLnsqx4qNgkAAAkCABEJBywAABkAAABA4Xq0PyEREgApEQkAMQkb8IGEPzDjgvQIOMpBQOUBSAJQhLKNG1iY1VJgAGjr3JoBeK_VBIABAYoBAJIBA1VTRJgBeKAB2ASoAQGwAQC4AQLAAQHIAQDQAQDYAQDgAQDqAaEFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlY2xpY2submV0JTJGcGNzJTJGBSAcJTI1M0Z4YWkBCPRpAURBS0FPanNzLVFfVDJNNF84NjNUVlFZM2otYnhRSWdHalJGSk5ldXprbkFvOFducjhMM3drN1c0TlJtUWVfdVBOVkY4WEp4NHJBVVNPc2drdFdpV0ZJc2hwVWJ2WUJfbG9nUnpyQlZ0U3FLWFhWcmZCOWFYZzNHNGY1UE9pWjE2S0F0dXhZNU8yYWp0Uzd1YVd3b1k4Wlo2cFpTT2I0UUs2RGIzQzI3YXROWURDZDBidkdIUFVJNnA3SFk1dDhCTXVkakJvUGhwdWxoTERMRHNmQ0NEcE5GLW9ZaEpXYkh3c0JibUh2a2ZUTnByNHdsaUZJRlVxREZYd3JnNThfZU9mZmpiUUlYOFJDal9yRXh1Q2dnSFZ2cG4xRU94Ml9VU0JaWEZPQ1NlNDN1cFhUMTdMU3dtMTczTHVwYVZWdHM3YzRSSXFCMVR4MFFpVDhueHF3bTNULXM2eEJIbGdTLW13TmclMjUyNnNhLW_w_U1mbC1ZUmFHVlpxbTZObEpHRTNCUFFna0YtQndWaE9UOHRGempDV1Ezc2FzOGdVODVNSjB6djRTeEk4R3ExTnlDWG9JS3NRQ2ZQVHk1cFhhdmVNSnVmVXdVYWpxU0hheXMxZ0hWZGlzYl9pVU95U2pyZVhjcklMM2VSREp1MGlTZ2ltemclMjUyNnNpZyUyNTNEQ2cwQXJLSlN6QjR4bHcwek5EcWZFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZoQa_weTovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xNzguMTYyLjIwOS4xMzSoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAOAEAPAEYXA0iAUBmAUAoAUAwAUAyQVpoRTwP9IFCQkJDHAAANgFAeAFAPAFAPoFBAgAEACQBgCYBgC4BgDBBhEjENoGFgoQEQ0RAVwQABgA4AYA8gYCCACABwGIBwCgBwC6Bw8BRA2VLLoGQADIB6_VBNIHDRVwATgI2gcGCSdo4AcA6gcCCADwB8L8A4oIAhAAlQgAAIA_mAgB&s=15d107fc7f57205e4d91fd05b338efa97a489dc5

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3ad540bc-3d31-4bca-a2d5-3d13533dc7aa
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK if Show response
fra1-ib.adnxs.com/ Frame 6252 10 KB
7 KB 10ms
8ms Document
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLKOPBMShwAAAMA1gAFAQjn9tqYBhCQxMS33M7flkoYjvLP54i57KseKjYJfc1y2eicpz8RHhoWo661oT8ZAAAAwB6F6z8hHhoWo661oT8pfc0JJNAxAAAAgD0Ktz8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjD1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGpBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0oQZEQUtBT2pzdjFjRmdxNXZjdVA2b1dyN1FjS3F4a2Q4OGcyUTdCR2JqTm9ZT0xtYzdoei13RmRKQ2NSYTVqWHhpT0dyU2h4cnBBeUNrQ0NNNFc5Tkg5ekVSWnR6VEIteDNJd3BvbXYxZ3RULTZWLTRveEw2dU9mMktmT2pvcThXRDVBUnY1eHBDNmRzUE12SjI4WXF4OTdWWmJpaHBxMnc5WW80aDBYemQxczVWNHpUTlB5NU1RcUJpcFllWFZFS1pMMnVpR2d3dFRMT1ZuN2RZZjh1Q3NaQVdvNmdnc2dmaU0yOXJUeDNIWklhTUFNMUItdGxScGN2aDFZdDdmRGF5VHpjYVBXOUZFd0d1TGlGNUxmOHVoWjFRNFZ3ZmlRcWFINTA5cnhrOU5pX2QtMnphWVdRaU1SUzdXbXRvZTlXaExqWU1zUkxiWmFib0sybFh2SEZTb2lHWW9nWTRDSE04MlBNUEFRejdhSkElMjUyNnNhaSUyNTNEQU1mbC1ZUVZSZ3VTcEtTVk13TlZobjBlcDBUSHVTcUFsSm1VSmN3bEJvWDg1dnR2dHFkMU5FSHZycUpnRVVtTWZaWVVMVUJLdFVmMDZXaHd2b3B2dXlOMlFncF84M3BOU1dSWE00MG1lUnlvbFRzTVBjbUlUSHZTQ1k3OTg2YVRvYVFXUFElMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TGlFN25yUTRWaEdFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZodHRwczovL3doZXJlZ29lcy5jb20v8gIMCgZIRUlHSFQSAjkw8gIMCgVXSURUSBIDNzI48gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk5NzgxOTAyNjPyAr8VCgtQUkVfU0NSSVBUUxKvFTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjt2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwpmdW5jdGlvbiBsKGEpe2xbIiAiXShhKTtyZXR1cm4gYX1sWyIgIl09ZnVuY3Rpb24oKXt9O2Z1bmN0aW9uIG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmV0dXJuIGEuY3JlYXRlRWxlbWVudCgiaW1nIil9O2Z1bmN0aW9uIHAoYSxjLGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHM9W10pO3ZhciBiPW4oYS5kb2N1bWVudCk7aWYoZCl7dmFyIGU9ZnVuY3Rpb24oKXtpZihkKXt2YXIgZj1hLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cyxnPWsoZixiKTswPD1nJiZBcnJheS5wcm90b3R5cGUuc3BsaWNlLmNhbGwoZixnLDEpfWIucmVtb3ZlRXZlbnRMaXN0ZW5lciYmYi5yZW1vdmVFdmVudExpc3RlbmVyKCJsb2FkIixlLCExKTtiLnJlbW92ZUV2ZW50TGlzdGVuZXImJmIucmVtb3ZlRXZlbnRMaXN0ZW5lcigiZXJyb3IiLGUsITEpfTtiLmFkZEV2ZW50TGlzdGVuZXImJmIuYWRkRXZlbnRMaXN0ZW5lcigibG9hZCIsZSwhMSk7Yi5hZGRFdmVudExpc3RlbmVyJiZiLmFCNABYZXJyb3IiLGUsITEpfWIuc3JjPWM7YS5SngEoLnB1c2goYil9O2YtafBhIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYcocj1SZWdFeHAoIl7lzeA_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmYR4AB0FeAAaAVhDGM9W10FCSBkPW51bGw7ZG8F_xhiPWE7dHJ5BQwsZTtpZihlPSEhYiYmASQcIT1iLmxvY2GhFCAuaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AdYIZj1lGRcAZgEWDGlmKGYpeQBnPl4AEDtkPWIuMTYEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVhQAQ7ZyUWJQIEZD0yBAEcMDw9ZDstLWSh2EhmPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZQBkIVoIJiZkBUgBGwgpO2MFrRR2KGIsZyltixggYy5nP2MuBfoMOmMuaQFAAH110DB2KGEsYyl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKnSkAd3VJJHQoKSxjPWEuaW7lokAoIj8iKTtzZXRUaW1lb3V0KBGMDTEEZD2VOhhkPy4wMTpkQTVEIShNYXRoLnJhbmRvbSgpPmQpaQ8MYj1xKCGkACJl_0g6Ly8iKyhiJiYidHJ1ZSI9PT1iVmsEOC1yY2QiKT8icGFnZWFkMo3_EHN5bmRpabkgLWNuLmNvbSI6ZiMABSAMKSsiLwlFeC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSKFRQxlPShlAbEMKSYmZVqZAA0xMCIpfHwidW5rbm93biJh41wrZSsiJnNhbXBsZT0iK2Q7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZT1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxlPS9DaHJvbWUvSZsgZSkmJiEvRWRnGREcPyEwOiExO2VhkxVRMC5zZW5kQmVhY29uPwodaR0YJChkKTpwKGIsZCw10gmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIxq9CIBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBmhQpOwo8L3PFmGw-8gLJAgoKRVhUUkFfVEFHUxK6AjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhS1WHSRRKWQJBNg0eLjICFGF3YmlkJgUG8IZfYj1BS0FtZi1CLVg1ZmdwRlJqT2JyWFVkOWJWZnVReE13bnluZXNuWXZxNkplcWozQWFyU1RsaE1rX19qcGszazQ0bHdjLTJsRng5VzdDSUY5UXV6ZlFTX215VGthZTNnQkxfUSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIxGqhkaXNwbGF5Om5vbmUiPjwvZGl2PvICmQEKDFBPU1RfU0NSSVBUUxKIATxzJWo2CAEWWAgUYWRzLmcuOlcPMQY8eGJmZV9iYWNrZmlsbC5qcwFlLbUNUwA-nSRgIHtyM3B4KCc5NzgxOTAyNjMnKTt9KSgpOz3qEJETChBIAZ00UE9SVF9QQVJBTVMS_BKRI4qUAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTE3OC4xNjIuMjA5LjEzNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wTYwgX3N0YXJ0PTEmoXcRvRB3aGVyZSL1DRAmc3ViXw2IAGJBjvB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1OVWJ0QUJGV3pRQkQyZzBBUXg0TkFHOGV6UUJUbncwQVFSOU5BRVlmVFFCSDMwMEFZZDlOQUdJZlRRQmpYMDBBWlo5TkFHZmZUUUJvWDAwQWFSOU5BR3hmVFFCdDMwMEFiaDlOQUc4ARAseEgwMEFjWjlOQUhWARAAMgEQBGRwARAAaAEQ9DsDUlhOQkFhOGRYQUxiSGx3Q0JCOWNBckwzaUFKei1ZZ0NSX3VJQXVFNXFnSW5RcW9DS0VLcUFpbENxZ0o5WXFvQ0VtaXFBbDVzcWdKT2Nxb0NfbmlxQXM5NnFnTHVocW9DZ0p1cUFvR2JxZ0tDbTZvQ0g2R3FBcFNqcWdLaXFLb0NzYXVxQWxXOXFnTEl5S29DR3RTcUF0dldxZ0ttMnFvQ1ZkNnFBc2ppcWdLZzVhb0NVLXFxQXFuMHFnSlQtS29DSnZ1cUFrTDdxZ0ltXzZvQ1FBR3JBdWNCcXdMM0Jhc0NmQWVyQW5ZTHF3Si1ES3NDc3hDckFqa1Jxd0tJRWFzQ0J4S3JBckVTcXdKb0Zxc0NVaGlyQW5ZWXF3S3hHS3NDemh1ckFnc2Nxd0ppSEtzQ2VoeXJBcXdjcXdJRUhxc0NYQjZyQXA4ZXF3S2dIcXNDVUItckF2WWZxd0lkSUtzQ1Z5Q3JBc0lncXdJQUk2c0NHaU9yQXM4a3F3SVBKYXNDZmlXckFvMG1xd0l4SjZzQ1RDZXJBcElucXdKVUtLc0NheWlyQWgwcHF3Sk1LYXNDYVNtckFtc3Bxd0tPS2FzQ2N5cXJBa0lycXdLcks2c0N2eXVyQXRVcnF3TDdLNnNDb2l5ckFyVXNxd0s2czhVRkI5cF9DUEJDM0FsQ19TTVFoYUUxRVRlVi14SVh0dnNTQnNuN0VsbksteEw1NWZzU1FfWDdFb0gxLXhJSF9mc1M1djM3RWdmXy14SkZBZndTZGdIOEVtRURfQktsQV93UzZGdlFFOXpIREJYNFZtc2FXUUNTS1EmZXhrPTk3ODE5MDI2MyZhd2JpZF9jPUFLQW1mLUNQTjE2NDhPNFJnYkhZVU9TTmoyRUZwLVM2LXZaTEJENF8wYlgycGRtcm1NblZxNGV3QWVzR2dhdVFZTWtyS1M0R1Q1Z09SMlhQWmFzLV92aE9PUDZRQWh4V3dZRzJFYVlsUGl6a0M4VzRObWozeEVWUExfc21Zb0huOXFqRjNkZkNnYjhXTmFSTVl4cklfRFpMaUw4SzVHOERiaGNQNW45MEtyVFRzWkJZbjRobW9XVSZhd2JpZF9kzRn0AgVDVnpNM19wdEVFRW1vYUlmdVl1LUdRV0tjYWtyZDI5OVNfMDdFQjNCd21aYzY2NUN0SmpDVDBGdHlaZE9BcDJTV0JjQjZaTFBCUDFjUERHbHBrTFRMLUpTdEdSU2RaTk9UMlNRb0pPa2syS1YtdFc3NGZYbWxYa3VhMWhVdnNzVVJpekNlZEs0UFFKdTFYNE5TZWZ3QzhrR1RPdGZieVF5ODhWVkczUWltYWNpMmhSUHZnRHRvM04xUUROc1BxbWswNnBLTldXd2N5R0RlUTUxX0ZZVEE0Rno1UTVJRkpWa1VhdmZZS0NXcEU5bnAyOVNmazhZaGFIb2ZhbzlHamtLWUFSVHZZWjJqa0RWZkNWS05TTVZhNFhRZGtfTWNWdTNpVnVlWldNQUVaeEhocUk5M29oSXJZQzh5QzVROHV1TmF4V2FzRW5Td2l4SXVVV1I1eGh4OU05eWFPckJocW9qajdaMVdTX0RRTmhXTEVsTjNqU3Y4bklDVkJDcEpMLU4wU1pPeExQcF9reEJOQzFJS1lQb2czal9QUThpejhIWk1UZWZtUnVBMHo1QWRoZlh6eUZaN1NFUWxkNGNBQ19rZnQ4cXh1REhtdEpqazZicURwSHJXSEc4TzdQQ2tETDdicUtLeWVfaDNkSnM2eHd6RThrMFFUNGFLaU5Hd2hONUNOOVN4eldBLWd0SHdYalhyYkt1ZExkdDhYMXVabGZGakJPSmdvRURsYll6bTRvSkRWN243OUZpb0ZKWEZza3cwdzFSOThoZkZDREFTYlIxTkRMbF9Ncmw2SHVZRVNmdWtBYWItRUo1N0xOWndqeUVtM1R3TG1IWEkzQUlkLW5wRE0wLUJDNmdMX1ZsUXRKUHByX2FjNkFiczVQcjNPYWdJSl8zVGdpcXc3cllycU5Uam9EZ3JMTmZxcFVkQndNSzNLVFZjcXV5cGN6R3BWRzVKSzFHaWJaNmpxU1k4STdRVlY4ZTlEb0hvY0RPcmVybDVzb0VJTEtqQm1aeGE3eXJITFN6UTgwSUJqcFd0T3R1SEVhR21PNjF5Y0VScmZremZUVUpVTGZFSHFVWFVFWHU5bHgtSV9lMVhBVlNnakFVMmR1NkNwd0M2bHE2djhtVWlTekZvVlZMTHJCMmZ1cEdBNkVGWllES3pYZmNDWTBVYmtzeW5scVVWUVRpLTJEdWJ1YmM3bklpX2U1Qk1aczRwNk5WSGt1Z3MzOEl1aUZCT04tYy1yUGQwMkRwTE4zc3l5QjdBaHNteHVXRVVISlFlY19RWnU2clMwWjU1cmVIdU5ULU9iUFItUS1lazVJa3pqSE1FWkdvQmc2LUpyaWNtM1pqWDJGWG1ielJMai1wT2RQU252TG1zaFVFcERyWDQ4VEprZ1Z5U3ZicFRCODBkTDVVTlV2SWxEVEs2Vm1VdzZ4Ni1sLXdDVnlGNU5pRHZHbVY4Q1VQQkFIWGptZjdaZ0xIazc5bTFVcWMySzUyc0UwNm1zcXliNnlKQjRnT1dwQUxiVXpRUjFzbFFKcjktZ2p1N3ZaU2prdzBaY3hsc0xBRHBNSDlzZVVnJmNpZD1DQUFTQk9Sb3l2RSZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd0YuC_Q-AUFCbThDT01ZLWNQaUI3VkNNV255NGJITTNpWEJHSkIzQjhETHNCVnNjNzQxSUJhb3JWM2RVYTFKTUFCQURyLVRncEQwVktSYko2Yl9zQmtPQ1poT0RoS3liY0hnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzUzNDUwNjczNzcwNzI2MTE4NTYiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xNzguMTYyLjIwOS4xMzSoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF_5S6z9fy3J96wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvOAb-gUECAAQAJAGAJgGALgGAMEGAAABJyzwP9AG7o8B2gYWChABEC4BAKAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzcxODEzMDE4MDW6Bw8IAAEpRCAAMAA4ugZAAMgHw9YF0gcNCRFLAR4I2gcGCSdo4AcA6gcCCADwB8L8A4oIAhAAlQgAAIA_mAgB&s=11442224c555fec020edcd24869c0bda97deccf6

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1662434151&bdh=cldp5P7AevX2WRR0KsOMoRPI_Ik.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=2049382849&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv1cFgq5vcuP6oWr7QcKqxkd88g2Q7BGbjNoYOLmc7hz-wFdJCcRa5jXxiOGrShxrpAyCkCCM4W9NH9zERZtzTB-x3Iwpomv1gtT-6V-4oxL6uOf2KfOjoq8WD5ARv5xpC6dsPMvJ28Yqx97VZbihpq2w9Yo4h0Xzd1s5V4zTNPy5MQqBipYeXVEKZL2uiGgwtTLOVn7dYf8uCsZAWo6ggsgfiM29rTx3HZIaMAM1B-tlRpcvh1Yt7fDayTzcaPW9FEwGuLiF5Lf8uhZ1Q4VwfiQqaH509rxk9Ni_d-2zaYWQiMRS7Wmtoe9WhLjYMsRLbZaboK2lXvHFSoiGYogY4CHM82PMPAQz7aJA%2526sai%253DAMfl-YQVRguSpKSVMwNVhn0ep0THuSqAlJmUJcwlBoX85vtvtqd1NEHvrqJgEUmMfZYULUBKtUf06WhwvopvuyN2Qgp_83pNSWRXM40meRyolTsMPcmITHvSCY7986aToaQWPQ%2526sig%253DCg0ArKJSzLiE7nrQ4VhGEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

8c37d3fd326ce23d6f07a19e6e7d8bd9e1599d9eff8bba41af367f8955bf394c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

AN-X-Request-Uuid: 035bc837-760a-4021-9042-d2883efec7f5
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Tue, 06 Sep 2022 03:15:51 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Creative-ID: 78827815
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E3E8 52 KB
17 KB 23ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1662434151&bdh=cldp5P7AevX2WRR0KsOMoRPI_Ik.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=2049382849&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsv1cFgq5vcuP6oWr7QcKqxkd88g2Q7BGbjNoYOLmc7hz-wFdJCcRa5jXxiOGrShxrpAyCkCCM4W9NH9zERZtzTB-x3Iwpomv1gtT-6V-4oxL6uOf2KfOjoq8WD5ARv5xpC6dsPMvJ28Yqx97VZbihpq2w9Yo4h0Xzd1s5V4zTNPy5MQqBipYeXVEKZL2uiGgwtTLOVn7dYf8uCsZAWo6ggsgfiM29rTx3HZIaMAM1B-tlRpcvh1Yt7fDayTzcaPW9FEwGuLiF5Lf8uhZ1Q4VwfiQqaH509rxk9Ni_d-2zaYWQiMRS7Wmtoe9WhLjYMsRLbZaboK2lXvHFSoiGYogY4CHM82PMPAQz7aJA%2526sai%253DAMfl-YQVRguSpKSVMwNVhn0ep0THuSqAlJmUJcwlBoX85vtvtqd1NEHvrqJgEUmMfZYULUBKtUf06WhwvopvuyN2Qgp_83pNSWRXM40meRyolTsMPcmITHvSCY7986aToaQWPQ%2526sig%253DCg0ArKJSzLiE7nrQ4VhGEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 80831
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 06 Sep 2022 03:15:51 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 31 Aug 2022 04:48:29 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2, 629229
X-Served-By: cache-lga21953-LGA, cache-fra19165-FRA
X-Timer: S1662434151.427741,VS0,VE0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 95F1 0
0 52ms
52ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssYTBmrIA3HdVFAC5rV4B8FsNkXnLCfNobOTF3G2PcJTpzDs_AaYHRmRNT_wHxYFadgIrxZ0jjJKcpOJnWyXMFWK8njdJOpHRnUXWTtdTv-5MVF7OM39gsIytsAyU6nE7kAsY2RiNsCvJj75U1iZRii2QqK1ydIi_7hAmk5jwY1uN820mzHy0jpcAJVNv_tobB0df1QgrPDvTPyEQmULg4ozZMreVc4-qF6I8AW4nQSdXJXyNyCC2HcZbI2RiTByts-8BaguEkGDorJ4hyKMeefz5rK5CE0iWO_MDA1wvkZkdVQq2OmJCcNJxC6yuua6kNvMjn7hGjQ4J8T6ILJK4WvTDUEv9x65aPilcIj63kN&sai=AMfl-YSWjjsXiy-0peZEYENn27sx9FVI-McmSE1I8ZdgFQ-3Ffa3ygBuEdCZw0rrb1hV88qRTCQQQcpvjLjMalXf2xtbn0tXGk5nBCJjqHKgjfI61oQo4njzlJbVHS88owv13w&sig=Cg0ArKJSzKftRMb7jtP1EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
DATA 200
OK truncated
/ Frame 95F1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9f680aba69504d5e987f1ff364423751d962544c55c607edb8336a5be57755d7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame A9CE 5 KB
4 KB 31ms
31ms Script
application/javascript 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?ttjb=1&bdc=1662434151&bdh=cldp5P7AevX2WRR0KsOMoRPI_Ik.&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=9896220&psa=0&cb=1635817758&gdpr=0&gdpr_consent=&loc=%2C&pubclick=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick%3FAAAAAAAAAAAAAAAAAAAAAAAAAEDherQ_AAAAAAAAAAAAAAAAAAAAAHIah_3h0iloDvnzjMixVx5nuxZjAAAAAGMBHQHKIAAA5QAAAAIAAAAEWWMDmKoUAAAAAAAAAAAAVVNEAHgAWAJrrgAAAAABAgEAAAAAAMwABRUigwAAAAA.%2Fbcr%3DAAAAAAAAAAA%3D%2Fbn%3D76463%2Fclickenc%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: ib.adnxs.com
URL: https://ib.adnxs.com/ttj?id=9896220&psa=0&cb=1635817758&gdpr=0&gdpr_consent=&loc=,&pubclick=https://fra1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAEDherQ_AAAAAAAAAAAAAAAAAAAAAHIah_3h0iloDvnzjMixVx5nuxZjAAAAAGMBHQHKIAAA5QAAAAIAAAAEWWMDmKoUAAAAAAAAAAAAVVNEAHgAWAJrrgAAAAABAgEAAAAAAMwABRUigwAAAAA./bcr=AAAAAAAAAAA=/bn=76463/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjss-Q_T2M4_863TVQY3j-bxQIgGjRFJNeuzknAo8Wnr8L3wk7W4NRmQe_uPNVF8XJx4rAUSOsgktWiWFIshpUbvYB_logRzrBVtSqKXXVrfB9aXg3G4f5POiZ16KAtuxY5O2ajtS7uaWwoY8ZZ6pZSOb4QK6Db3C27atNYDCd0bvGHPUI6p7HY5t8BMudjBoPhpulhLDLDsfCCDpNF-oYhJWbHwsBbmHvkfTNpr4wliFIFUqDFXwrg58_eOffjbQIX8RCj_rExuCggHVvpn1EOx2_USBZXFOCSe43upXT17LSwm173LupaVVts7c4RIqB1Tx0QiT8nxqwm3T-s6xBHlgS-mwNg%2526sai%253DAMfl-YRaGVZqm6NlJGE3BPQgkF-BwVhOT8tFzjCWQ3sas8gU85MJ0zv4SxI8Gq1NyCXoIKsQCfPTy5pXaveMJufUwUajqSHays1gHVdisb_iUOySjreXcrIL3eRDJu0iSgimzg%2526sig%253DCg0ArKJSzB4xlw0zNDqfEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

d6266d3f406a047bc9c811a8639350d7b32d4cff9f651a35073fdac29b330862

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
X-Creative-ID: 321851875
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2327bf11-f9bc-4498-b5cd-7c7da3df7736
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6252 0
20 B 48ms
47ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-B-X5fgpFRjObrXUd9bVfuQxMwnynesnYvq6Jeqj3AarSTlhMk__jpk3k44lwc-2lFx9W7CIF9QuzfQS_myTkae3gBL_Q

Requested by

Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLKOPBMShwAAAMA1gAFAQjn9tqYBhCQxMS33M7flkoYjvLP54i57KseKjYJfc1y2eicpz8RHhoWo661oT8ZAAAAwB6F6z8hHhoWo661oT8pfc0JJNAxAAAAgD0Ktz8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjD1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGpBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0oQZEQUtBT2pzdjFjRmdxNXZjdVA2b1dyN1FjS3F4a2Q4OGcyUTdCR2JqTm9ZT0xtYzdoei13RmRKQ2NSYTVqWHhpT0dyU2h4cnBBeUNrQ0NNNFc5Tkg5ekVSWnR6VEIteDNJd3BvbXYxZ3RULTZWLTRveEw2dU9mMktmT2pvcThXRDVBUnY1eHBDNmRzUE12SjI4WXF4OTdWWmJpaHBxMnc5WW80aDBYemQxczVWNHpUTlB5NU1RcUJpcFllWFZFS1pMMnVpR2d3dFRMT1ZuN2RZZjh1Q3NaQVdvNmdnc2dmaU0yOXJUeDNIWklhTUFNMUItdGxScGN2aDFZdDdmRGF5VHpjYVBXOUZFd0d1TGlGNUxmOHVoWjFRNFZ3ZmlRcWFINTA5cnhrOU5pX2QtMnphWVdRaU1SUzdXbXRvZTlXaExqWU1zUkxiWmFib0sybFh2SEZTb2lHWW9nWTRDSE04MlBNUEFRejdhSkElMjUyNnNhaSUyNTNEQU1mbC1ZUVZSZ3VTcEtTVk13TlZobjBlcDBUSHVTcUFsSm1VSmN3bEJvWDg1dnR2dHFkMU5FSHZycUpnRVVtTWZaWVVMVUJLdFVmMDZXaHd2b3B2dXlOMlFncF84M3BOU1dSWE00MG1lUnlvbFRzTVBjbUlUSHZTQ1k3OTg2YVRvYVFXUFElMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TGlFN25yUTRWaEdFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZodHRwczovL3doZXJlZ29lcy5jb20v8gIMCgZIRUlHSFQSAjkw8gIMCgVXSURUSBIDNzI48gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk5NzgxOTAyNjPyAr8VCgtQUkVfU0NSSVBUUxKvFTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjt2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwpmdW5jdGlvbiBsKGEpe2xbIiAiXShhKTtyZXR1cm4gYX1sWyIgIl09ZnVuY3Rpb24oKXt9O2Z1bmN0aW9uIG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmV0dXJuIGEuY3JlYXRlRWxlbWVudCgiaW1nIil9O2Z1bmN0aW9uIHAoYSxjLGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHM9W10pO3ZhciBiPW4oYS5kb2N1bWVudCk7aWYoZCl7dmFyIGU9ZnVuY3Rpb24oKXtpZihkKXt2YXIgZj1hLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cyxnPWsoZixiKTswPD1nJiZBcnJheS5wcm90b3R5cGUuc3BsaWNlLmNhbGwoZixnLDEpfWIucmVtb3ZlRXZlbnRMaXN0ZW5lciYmYi5yZW1vdmVFdmVudExpc3RlbmVyKCJsb2FkIixlLCExKTtiLnJlbW92ZUV2ZW50TGlzdGVuZXImJmIucmVtb3ZlRXZlbnRMaXN0ZW5lcigiZXJyb3IiLGUsITEpfTtiLmFkZEV2ZW50TGlzdGVuZXImJmIuYWRkRXZlbnRMaXN0ZW5lcigibG9hZCIsZSwhMSk7Yi5hZGRFdmVudExpc3RlbmVyJiZiLmFCNABYZXJyb3IiLGUsITEpfWIuc3JjPWM7YS5SngEoLnB1c2goYil9O2YtafBhIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYcocj1SZWdFeHAoIl7lzeA_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmYR4AB0FeAAaAVhDGM9W10FCSBkPW51bGw7ZG8F_xhiPWE7dHJ5BQwsZTtpZihlPSEhYiYmASQcIT1iLmxvY2GhFCAuaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AdYIZj1lGRcAZgEWDGlmKGYpeQBnPl4AEDtkPWIuMTYEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVhQAQ7ZyUWJQIEZD0yBAEcMDw9ZDstLWSh2EhmPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZQBkIVoIJiZkBUgBGwgpO2MFrRR2KGIsZyltixggYy5nP2MuBfoMOmMuaQFAAH110DB2KGEsYyl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKnSkAd3VJJHQoKSxjPWEuaW7lokAoIj8iKTtzZXRUaW1lb3V0KBGMDTEEZD2VOhhkPy4wMTpkQTVEIShNYXRoLnJhbmRvbSgpPmQpaQ8MYj1xKCGkACJl_0g6Ly8iKyhiJiYidHJ1ZSI9PT1iVmsEOC1yY2QiKT8icGFnZWFkMo3_EHN5bmRpabkgLWNuLmNvbSI6ZiMABSAMKSsiLwlFeC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSKFRQxlPShlAbEMKSYmZVqZAA0xMCIpfHwidW5rbm93biJh41wrZSsiJnNhbXBsZT0iK2Q7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZT1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxlPS9DaHJvbWUvSZsgZSkmJiEvRWRnGREcPyEwOiExO2VhkxVRMC5zZW5kQmVhY29uPwodaR0YJChkKTpwKGIsZCw10gmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIxq9CIBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBmhQpOwo8L3PFmGw-8gLJAgoKRVhUUkFfVEFHUxK6AjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhS1WHSRRKWQJBNg0eLjICFGF3YmlkJgUG8IZfYj1BS0FtZi1CLVg1ZmdwRlJqT2JyWFVkOWJWZnVReE13bnluZXNuWXZxNkplcWozQWFyU1RsaE1rX19qcGszazQ0bHdjLTJsRng5VzdDSUY5UXV6ZlFTX215VGthZTNnQkxfUSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIxGqhkaXNwbGF5Om5vbmUiPjwvZGl2PvICmQEKDFBPU1RfU0NSSVBUUxKIATxzJWo2CAEWWAgUYWRzLmcuOlcPMQY8eGJmZV9iYWNrZmlsbC5qcwFlLbUNUwA-nSRgIHtyM3B4KCc5NzgxOTAyNjMnKTt9KSgpOz3qEJETChBIAZ00UE9SVF9QQVJBTVMS_BKRI4qUAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTE3OC4xNjIuMjA5LjEzNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wTYwgX3N0YXJ0PTEmoXcRvRB3aGVyZSL1DRAmc3ViXw2IAGJBjvB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1OVWJ0QUJGV3pRQkQyZzBBUXg0TkFHOGV6UUJUbncwQVFSOU5BRVlmVFFCSDMwMEFZZDlOQUdJZlRRQmpYMDBBWlo5TkFHZmZUUUJvWDAwQWFSOU5BR3hmVFFCdDMwMEFiaDlOQUc4ARAseEgwMEFjWjlOQUhWARAAMgEQBGRwARAAaAEQ9DsDUlhOQkFhOGRYQUxiSGx3Q0JCOWNBckwzaUFKei1ZZ0NSX3VJQXVFNXFnSW5RcW9DS0VLcUFpbENxZ0o5WXFvQ0VtaXFBbDVzcWdKT2Nxb0NfbmlxQXM5NnFnTHVocW9DZ0p1cUFvR2JxZ0tDbTZvQ0g2R3FBcFNqcWdLaXFLb0NzYXVxQWxXOXFnTEl5S29DR3RTcUF0dldxZ0ttMnFvQ1ZkNnFBc2ppcWdLZzVhb0NVLXFxQXFuMHFnSlQtS29DSnZ1cUFrTDdxZ0ltXzZvQ1FBR3JBdWNCcXdMM0Jhc0NmQWVyQW5ZTHF3Si1ES3NDc3hDckFqa1Jxd0tJRWFzQ0J4S3JBckVTcXdKb0Zxc0NVaGlyQW5ZWXF3S3hHS3NDemh1ckFnc2Nxd0ppSEtzQ2VoeXJBcXdjcXdJRUhxc0NYQjZyQXA4ZXF3S2dIcXNDVUItckF2WWZxd0lkSUtzQ1Z5Q3JBc0lncXdJQUk2c0NHaU9yQXM4a3F3SVBKYXNDZmlXckFvMG1xd0l4SjZzQ1RDZXJBcElucXdKVUtLc0NheWlyQWgwcHF3Sk1LYXNDYVNtckFtc3Bxd0tPS2FzQ2N5cXJBa0lycXdLcks2c0N2eXVyQXRVcnF3TDdLNnNDb2l5ckFyVXNxd0s2czhVRkI5cF9DUEJDM0FsQ19TTVFoYUUxRVRlVi14SVh0dnNTQnNuN0VsbksteEw1NWZzU1FfWDdFb0gxLXhJSF9mc1M1djM3RWdmXy14SkZBZndTZGdIOEVtRURfQktsQV93UzZGdlFFOXpIREJYNFZtc2FXUUNTS1EmZXhrPTk3ODE5MDI2MyZhd2JpZF9jPUFLQW1mLUNQTjE2NDhPNFJnYkhZVU9TTmoyRUZwLVM2LXZaTEJENF8wYlgycGRtcm1NblZxNGV3QWVzR2dhdVFZTWtyS1M0R1Q1Z09SMlhQWmFzLV92aE9PUDZRQWh4V3dZRzJFYVlsUGl6a0M4VzRObWozeEVWUExfc21Zb0huOXFqRjNkZkNnYjhXTmFSTVl4cklfRFpMaUw4SzVHOERiaGNQNW45MEtyVFRzWkJZbjRobW9XVSZhd2JpZF9kzRn0AgVDVnpNM19wdEVFRW1vYUlmdVl1LUdRV0tjYWtyZDI5OVNfMDdFQjNCd21aYzY2NUN0SmpDVDBGdHlaZE9BcDJTV0JjQjZaTFBCUDFjUERHbHBrTFRMLUpTdEdSU2RaTk9UMlNRb0pPa2syS1YtdFc3NGZYbWxYa3VhMWhVdnNzVVJpekNlZEs0UFFKdTFYNE5TZWZ3QzhrR1RPdGZieVF5ODhWVkczUWltYWNpMmhSUHZnRHRvM04xUUROc1BxbWswNnBLTldXd2N5R0RlUTUxX0ZZVEE0Rno1UTVJRkpWa1VhdmZZS0NXcEU5bnAyOVNmazhZaGFIb2ZhbzlHamtLWUFSVHZZWjJqa0RWZkNWS05TTVZhNFhRZGtfTWNWdTNpVnVlWldNQUVaeEhocUk5M29oSXJZQzh5QzVROHV1TmF4V2FzRW5Td2l4SXVVV1I1eGh4OU05eWFPckJocW9qajdaMVdTX0RRTmhXTEVsTjNqU3Y4bklDVkJDcEpMLU4wU1pPeExQcF9reEJOQzFJS1lQb2czal9QUThpejhIWk1UZWZtUnVBMHo1QWRoZlh6eUZaN1NFUWxkNGNBQ19rZnQ4cXh1REhtdEpqazZicURwSHJXSEc4TzdQQ2tETDdicUtLeWVfaDNkSnM2eHd6RThrMFFUNGFLaU5Hd2hONUNOOVN4eldBLWd0SHdYalhyYkt1ZExkdDhYMXVabGZGakJPSmdvRURsYll6bTRvSkRWN243OUZpb0ZKWEZza3cwdzFSOThoZkZDREFTYlIxTkRMbF9Ncmw2SHVZRVNmdWtBYWItRUo1N0xOWndqeUVtM1R3TG1IWEkzQUlkLW5wRE0wLUJDNmdMX1ZsUXRKUHByX2FjNkFiczVQcjNPYWdJSl8zVGdpcXc3cllycU5Uam9EZ3JMTmZxcFVkQndNSzNLVFZjcXV5cGN6R3BWRzVKSzFHaWJaNmpxU1k4STdRVlY4ZTlEb0hvY0RPcmVybDVzb0VJTEtqQm1aeGE3eXJITFN6UTgwSUJqcFd0T3R1SEVhR21PNjF5Y0VScmZremZUVUpVTGZFSHFVWFVFWHU5bHgtSV9lMVhBVlNnakFVMmR1NkNwd0M2bHE2djhtVWlTekZvVlZMTHJCMmZ1cEdBNkVGWllES3pYZmNDWTBVYmtzeW5scVVWUVRpLTJEdWJ1YmM3bklpX2U1Qk1aczRwNk5WSGt1Z3MzOEl1aUZCT04tYy1yUGQwMkRwTE4zc3l5QjdBaHNteHVXRVVISlFlY19RWnU2clMwWjU1cmVIdU5ULU9iUFItUS1lazVJa3pqSE1FWkdvQmc2LUpyaWNtM1pqWDJGWG1ielJMai1wT2RQU252TG1zaFVFcERyWDQ4VEprZ1Z5U3ZicFRCODBkTDVVTlV2SWxEVEs2Vm1VdzZ4Ni1sLXdDVnlGNU5pRHZHbVY4Q1VQQkFIWGptZjdaZ0xIazc5bTFVcWMySzUyc0UwNm1zcXliNnlKQjRnT1dwQUxiVXpRUjFzbFFKcjktZ2p1N3ZaU2prdzBaY3hsc0xBRHBNSDlzZVVnJmNpZD1DQUFTQk9Sb3l2RSZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd0YuC_Q-AUFCbThDT01ZLWNQaUI3VkNNV255NGJITTNpWEJHSkIzQjhETHNCVnNjNzQxSUJhb3JWM2RVYTFKTUFCQURyLVRncEQwVktSYko2Yl9zQmtPQ1poT0RoS3liY0hnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzUzNDUwNjczNzcwNzI2MTE4NTYiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xNzguMTYyLjIwOS4xMzSoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF_5S6z9fy3J96wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvOAb-gUECAAQAJAGAJgGALgGAMEGAAABJyzwP9AG7o8B2gYWChABEC4BAKAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzcxODEzMDE4MDW6Bw8IAAEpRCAAMAA4ugZAAMgHw9YF0gcNCRFLAR4I2gcGCSdo4AcA6gcCCADwB8L8A4oIAhAAlQgAAIA_mAgB&s=11442224c555fec020edcd24869c0bda97deccf6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 6252 7 KB
3 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13385bc296bb2dc9cac61d19963d6868de43445187fdb91b6980e892773a1c37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 02:30:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2728
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3151
x-xss-protection: 0
server: cafe
etag: 3095951791532391640
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Sep 2022 03:30:23 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 6252 0
819 B 8ms
7ms Image
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKsC_BMrAUAAAMA1gAFAQjn9tqYBhCQxMS33M7flkoYjvLP54i57KseKjYJfs1y2eicpz8RHhoWo661oT8ZAAAAwB6F6z8hHhoWo661oT8pfc0JJNAxAAAAgD0Ktz8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjD1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGpBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0uwREQUtBT2pzdjFjRmdxNXZjdVA2b1dyN1FjS3F4a2Q4OGcyUTdCR2JqTm9ZT0xtYzdoei13RmRKQ2NSYTVqWHhpT0dyU2h4cnBBeUNrQ0NNNFc5Tkg5ekVSWnR6VEIteDNJd3BvbXYxZ3RULTZWLTRveEw2dU9mMktmT2pvcThXRDVBUnY1eHBDNmRzUE12SjI4WXF4OTdWWmJpaHBxMnc5WW80aDBYemQxczVWNHpUTlB5NU1RcUJpcFllWFZFS1pMMnVpR2d3dFRMT1ZuN2RZZjh1Q3NaQVdvNmdnc2dmaU0yOXJUeDNIWklhTUFNMUItdGxScGN2aDFZdDdmRGF5VHpjYVBXOUZFd0d1TGlGNUxmOHVoWjFRNFZ3ZmlRcWFINTA5cnhrOU5pX2QtMnphWVdRaU1SUzdXbXRvZTlXaExqWU1zUkxiWmFib0sybFh2SEZTb2lHWW9nWTRDSE04MlBNUEFRejdhSkElMjUyNnNhaSUyNTNEQU1mbC1ZUVZSZ3VTcEtTVk13TlZobjBlcDBUSHVTcUFsSm1VSmN3bEJvWDg1dnR2dHFkMU5FSHZycUpnRVVtTWZaWVVMVUJLdFVmMDZXaHd2b3B2dXlOMlFncF84M3BOU1dSWE00MG1lUnlvbFRzTVBjbUlUSHZTQ1k3OTg2YVRvYVFXUFElMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TGlFN25yUTRWaEdFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZodHRwczovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1BQm04Q09NWS1jUGlCN1ZDTVdueTRiSE0zaVhCR0pCM0I4RExzQlZzYzc0MUlCYW9yVjNkVWExSk1BQkFEci1UZ3BEMFZLUmJKNmJfc0JrT0NaaE9EaEt5YmNIZyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM1MzQ1MDY3Mzc3MDcyNjExODU2Igg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBf-Uus_X8tyfesAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbzgG_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzcxODEzMDE4MDW6Bw8IABAAGAAgADAAOLoGQADIB8PWBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHwvwDiggCEACVCAAAgD-YCAE.&s=14154b96e4147618b97b8fc9a145a6bbe46e8dec

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d559f301-70de-4dc1-8d7b-a733bbeb6d44
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/227/ Frame 6252 85 KB
29 KB 7ms
6ms Script
application/x-javascript 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/227/trk.js
Requested by: Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLKOPBMShwAAAMA1gAFAQjn9tqYBhCQxMS33M7flkoYjvLP54i57KseKjYJfc1y2eicpz8RHhoWo661oT8ZAAAAwB6F6z8hHhoWo661oT8pfc0JJNAxAAAAgD0Ktz8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjD1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGpBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0oQZEQUtBT2pzdjFjRmdxNXZjdVA2b1dyN1FjS3F4a2Q4OGcyUTdCR2JqTm9ZT0xtYzdoei13RmRKQ2NSYTVqWHhpT0dyU2h4cnBBeUNrQ0NNNFc5Tkg5ekVSWnR6VEIteDNJd3BvbXYxZ3RULTZWLTRveEw2dU9mMktmT2pvcThXRDVBUnY1eHBDNmRzUE12SjI4WXF4OTdWWmJpaHBxMnc5WW80aDBYemQxczVWNHpUTlB5NU1RcUJpcFllWFZFS1pMMnVpR2d3dFRMT1ZuN2RZZjh1Q3NaQVdvNmdnc2dmaU0yOXJUeDNIWklhTUFNMUItdGxScGN2aDFZdDdmRGF5VHpjYVBXOUZFd0d1TGlGNUxmOHVoWjFRNFZ3ZmlRcWFINTA5cnhrOU5pX2QtMnphWVdRaU1SUzdXbXRvZTlXaExqWU1zUkxiWmFib0sybFh2SEZTb2lHWW9nWTRDSE04MlBNUEFRejdhSkElMjUyNnNhaSUyNTNEQU1mbC1ZUVZSZ3VTcEtTVk13TlZobjBlcDBUSHVTcUFsSm1VSmN3bEJvWDg1dnR2dHFkMU5FSHZycUpnRVVtTWZaWVVMVUJLdFVmMDZXaHd2b3B2dXlOMlFncF84M3BOU1dSWE00MG1lUnlvbFRzTVBjbUlUSHZTQ1k3OTg2YVRvYVFXUFElMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TGlFN25yUTRWaEdFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZodHRwczovL3doZXJlZ29lcy5jb20v8gIMCgZIRUlHSFQSAjkw8gIMCgVXSURUSBIDNzI48gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk5NzgxOTAyNjPyAr8VCgtQUkVfU0NSSVBUUxKvFTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjt2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwpmdW5jdGlvbiBsKGEpe2xbIiAiXShhKTtyZXR1cm4gYX1sWyIgIl09ZnVuY3Rpb24oKXt9O2Z1bmN0aW9uIG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmV0dXJuIGEuY3JlYXRlRWxlbWVudCgiaW1nIil9O2Z1bmN0aW9uIHAoYSxjLGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHM9W10pO3ZhciBiPW4oYS5kb2N1bWVudCk7aWYoZCl7dmFyIGU9ZnVuY3Rpb24oKXtpZihkKXt2YXIgZj1hLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cyxnPWsoZixiKTswPD1nJiZBcnJheS5wcm90b3R5cGUuc3BsaWNlLmNhbGwoZixnLDEpfWIucmVtb3ZlRXZlbnRMaXN0ZW5lciYmYi5yZW1vdmVFdmVudExpc3RlbmVyKCJsb2FkIixlLCExKTtiLnJlbW92ZUV2ZW50TGlzdGVuZXImJmIucmVtb3ZlRXZlbnRMaXN0ZW5lcigiZXJyb3IiLGUsITEpfTtiLmFkZEV2ZW50TGlzdGVuZXImJmIuYWRkRXZlbnRMaXN0ZW5lcigibG9hZCIsZSwhMSk7Yi5hZGRFdmVudExpc3RlbmVyJiZiLmFCNABYZXJyb3IiLGUsITEpfWIuc3JjPWM7YS5SngEoLnB1c2goYil9O2YtafBhIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYcocj1SZWdFeHAoIl7lzeA_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmYR4AB0FeAAaAVhDGM9W10FCSBkPW51bGw7ZG8F_xhiPWE7dHJ5BQwsZTtpZihlPSEhYiYmASQcIT1iLmxvY2GhFCAuaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AdYIZj1lGRcAZgEWDGlmKGYpeQBnPl4AEDtkPWIuMTYEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_8EB9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlbmd0aC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVhQAQ7ZyUWJQIEZD0yBAEcMDw9ZDstLWSh2EhmPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZQBkIVoIJiZkBUgBGwgpO2MFrRR2KGIsZyltixggYy5nP2MuBfoMOmMuaQFAAH110DB2KGEsYyl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKnSkAd3VJJHQoKSxjPWEuaW7lokAoIj8iKTtzZXRUaW1lb3V0KBGMDTEEZD2VOhhkPy4wMTpkQTVEIShNYXRoLnJhbmRvbSgpPmQpaQ8MYj1xKCGkACJl_0g6Ly8iKyhiJiYidHJ1ZSI9PT1iVmsEOC1yY2QiKT8icGFnZWFkMo3_EHN5bmRpabkgLWNuLmNvbSI6ZiMABSAMKSsiLwlFeC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSKFRQxlPShlAbEMKSYmZVqZAA0xMCIpfHwidW5rbm93biJh41wrZSsiJnNhbXBsZT0iK2Q7Yj13aW5kb3cFWABmOTQUZj8hMTpmITM0ZT1iLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxlPS9DaHJvbWUvSZsgZSkmJiEvRWRnGREcPyEwOiExO2VhkxVRMC5zZW5kQmVhY29uPwodaR0YJChkKTpwKGIsZCw10gmeECl9fSwwVaBcMDw9Yz9hLnN1YnN0cmluZygwLGMpOmF9CeAQLnJmbD1dIxq9CIBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBmhQpOwo8L3PFmGw-8gLJAgoKRVhUUkFfVEFHUxK6AjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhS1WHSRRKWQJBNg0eLjICFGF3YmlkJgUG8IZfYj1BS0FtZi1CLVg1ZmdwRlJqT2JyWFVkOWJWZnVReE13bnluZXNuWXZxNkplcWozQWFyU1RsaE1rX19qcGszazQ0bHdjLTJsRng5VzdDSUY5UXV6ZlFTX215VGthZTNnQkxfUSIgYm9yZGVyPTAgd2lkdGg9MSBoZWlnaHQ9MSBhbHQ9IiIxGqhkaXNwbGF5Om5vbmUiPjwvZGl2PvICmQEKDFBPU1RfU0NSSVBUUxKIATxzJWo2CAEWWAgUYWRzLmcuOlcPMQY8eGJmZV9iYWNrZmlsbC5qcwFlLbUNUwA-nSRgIHtyM3B4KCc5NzgxOTAyNjMnKTt9KSgpOz3qEJETChBIAZ00UE9SVF9QQVJBTVMS_BKRI4qUAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTE3OC4xNjIuMjA5LjEzNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wTYwgX3N0YXJ0PTEmoXcRvRB3aGVyZSL1DRAmc3ViXw2IAGJBjvB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1OVWJ0QUJGV3pRQkQyZzBBUXg0TkFHOGV6UUJUbncwQVFSOU5BRVlmVFFCSDMwMEFZZDlOQUdJZlRRQmpYMDBBWlo5TkFHZmZUUUJvWDAwQWFSOU5BR3hmVFFCdDMwMEFiaDlOQUc4ARAseEgwMEFjWjlOQUhWARAAMgEQBGRwARAAaAEQ9DsDUlhOQkFhOGRYQUxiSGx3Q0JCOWNBckwzaUFKei1ZZ0NSX3VJQXVFNXFnSW5RcW9DS0VLcUFpbENxZ0o5WXFvQ0VtaXFBbDVzcWdKT2Nxb0NfbmlxQXM5NnFnTHVocW9DZ0p1cUFvR2JxZ0tDbTZvQ0g2R3FBcFNqcWdLaXFLb0NzYXVxQWxXOXFnTEl5S29DR3RTcUF0dldxZ0ttMnFvQ1ZkNnFBc2ppcWdLZzVhb0NVLXFxQXFuMHFnSlQtS29DSnZ1cUFrTDdxZ0ltXzZvQ1FBR3JBdWNCcXdMM0Jhc0NmQWVyQW5ZTHF3Si1ES3NDc3hDckFqa1Jxd0tJRWFzQ0J4S3JBckVTcXdKb0Zxc0NVaGlyQW5ZWXF3S3hHS3NDemh1ckFnc2Nxd0ppSEtzQ2VoeXJBcXdjcXdJRUhxc0NYQjZyQXA4ZXF3S2dIcXNDVUItckF2WWZxd0lkSUtzQ1Z5Q3JBc0lncXdJQUk2c0NHaU9yQXM4a3F3SVBKYXNDZmlXckFvMG1xd0l4SjZzQ1RDZXJBcElucXdKVUtLc0NheWlyQWgwcHF3Sk1LYXNDYVNtckFtc3Bxd0tPS2FzQ2N5cXJBa0lycXdLcks2c0N2eXVyQXRVcnF3TDdLNnNDb2l5ckFyVXNxd0s2czhVRkI5cF9DUEJDM0FsQ19TTVFoYUUxRVRlVi14SVh0dnNTQnNuN0VsbksteEw1NWZzU1FfWDdFb0gxLXhJSF9mc1M1djM3RWdmXy14SkZBZndTZGdIOEVtRURfQktsQV93UzZGdlFFOXpIREJYNFZtc2FXUUNTS1EmZXhrPTk3ODE5MDI2MyZhd2JpZF9jPUFLQW1mLUNQTjE2NDhPNFJnYkhZVU9TTmoyRUZwLVM2LXZaTEJENF8wYlgycGRtcm1NblZxNGV3QWVzR2dhdVFZTWtyS1M0R1Q1Z09SMlhQWmFzLV92aE9PUDZRQWh4V3dZRzJFYVlsUGl6a0M4VzRObWozeEVWUExfc21Zb0huOXFqRjNkZkNnYjhXTmFSTVl4cklfRFpMaUw4SzVHOERiaGNQNW45MEtyVFRzWkJZbjRobW9XVSZhd2JpZF9kzRn0AgVDVnpNM19wdEVFRW1vYUlmdVl1LUdRV0tjYWtyZDI5OVNfMDdFQjNCd21aYzY2NUN0SmpDVDBGdHlaZE9BcDJTV0JjQjZaTFBCUDFjUERHbHBrTFRMLUpTdEdSU2RaTk9UMlNRb0pPa2syS1YtdFc3NGZYbWxYa3VhMWhVdnNzVVJpekNlZEs0UFFKdTFYNE5TZWZ3QzhrR1RPdGZieVF5ODhWVkczUWltYWNpMmhSUHZnRHRvM04xUUROc1BxbWswNnBLTldXd2N5R0RlUTUxX0ZZVEE0Rno1UTVJRkpWa1VhdmZZS0NXcEU5bnAyOVNmazhZaGFIb2ZhbzlHamtLWUFSVHZZWjJqa0RWZkNWS05TTVZhNFhRZGtfTWNWdTNpVnVlWldNQUVaeEhocUk5M29oSXJZQzh5QzVROHV1TmF4V2FzRW5Td2l4SXVVV1I1eGh4OU05eWFPckJocW9qajdaMVdTX0RRTmhXTEVsTjNqU3Y4bklDVkJDcEpMLU4wU1pPeExQcF9reEJOQzFJS1lQb2czal9QUThpejhIWk1UZWZtUnVBMHo1QWRoZlh6eUZaN1NFUWxkNGNBQ19rZnQ4cXh1REhtdEpqazZicURwSHJXSEc4TzdQQ2tETDdicUtLeWVfaDNkSnM2eHd6RThrMFFUNGFLaU5Hd2hONUNOOVN4eldBLWd0SHdYalhyYkt1ZExkdDhYMXVabGZGakJPSmdvRURsYll6bTRvSkRWN243OUZpb0ZKWEZza3cwdzFSOThoZkZDREFTYlIxTkRMbF9Ncmw2SHVZRVNmdWtBYWItRUo1N0xOWndqeUVtM1R3TG1IWEkzQUlkLW5wRE0wLUJDNmdMX1ZsUXRKUHByX2FjNkFiczVQcjNPYWdJSl8zVGdpcXc3cllycU5Uam9EZ3JMTmZxcFVkQndNSzNLVFZjcXV5cGN6R3BWRzVKSzFHaWJaNmpxU1k4STdRVlY4ZTlEb0hvY0RPcmVybDVzb0VJTEtqQm1aeGE3eXJITFN6UTgwSUJqcFd0T3R1SEVhR21PNjF5Y0VScmZremZUVUpVTGZFSHFVWFVFWHU5bHgtSV9lMVhBVlNnakFVMmR1NkNwd0M2bHE2djhtVWlTekZvVlZMTHJCMmZ1cEdBNkVGWllES3pYZmNDWTBVYmtzeW5scVVWUVRpLTJEdWJ1YmM3bklpX2U1Qk1aczRwNk5WSGt1Z3MzOEl1aUZCT04tYy1yUGQwMkRwTE4zc3l5QjdBaHNteHVXRVVISlFlY19RWnU2clMwWjU1cmVIdU5ULU9iUFItUS1lazVJa3pqSE1FWkdvQmc2LUpyaWNtM1pqWDJGWG1ielJMai1wT2RQU252TG1zaFVFcERyWDQ4VEprZ1Z5U3ZicFRCODBkTDVVTlV2SWxEVEs2Vm1VdzZ4Ni1sLXdDVnlGNU5pRHZHbVY4Q1VQQkFIWGptZjdaZ0xIazc5bTFVcWMySzUyc0UwNm1zcXliNnlKQjRnT1dwQUxiVXpRUjFzbFFKcjktZ2p1N3ZaU2prdzBaY3hsc0xBRHBNSDlzZVVnJmNpZD1DQUFTQk9Sb3l2RSZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd0YuC_Q-AUFCbThDT01ZLWNQaUI3VkNNV255NGJITTNpWEJHSkIzQjhETHNCVnNjNzQxSUJhb3JWM2RVYTFKTUFCQURyLVRncEQwVktSYko2Yl9zQmtPQ1poT0RoS3liY0hnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzUzNDUwNjczNzcwNzI2MTE4NTYiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xNzguMTYyLjIwOS4xMzSoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF_5S6z9fy3J96wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFvOAb-gUECAAQAJAGAJgGALgGAMEGAAABJyzwP9AG7o8B2gYWChABEC4BAKAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzcxODEzMDE4MDW6Bw8IAAEpRCAAMAA4ugZAAMgHw9YF0gcNCRFLAR4I2gcGCSdo4AcA6gcCCADwB8L8A4oIAhAAlQgAAIA_mAgB&s=11442224c555fec020edcd24869c0bda97deccf6
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e8962d65caa8b6f0dc72b61fbb38446161265efab5e41ca343cedfafd139a4e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Content-Encoding: gzip
Age: 497872
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29299
X-Served-By: cache-lga13622-LGA, cache-fra19161-FRA
Access-Control-Allow-Origin: *, *
Last-Modified: Wed, 31 Aug 2022 08:56:29 GMT
Server: AkamaiNetStorage
X-Timer: S1662434151.445531,VS0,VE0
ETag: "6a0cd0532ee3ee4311615d1638090572:1661936189.164265"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Thu, 31 Aug 2023 08:58:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 1, 1223835

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 65F1 13 KB
5 KB 24ms
24ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fra1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76119
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 05 Sep 2022 06:07:12 GMT
etag: 12223946614886178233
expires: Tue, 06 Sep 2022 06:07:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 0351 8 KB
1 KB 90ms
33ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Sep 2022 01:44:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 06 Sep 2022 03:15:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 0351 2 KB
1 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f4362568e9be366759f9ada329e928f398f49333040bc12fcf2de18483d1f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 00:19:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10609
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
server: cafe
etag: 17441257144546641969
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 00:19:02 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 0351 30 KB
12 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 00:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8193
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 00:59:18 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 0351 3 KB
1 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59e198c356c79d1ba89670c50cdb7e54181037f277ee106126caf570278bc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
server: cafe
etag: 15450667304708860052
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 03:03:42 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0351 142 KB
44 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 0351 26 KB
10 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f882756b47651b0f3e87b7031f4d98412c1f2b43fc6cfa900285b8d00a3d3c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 02:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1636
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10270
x-xss-protection: 0
server: cafe
etag: 538911934249463863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 02:48:35 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0351 0
0 53ms
23ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQIPPdOCAJSl-6q-VxiZNG2hBp6F89awGssJxON2OjUItDogE9TCqVN3kCDCozOtK9AI5c1RN3-umd8JO2Q256O3dE9Bg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2 200 99d351374812bfb865cd4e83ebb83e02.js Show response
www.gstatic.com/mysidia/ Frame 0351 43 KB
17 KB 60ms
25ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/99d351374812bfb865cd4e83ebb83e02.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bd2aa31d3fd0959adbeedc4d69713ca9e68cc3b074672bc992f808eeb668e8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 22:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 447950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16711
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 01:10:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 22:50:01 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0351 0
17 B 70ms
69ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cq2wwZrsWY8KiFNyLmLAPzuqvoAvhjNGebI2g0dKfD4Wv3aTVFRABIOaX1iVglYKAgLQHoAHPyPr8A8gBAakCCAx8yg25sD6oAwHIA8sEqgTUAU_QHdZY8icMP6K5B5V0c7OOzjo-R8msjtjiD13fxxg4JVCTnZq2qqFz1ThwYqIu05NPvB724jLRp6ZiNTY1qvB11LpaWfZAOywf6jefoU3ZILvSFF0NLsZlosBCPnWTaEBP8fvaKmLh6onmuIwX73GvVRyRlOmZxMle0VkK-7MEulxpRsFmNDUt_uQrec9qZN5fLr6sQDDczophLbKouR42hRpS3XpTpfxGDx0zyDHAHjjBFr5YoM5LNbcrdyHumgtYPk46hVG39tPTRnbW-aRO_hMvwAS25OSCtAOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAYAHueSXmAGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAdIIEQiA4YAQEAEYADICqgI6AoBA8ggOYmlkZGVyLTMwNTY0NDeACgTICwHYEwzQFQGAFwGyFwgKBggAEgAYAA&sigh=ranqEgN5C40&uach_m=[UACH]&pr=10:0.044578&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 06 Sep 2022 03:15:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E3E8 0
747 B 23ms
23ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 990c4653-d53e-4317-9210-68d91b14d6a8
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK 949f7108-7866-4dda-ad7a-f37ec5dcfa1b.jpg
crcdn01.adnxs-simple.com/creative/p/3854/2021/11/5/29608470/ Frame A9CE 17 KB
18 KB 48ms
7ms Image
image/jpeg 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crcdn01.adnxs-simple.com/creative/p/3854/2021/11/5/29608470/949f7108-7866-4dda-ad7a-f37ec5dcfa1b.jpg
Requested by: Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.19.0 /
Resource Hash: 31fca2c69e09dcfadaf80aff16608ff3a2a2bb3d6d99fedee25667aa10c2e0d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:51 GMT
Last-Modified: Fri, 05 Nov 2021 17:21:07 GMT
Server: nginx/1.19.0
x-amz-request-id: 4c6c16db-91bd-4a82-b5af-1d223708f30c
X-Clv-Request-Id: 4c6c16db-91bd-4a82-b5af-1d223708f30c
ETag: "2e92f5542fbaa3b2186cec9d89752659"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=3888000
X-Clv-S3-Version: 2.5
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17639
Expires: Fri, 21 Oct 2022 03:15:51 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame A9CE 0
819 B 7ms
7ms Image
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL9EaD9CAAAAwDWAAUBCOf22pgGEOqKuvPLrd_6exiO8s_niLnsqx4qNgkAAAECCPA_EQEHEAAA8D8ZEQkAIREJACkRCQAxEQmoMJyC3AQ4jh5Ajh5IAlDjo7yZAVio-zlgAGjas2B48tcFgAEBigEDVVNEkgUG8E-YAXigAdgEqAEBsAEAuAECwAEDyAEC0AEA2AEA4AEA6gGpB2h0dHBzJTNBJTJGJTJGZnJhMS1pYi5hZG54cy5jb20lMkZjbGljayUzRkFBQVYDABhFRGhlclFfUh0AaEhJYWhfM2gwaWxvRHZuempNaXhWeDVudXhaagUwMEdNQkhRSEtJQUFBNVEBEgEKJEFFV1dNRG1Lb1UBEhEBNFZWTkVBSGdBV0FKcnJnBRYMQkFnRQUJJEFNd0FCUlVpZ3cFDyQuJTJGYmNyJTNEBQ8JAQglM0QBFyhuJTNENzY0NjMlMgnbFGVuYyUzRDYIATxhZGNsaWNrLmcuZG91YmxlCQ4gbmV0JTJGcGNzETscJTI1M0Z4YWkBCPRpAURBS0FPanNzLVFfVDJNNF84NjNUVlFZM2otYnhRSWdHalJGSk5ldXprbkFvOFducjhMM3drN1c0TlJtUWVfdVBOVkY4WEp4NHJBVVNPc2drdFdpV0ZJc2hwVWJ2WUJfbG9nUnpyQlZ0U3FLWFhWcmZCOWFYZzNHNGY1UE9pWjE2S0F0dXhZNU8yYWp0Uzd1YVd3b1k4Wlo2cFpTT2I0UUs2RGIzQzI3YXROWURDZDBidkdIUFVJNnA3SFk1dDhCTXVkakJvUGhwdWxoTERMRHNmQ0NEcE5GLW9ZaEpXYkh3c0JibUh2a2ZUTnByNHdsaUZJRlVxREZYd3JnNThfZU9mZmpiUUlYOFJDal9yRXh1Q2dnSFZ2cG4xRU94Ml9VU0JaWEZPQ1NlNDN1cFhUMTdMU3dtMTczTHVwYVZWdHM3YzRSSXFCMVR4MFFpVDhueHF3bTNULXM2eEJIbGdTLW13TmclMjUyNnNhLW_0bgJNZmwtWVJhR1ZacW02TmxKR0UzQlBRZ2tGLUJ3VmhPVDh0RnpqQ1dRM3NhczhnVTg1TUowenY0U3hJOEdxMU55Q1hvSUtzUUNmUFR5NXBYYXZlTUp1ZlV3VWFqcVNIYXlzMWdIVmRpc2JfaVVPeVNqcmVYY3JJTDNlUkRKdTBpU2dpbXpnJTI1MjZzaWclMjUzRENnMEFyS0pTekI0eGx3MHpORHFmRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABAIoCWXVmKCdhJywgMjkxMzk5NCwgMTY2MjQzNDE1MSk7dWYoJ2knLCA2NDI1OTM4LCAxNjYyNDM0MTUxKTt1ZigncicsIDMyMTg1MTg3NSwgMTY2MjQzNDE1MSk7kgKBBCFYMVNlWlFqanM3QVlFT09qdkprQkdBQWdxUHM1TUFBNEFFQUVTSTRlVUp5QzNBUllBR0MyQjJnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFhZ0JBYkFCQUxrQktZdUlnd0FBQUVEQkFTbUxpSU1BQVBBX3lRRUFBQUFBQUFEd1A5a0JBQUFBQUFBQThEX2dBZEthaUFQMUFRQUFnRC1ZQWdDZ0FnRzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0c2QXdsR1VrRXhPalV6TWpYZ0E1c3ZnQVNGM0o0SGlBVGw0WjRIa0FRQW1BUUJ3UVFBQUFBQUFBQUFBTWtFQUFBQYlFGERZQkFEeEIJDQUBHGlBWE5LYWtGBQ0cQUFBOEQteEKFywkBBHdRkcYMRHdQOBkoDEFFRFIuKAAAMi4oAGgtQUZvSTBHOEFYS3otVUgtQVhLN2JFQmdnWUShBzhpQVlBa0FZQm1BWUFvUVkJaQFgJDZnR0JMSUdKQWsNFAxBQUFCrSMBAQRCawEGCQEAQx0YXExnR0NnLi6aApkBITRSSDJEZ2pqczdBWVUFKEtqN09TQUVLQUF4CT4B6Uw4NkNVWlNRVEU2TlRNeU5VQ2JMMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgQSGdBaVERECBEd1B3Li7CAjilpXg6Ly93d3cuY2FyZWVyZ2lybHMub3JnL2V4cGxvcmUtCRgEcy8JCEAtcXVpei_YAgDgArnQMOoCFhVD8IZoZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xNzguMTYyLjIwOS4xMzSoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA4zODU0I0ZSQTE6NTMyNdoEAggA4AQA8ATlxSCIBQGYBQCgBf8RARQBwAUAyQXx9wzSBQkJCQx4AADYBQHgBQHwBYOVJ_oFBAgAEACQBgCYBgC4BgDBBgklKPA_0AahD9oGFgoQCREZAQGcTOAGAfIGAggAgAcBiAcAoAcBugcPAUgAGAm2LLoGQADIB_LXBdIHDRV2ATgI2gcGCSdo4AcA6gcCCADwB8L8A4oIAhAAlQgAAIA_mAgB&s=758bed0ba9d650a76069536ff6f80d3d890eabd5

Requested by

Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8511c460-57e9-452e-91cb-a535d6c620b2
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E1DB 52 KB
17 KB 7ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: 90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com
URL: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 80831
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 06 Sep 2022 03:15:51 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 31 Aug 2022 04:48:29 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2, 629230
X-Served-By: cache-lga21953-LGA, cache-fra19165-FRA
X-Timer: S1662434151.487183,VS0,VE0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5C6C 143 B
163 B 24ms
24ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 06 Sep 2022 02:39:20 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A9CE 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2126f5c65d5879d31487bd571ec470e3018c97739ee8782adad74d2e76e3388

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 6252 0
843 B 7ms
7ms Ping
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKsC_BMrAUAAAMA1gAFAQjn9tqYBhCQxMS33M7flkoYjvLP54i57KseKjYJfs1y2eicpz8RHhoWo661oT8ZAAAAwB6F6z8hHhoWo661oT8pfc0JJNAxAAAAgD0Ktz8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjD1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGpBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0uwREQUtBT2pzdjFjRmdxNXZjdVA2b1dyN1FjS3F4a2Q4OGcyUTdCR2JqTm9ZT0xtYzdoei13RmRKQ2NSYTVqWHhpT0dyU2h4cnBBeUNrQ0NNNFc5Tkg5ekVSWnR6VEIteDNJd3BvbXYxZ3RULTZWLTRveEw2dU9mMktmT2pvcThXRDVBUnY1eHBDNmRzUE12SjI4WXF4OTdWWmJpaHBxMnc5WW80aDBYemQxczVWNHpUTlB5NU1RcUJpcFllWFZFS1pMMnVpR2d3dFRMT1ZuN2RZZjh1Q3NaQVdvNmdnc2dmaU0yOXJUeDNIWklhTUFNMUItdGxScGN2aDFZdDdmRGF5VHpjYVBXOUZFd0d1TGlGNUxmOHVoWjFRNFZ3ZmlRcWFINTA5cnhrOU5pX2QtMnphWVdRaU1SUzdXbXRvZTlXaExqWU1zUkxiWmFib0sybFh2SEZTb2lHWW9nWTRDSE04MlBNUEFRejdhSkElMjUyNnNhaSUyNTNEQU1mbC1ZUVZSZ3VTcEtTVk13TlZobjBlcDBUSHVTcUFsSm1VSmN3bEJvWDg1dnR2dHFkMU5FSHZycUpnRVVtTWZaWVVMVUJLdFVmMDZXaHd2b3B2dXlOMlFncF84M3BOU1dSWE00MG1lUnlvbFRzTVBjbUlUSHZTQ1k3OTg2YVRvYVFXUFElMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TGlFN25yUTRWaEdFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZodHRwczovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1BQm04Q09NWS1jUGlCN1ZDTVdueTRiSE0zaVhCR0pCM0I4RExzQlZzYzc0MUlCYW9yVjNkVWExSk1BQkFEci1UZ3BEMFZLUmJKNmJfc0JrT0NaaE9EaEt5YmNIZyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM1MzQ1MDY3Mzc3MDcyNjExODU2Igg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBf-Uus_X8tyfesAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbzgG_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzcxODEzMDE4MDW6Bw8IABAAGAAgADAAOLoGQADIB8PWBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHwvwDiggCEACVCAAAgD-YCAE.&s=14154b96e4147618b97b8fc9a145a6bbe46e8dec&type=nv&nvt=5&jm=1003&px=0&py=0&bw=728&bh=90&sid=6308979721398473639&vd=ct~0|rr~0&sv=227&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=728&ph=90&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/227/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 24f68be2-77fe-4798-a94b-67f90fda8988
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 0351 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97d7d98f2c8126998a487cb09641f7cca88d76035b777e531fa95ad49bc74d91

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 65F1 104 KB
35 KB 99ms
99ms XHR
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0236cf36933bc8b222ea94dbfd2a3389afec4c4549ca1d4fa59965869027780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36284
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E1DB 0
747 B 8ms
8ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:51 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9fc261b4-38ec-48e1-be1e-ea1db76e965b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 0351 28 KB
28 KB 48ms
14ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 20:36:54 GMT
x-content-type-options: nosniff
age: 455937
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 20:36:54 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A9CE 0
0 51ms
51ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvOd4f6ty5U6fhGtPbbhhw8-N5jZAuBgNSfK_IUuJbdCvH5tDS3Yyx_Yy9FHfxplKoTkiyPtxZ3NxN3oSOIrZ_alTwCPWyYEcfk6OH8oit5k-J-4jxxmypwujI5kez15lVbNLj1uO2qZ-48ngJSAWU4tt-NPgEH1odEAND3y3JzwEJNGRqdvsYE3ah55VcYDBZgdCky-BdSPZuyftBEo-1uKexxOWJ2Rp-IFGF5wCKZT4Pj0NqS8yl93zAfh16NgbuaPr4hUlmJ_evCfpjOPO78CTxs1uM2OOdfWWGRbCbB7Lfjhz54lQz-TpXtyoFSDpuAVAWy1Q51sacx4w-DpDgXumRNhgAlxCMw&sai=AMfl-YRwFnGaPkf8NNUUOc3VIfHyX1KjNd0MzzueLKyM-LY9T-KJ34ejCyd_IA6EEyHnH3rESDL8OYI8naeDZ56FxOWJNyfuxb3cGO5AhEzE-gVPQEEhsEz38Hlqdjy72mHDYg&sig=Cg0ArKJSzGayMVDWkar1EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216533.ip-141-95-98.eu

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5C6C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

147ms
146ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
expires: Tue, 06 Sep 2022 03:15:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 a568387544c7025dc0c7e4352283b457.js Show response
www.gstatic.com/mysidia/ Frame 65F1 17 KB
6 KB 56ms
27ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a568387544c7025dc0c7e4352283b457.js?tag=client_fast_engine

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3022778966c2350b7f492753d8415c7590a23300bd36968ac9e28170f105953

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 02:21:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 435287
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6629
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 01:10:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 02:21:04 GMT

GET
H3 200 e2875713480840d8712332133311d4ea.js Show response
www.gstatic.com/mysidia/ Frame 65F1 19 KB
8 KB 52ms
24ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e2875713480840d8712332133311d4ea.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d124788e480924e0a0917ef210d06075bd5166a9f9cc75f2937a98a4a497199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 03:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430321
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7767
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 19:26:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 03:43:50 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 65F1 8 KB
893 B 61ms
33ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Sep 2022 01:43:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 06 Sep 2022 03:15:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 65F1 2 KB
1 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f4362568e9be366759f9ada329e928f398f49333040bc12fcf2de18483d1f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 00:19:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10609
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
server: cafe
etag: 17441257144546641969
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 00:19:02 GMT

GET
H3 200 3cc14469dd7991d443416ad27a0ba906.js Show response
www.gstatic.com/mysidia/ Frame 65F1 12 KB
4 KB 54ms
27ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3cc14469dd7991d443416ad27a0ba906.js?tag=analytics_pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

50c9e53f4e72e20620140646d672380101ebece55b2e49f7c7911f7931d546bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Thu, 01 Sep 2022 03:58:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 429449
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4483
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 01:10:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 03:58:22 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/ Frame 65F1 30 KB
12 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35700fd4dc1a4008ab66bc0e57c19689f6daca9368bfd2a6beea1b86dc0159d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 00:59:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8193
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11778
x-xss-protection: 0
server: cafe
etag: 15541287485089275602
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 00:59:18 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 65F1 3 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59e198c356c79d1ba89670c50cdb7e54181037f277ee106126caf570278bc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:03:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
server: cafe
etag: 15450667304708860052
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 03:03:42 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 65F1 142 KB
44 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e851345505ee432c9397d60e5d91929ab4e5921f75c91f359b0939a879304b7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44792
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1661945761880069"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 06 Sep 2022 03:15:51 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/ Frame 65F1 26 KB
10 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220831/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f882756b47651b0f3e87b7031f4d98412c1f2b43fc6cfa900285b8d00a3d3c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 02:48:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1636
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10270
x-xss-protection: 0
server: cafe
etag: 538911934249463863
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 20 Sep 2022 02:48:35 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 65F1 0
0 22ms
21ms Image
text/html 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQlxgr7QCj0s6w6DVLuG2TE8CgZ3Jg54q3E6KTztFSEO-Q7yC8NGEIsVZ0dRL0YvWmLAPP8onJuYz6pPGUMje6vWKljdg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3 200 99d351374812bfb865cd4e83ebb83e02.js Show response
www.gstatic.com/mysidia/ Frame 65F1 43 KB
16 KB 51ms
25ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/99d351374812bfb865cd4e83ebb83e02.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bd2aa31d3fd0959adbeedc4d69713ca9e68cc3b074672bc992f808eeb668e8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 22:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 447950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16711
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 01:10:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 22:50:01 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 65F1 0
17 B 67ms
67ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CylILZ7sWY7L3Ev-1kdUP5sOlyAzO7JCna7uJ_Z6rEN_o8_0IEAEg5pfWJWCVgoCAtAegAZrH-ccDyAEBqQIIDHzKDbmwPqgDAcgDywSqBM8BT9D9rH2BqC733K7r1rHLEdDQb5nJpqUfflz7-Ivp8B7NnYy1cNa-mhP6Kxz_JKrOrGSk1I6o44L0_ZqrG1Y0eU7Am2XGs7Mf7lkbS5k6yFEz9MGvmvvu9KL95H7EAiQlRJ7wsCUdj-Z-nHHN5ypgvBRXjDZds9XX1ktHZ73E2Nqk3el7bGLQLSkcnsQhWt3MTVBY0ts5kBx781GL5GRaFgJuYZeBjV_sX90XNje4_c79xImdTfR1FBvAOa9qnt4n_OmXJ4pqj8fII_Kg4Z-QwAStmJKF_wOSBQQIBBgBkgUECAUYBIAHzriGOKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB0ggRCIDhgBAQARgAMgKqAjoCgEDyCA5iaWRkZXItMzA1NjQ0N4AKBMgLAdgTDdAVAYAXAbIXCAoGCAASABgA&sigh=oKAw2QQIJ0w&uach_m=[UACH]&pr=10:0.046119&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 06 Sep 2022 03:15:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3C94 143 B
163 B 23ms
23ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2191
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 06 Sep 2022 02:39:20 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 65F1 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 25c64049f0063d542686508b2047305fc3e24486bf63ebdcc07938ad13c2a14b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 65F1 28 KB
28 KB 42ms
14ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 20:36:54 GMT
x-content-type-options: nosniff
age: 455937
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Aug 2023 20:36:54 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame E56F 36 KB
16 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 06:14:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75683
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Sep 2023 06:14:28 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3C94
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

39ms
39ms

Document
text/html

2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
expires: Tue, 06 Sep 2022 03:15:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:51 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 65F1 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoRCAEqDWJhbm5lci1ub2xvZ28KCggCKgZzZXJ2ZXIKLwgEKitteXNpZGlhX2FuYWx5dGljc19leHAyLG15c2lkaWFfcmVsZWFzZV9wcm9kCg0QKyEAAAAAAAAkQDAECg0QAyEAAAA0M2NxQDAECg0QCiEAAABAZmYgQDAECg0QDSEAAAAAAAAAADAECgwQHioGNzI4eDkwMAQKDBAZKgY3Mjh4OTAwBAoNEA4hAAAAAKCZuT8wBAoNEAQhAAAAmpnxcUAwBAoNEA8hAAAAAAAAAAAwBAoNECshAAAAAAAANEAwBAoNEAUhAAAANDPzcUAwBAoNEBAhAAAAAACgtEAwBAoNEBEhAAAAAEBG2UAwBAoNEBIhAAAAAAAAHEAwBAoNEBMhAAAAAAAACEAwBAoNEBchAAAAAADQckAwBBIaQ1BpR3hPaVpfX2tDRllKSTVRb2RxMzhHMWciCnRleHQvbWFjYXcoAw==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/e2875713480840d8712332133311d4ea.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js Show response
pagead2.googlesyndication.com/bg/ Frame 018E 36 KB
16 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JRDtgcUl_7OUjJ4QO8bVbwNuRTRqDUxuSBYCwiPHS6U.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2510ed81c525ffb3948c9e103bc6d56f036e45346a0d4c6e481602c223c74ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 06:14:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75683
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15893
x-xss-protection: 0
last-modified: Mon, 29 Aug 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 05 Sep 2023 06:14:28 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 50ms
50ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022083001&jk=785618199491999&bg=!BAelB0PNAAZTikH4c4o7ACkAdvg8WpGsCfsjxnCCLnQ0E6sne6coFOOH3pfRRlG2gc1EAnjvzhYZWAIAAABBUgAAAAFoAQeZAp10LM3dZjUEZpqYGHy2elVlGUxWLtLwCzwlvCWuAQYnDZchhFSPwyztIvuWYaFmk0rN2SiLZCDsSC625N01RZ4B1gC_AROgU9vEB5mLqPeJBh1v_0eIXr9Lb_PoXwVXzTDGxuat4rTcbTIhTNX233_9rRgueibjedSVjZbjyWQyOsXn1aYOfwTR04o-2Y77jZ57nZ2iXIEO_-kTmRAvIze8k61Qjvz1UkCk7s_xKgLyCO3iKeI6YEuJQPf8iOn8GCmhQL38tsU7V57CUKIJaGxMCndy09Qma7CwnJbNCROTKhxwJm_LdTHTMdnIgT6lpYchMWt8kt5xU-TA-sI3ppFoXYs1ieBkQahUJ6Ref_PhzT3Ep7Q2Ylg_1aBuRYihwbiJ-HL4JOQQGIlvsyv0zS5v-FcNDXY674JsIzMvYYYLrud7GosYdxQJi5mKSyFkaAFkkA8QZf5y7ekEUbyx6tugRkmFV97rtmnoboPZiXXPzjnoPEsg9-ZijFotelbe6omTWczJBR82oLXm0_MaqrGjSwG9JhpNvwVJtM8sOsRACVVxmz_8x9DMui0t7jP1cQxpsb-xbqgFqxRQcJaCC3bbEslpQv3w7bT7-Q-nMlnTDurwZL-v3DxO-DbjfI6C15m6u36kjXQTMhoMCKlEKjrIm6KBAkKYgOyGRpL4s_w1FUU18h9r7n5wYDKB0MI7cHuBcv0VkiRCTfGhFPJOwkcUMcIlNIennb8Ie92bdl2Oi2Dm7sHVVqIKVS0KWUqFqjfb6w6cvdx1r4LOqLyldn3G220FtWXyKG9G13-qJ1KWx-1fmYnpteHAplq1RbbPTN9-9zUA-_OporzD59u6w9y3DvrXf3u_TwDun2k8op2ZbgnBEUXxGdGSeIMPWo0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 65F1 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoRCAEqDWJhbm5lci1ub2xvZ28KCggCKgZzZXJ2ZXIKLwgEKitteXNpZGlhX2FuYWx5dGljc19leHAyLG15c2lkaWFfcmVsZWFzZV9wcm9kCg0QFCEAAAAAMLL2QDAECg0QFSEAAAAAAAAuQDAECg0QFiEAAAAAAAAYQDAECg0QGCEAAAAAANB5QDAECg0QMiEAAAAAODPTPzAECg0QMyEAAAAAODPTPzAECg0QNCEAAAAAODPTPzAECg0QNSEAAAAAODPTPzAECg0QNiEAAAAAODPTPzAECg0QNyEAAAAAODPTPzAECg0QOCEAAAAANDPzPzAECg0QOSEAAAAAAAA5QDAECg0QOiEAAAAAAIA6QDAECg0QOyEAAACYmTlTQDAECg0QPCEAAACYmTlTQDAECg0QPSEAAACYmTlTQDAECg0QPiEAAACYmTlTQDAECg0QPyEAAACYmTlTQDAECg0QQCEAAACYmTlTQDAEEhpDUGlHeE9pWl9fa0NGWUpJNVFvZHEzOEcxZyIKdGV4dC9tYWNhdygD

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/e2875713480840d8712332133311d4ea.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 grumi.js Show response
rumcdn.geoedge.be/a8a9222e-ddf2-4976-b1fb-c79def449f45/ Frame 2407 328 KB
104 KB 73ms
9ms Script
text/javascript 2600:9000:2491:2a00:4:b37b:9440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rumcdn.geoedge.be/a8a9222e-ddf2-4976-b1fb-c79def449f45/grumi.js
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2491:2a00:4:b37b:9440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a21105019ff222f951651346fd1d1883726abae498d41bce3a45287c4b8785f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 02:43:10 GMT
content-encoding: br
last-modified: Tue, 06 Sep 2022 02:01:08 GMT
server: AmazonS3
age: 1963
etag: W/"46d6a1b936ccb0ab78d330ae9dcd3b83"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: HDcGnveYQDs28anV3T.y0ppAeD6gzIl0
via: 1.1 6e5ec1ef7875ec0751cb61200df7f212.cloudfront.net (CloudFront)
cache-control: public,max-age=3600,stale-while-revalidate=3600,immutable,must-revalidate
x-amz-cf-pop: FRA56-P7
content-type: text/javascript
x-amz-cf-id: 3Giowy2MzFjkr67y-ErzHWkD7DchhfK9pwrbnVA3RsPH1Ipjmuhx-A==

GET
H/1.1

200
OK

gcm
ads.creative-serving.com/ Frame 2407
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=platform161_direct_new&google_cm&google_sc
https://ads.creative-serving.com/gcm?google_gid=CAESEKOPNoUcmpfL9mZ7r1e9aKI&google_cver=1

43 B
220 B

9ms
9ms

Image
image/gif

3.121.93.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.creative-serving.com/gcm?google_gid=CAESEKOPNoUcmpfL9mZ7r1e9aKI&google_cver=1
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: HTTP/1.1
Server: 3.121.93.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-93-31.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:52 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.creative-serving.com/gcm?google_gid=CAESEKOPNoUcmpfL9mZ7r1e9aKI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 2407
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=4&user_id=933c3b54-d91e-43d6-8653-be2e3ff085d8&ssp=&expires=30&user_group=1&cb=43
https://pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=dedcc7c7-365c-4a8d-be24-02066c0593aa&expires=30

0
239 B

44ms
8ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=dedcc7c7-365c-4a8d-be24-02066c0593aa&expires=30
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Content-Type: image/gif

Redirect headers

Location: //pixel.rubiconproject.com/tap.php?v=15796&nid=2760&put=dedcc7c7-365c-4a8d-be24-02066c0593aa&expires=30
Date: Tue, 06 Sep 2022 03:15:52 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cm_nst
ads.creative-serving.com/ Frame 2407
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212282158
https://ads.creative-serving.com/cm_nst?cookie_id=219483204266000131964

43 B
220 B

9ms
8ms

Image
image/gif

3.121.93.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.creative-serving.com/cm_nst?cookie_id=219483204266000131964
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: HTTP/1.1
Server: 3.121.93.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-93-31.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:52 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
server: AAWebServer
location: https://ads.creative-serving.com/cm_nst?cookie_id=219483204266000131964
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

GET
H/1.1 200 1.gif
id5-sync.com/s/101/933c3b54-d91e-43d6-8653-be2e3ff085d8/ Frame 2407 43 B
1 KB 68ms
16ms Image
image/gif 141.95.98.67
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/s/101/933c3b54-d91e-43d6-8653-be2e3ff085d8/1.gif

Requested by

Host: pool-usw.creative-serving.com
URL: https://pool-usw.creative-serving.com/simp?buid=&guid=&ic=p3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8TQcj6U6rQr6Zn6WRD45fG3ulcgEi9-yUzEbH51cCMZATvPFS05uC4EdI0qtGXwVgzxI02LbWc2qFh7MxxcykJ6fHUMLk.2p7xlNajwLyLosIIxYO6HDHwIFER9G9Pn-vS6N...9b-M0IQeu9rnloRNyrXT47Xg0oDOAP0Rv5jhAf-1I9gApUjJVlUrJTJR0H5N5ibymu.pdrLkHzGyZfMTkkizleMLTvwa12BqTYAsLitxTt60tVlny7rs5oRu-wX8PqunsCcZxYq30.dOa.cBMWqFda9i0L0ZI23w2l9n2SC8PHynpSPq.cE7GkSuy8bKMaJ9dwq8rvZ.1totOeNFezYpEaVwOXiBu8T41lNaPPsFxlYdj71mig3FCypkNAZXrgT3JPenPer.JkmBrDKb9lfk3b-GRwchPQBIRCWFmpUG4UqYN0XuuKYSZ73dcvABUem9z4SMQvD3DS4IpLZpTqkGYN3RapmDWS8AtYDwIwHIbfiuwtrgffKLwOPXwmhf7z9IfjhPBB3e1kd7YhQ4OXvBcf5vF09oA4LE6jQjzWzp68p2Nhl-zwsuaXiuMcqkvYxgM8u4G6Lk8faGxyePr5k4CwxXjpeBUCbohRDXvwefQjWgclkIM-M0Acsl742JzA.x4LYbk-nq67FlFAM-lxKMM7PAlthhzfxv5-90h.XhF6VKxUwYZarqWZSrjIwO0x4LS6gZcCMhAiHajz5S71CAqbhl5AhSHiVN2j0BzFxIjQlI9dvSexqRvffFTSuhHOiTQ4XoQSb3uzPvjo5JOyVxHSeYyAjSiu9wwOI8phO7S753-nLH3ohDCakHPoeiIxRzPazR4UBti-Mg2c1R1NM.M0KJM7EjjTG.nuya7Nqjh3uI9AfqOn7nKxkS86EodgksBotFnMAgkxwTSnqPia4QMqT5oInGQF8WWqWKskEK0SyOzCiqZJqLi8rH2CN6c62JLnqU0pZNCrntAAeofIAKR569z7SAK5gYGSM3qBCVV7V2wWI71i1ei-b04f3.kj1CH-QraRyHauooRprVACI034BzxpHzMiF.278X5LrQ-LOdKOr9SKwl80JLEQOt-5OvvKpuSD1.MLuQw64X0AnH2W.4hM.ceLuenq8cqsXsv0mF-3G5IKetjJKKWKc1lsQ7tcWQlrMNAzhYIH9EIUPDRPFI-8caRvsCoSoZo2anS0nJRI7AkmCGDmLC73OZD4amrfwt5oQzez1skDoMcXtWy4ly.9hqJ4zUUZKA==&t=adj&ssp_click_url=&rd=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.67 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:51 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 2407
Redirect Chain

https://dpm.demdex.net/ibs:dpid=393426&dpuuid=933c3b54-d91e-43d6-8653-be2e3ff085d8
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=393426&dpuuid=933c3b54-d91e-43d6-8653-be2e3ff085d8

42 B
942 B

35ms
35ms

Image
image/gif

34.252.39.216
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=393426&dpuuid=933c3b54-d91e-43d6-8653-be2e3ff085d8

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/

Protocol

HTTP/1.1

Server

34.252.39.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-252-39-216.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v038-0081e3a6f.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: ryWpi7w9QuQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v038-09a34e9ee.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 1AfswR6LStA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=393426&dpuuid=933c3b54-d91e-43d6-8653-be2e3ff085d8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 2407 0
225 B 83ms
18ms Image
text/html 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDYmdGw9MjAxNjA=&piggybackCookie=933c3b54-d91e-43d6-8653-be2e3ff085d8
Requested by: Host: pool-usw.creative-serving.com
URL: https://pool-usw.creative-serving.com/simp?buid=&guid=&ic=p3tXK8yMAlgzUabgBz3BAA17URqwDwAW65BEl7xDGOPOgoPxSQH8zq9ztFbUntg30zw8wIzCOCZJXeSZIl6.T2T1nbPR8WcR4hH3AFfJXEWgEM0yB-3AHMrEBdeW.8mp9og8TQcj6U6rQr6Zn6WRD45fG3ulcgEi9-yUzEbH51cCMZATvPFS05uC4EdI0qtGXwVgzxI02LbWc2qFh7MxxcykJ6fHUMLk.2p7xlNajwLyLosIIxYO6HDHwIFER9G9Pn-vS6N...9b-M0IQeu9rnloRNyrXT47Xg0oDOAP0Rv5jhAf-1I9gApUjJVlUrJTJR0H5N5ibymu.pdrLkHzGyZfMTkkizleMLTvwa12BqTYAsLitxTt60tVlny7rs5oRu-wX8PqunsCcZxYq30.dOa.cBMWqFda9i0L0ZI23w2l9n2SC8PHynpSPq.cE7GkSuy8bKMaJ9dwq8rvZ.1totOeNFezYpEaVwOXiBu8T41lNaPPsFxlYdj71mig3FCypkNAZXrgT3JPenPer.JkmBrDKb9lfk3b-GRwchPQBIRCWFmpUG4UqYN0XuuKYSZ73dcvABUem9z4SMQvD3DS4IpLZpTqkGYN3RapmDWS8AtYDwIwHIbfiuwtrgffKLwOPXwmhf7z9IfjhPBB3e1kd7YhQ4OXvBcf5vF09oA4LE6jQjzWzp68p2Nhl-zwsuaXiuMcqkvYxgM8u4G6Lk8faGxyePr5k4CwxXjpeBUCbohRDXvwefQjWgclkIM-M0Acsl742JzA.x4LYbk-nq67FlFAM-lxKMM7PAlthhzfxv5-90h.XhF6VKxUwYZarqWZSrjIwO0x4LS6gZcCMhAiHajz5S71CAqbhl5AhSHiVN2j0BzFxIjQlI9dvSexqRvffFTSuhHOiTQ4XoQSb3uzPvjo5JOyVxHSeYyAjSiu9wwOI8phO7S753-nLH3ohDCakHPoeiIxRzPazR4UBti-Mg2c1R1NM.M0KJM7EjjTG.nuya7Nqjh3uI9AfqOn7nKxkS86EodgksBotFnMAgkxwTSnqPia4QMqT5oInGQF8WWqWKskEK0SyOzCiqZJqLi8rH2CN6c62JLnqU0pZNCrntAAeofIAKR569z7SAK5gYGSM3qBCVV7V2wWI71i1ei-b04f3.kj1CH-QraRyHauooRprVACI034BzxpHzMiF.278X5LrQ-LOdKOr9SKwl80JLEQOt-5OvvKpuSD1.MLuQw64X0AnH2W.4hM.ceLuenq8cqsXsv0mF-3G5IKetjJKKWKc1lsQ7tcWQlrMNAzhYIH9EIUPDRPFI-8caRvsCoSoZo2anS0nJRI7AkmCGDmLC73OZD4amrfwt5oQzez1skDoMcXtWy4ly.9hqJ4zUUZKA==&t=adj&ssp_click_url=&rd=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:52 GMT
content-encoding: gzip
server: nginx
cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-type: text/html; charset=utf-8

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ Frame 2407 48 KB
14 KB 52ms
13ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e85815908064ec7977f13468af609ac980317a21b5b519cfa107948cf76b8ce9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 06 Sep 2022 03:15:52 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 31 Aug 2022 11:00:45 GMT
server: cloudflare
age: 1019
etag: W/"b17c28d6fd88a6b12feea5c52e9a7485"
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-ray: 74640aea78d09b5e-FRA
x-amz-request-id: HRQ38KM5DBZV2DC4
x-amz-id-2: dsDVI8faOYy6oyRJY6wu7jliwz0n3Tky/FX2PmD63Xnhwsx8KiWUrLZAMhNgmC4cXpqv1Kh3ac0=

POST
H2 200 init Show response
gw.geoedge.be/api/ Frame 2407 0
96 B 303ms
94ms XHR
text/plain 52.87.19.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://gw.geoedge.be/api/init
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/a8a9222e-ddf2-4976-b1fb-c79def449f45/grumi.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 52.87.19.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-87-19-42.compute-1.amazonaws.com
Software: nginx/1.20.1 / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Tue, 06 Sep 2022 03:15:52 GMT
server: nginx/1.20.1
x-powered-by: Express
content-length: 0

GET
H2 200 banner Show response
analytics.fatmedia.io/ Frame E081 5 KB
2 KB 134ms
92ms Document
text/html 2001:4860:4802:32::15
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.fatmedia.io/banner?id=5fa951fbb7c3f4001322c5d9&l=5fa951ffb7c3f4001322c5dc&c=5fa951fbb7c3f4001322c5d0&desc=p161_300x250&pubid=bsw_fmx&ssp=bsw_fmx&pubdomain=wheregoes.com&clickUrl=https%3A%2F%2Fpool-usw.creative-serving.com%2Fclick3%2Fpl3.rc9UPpEkGuQzt4InazzVW0.OciiilOq9RoUAvyf-ugxkixNPLEv4nzwQJ4EgTawT87QodB7ZN0ObEbr7di0UqNNY6r9nXtOcWkZiDZL54iYOcouFL15ahqhkb4Q-aEINw3qGF8i7J7mWaL23LOKIv4gr2PCqkXPKfV1NMPaDSzXarKtL2xlyRZoLRnBXzgxDmC.n-EJu4r7JeMW0ulB1UxZPLsjN8Y-AJBeevgBClIJvalLSzGnWYNYuq0Zy3pDXSJWX-HlXwHJPMYuiR8PNd1Z2Ts8icp5jzObPEZq-miGCTAb-I8fra-iQr4b4PTrSfbZyMh0x7zBvdF5hZkGwwmRv-2WwnBgVirdEQ5U85e0cYIq6UaJvOV6qcGk-6TJKt5vF4F9HNI.8mw23h9Zeafp6BERyxnzpY5dhiEjlFd1vmwqT5NIisaFLY1vMGGe9TRSN6-byGhiC.6shWfuO2bRVo7OeT-irPnL9F62WafRZwF0e-AEYAG4vRKCiQU3Z6AT.9GhySVJhwasd6EYxo30iaPx2xpXF9.Dg.Falla1UP8fGqkvuPbFzYQoaanUW2O8wkrAw3TDeimnyXZwQYdbKbcKL443CI4ggzT-hkgvkAcJ0wBBjFCumbE1KN.MRnKMwEGa3ReGtfluLIiBFeDiULMlv2ik0qLuE6LopINySF7jhpXmsGkGbolxg.ELICuU8ltVau9xVW8ybsEfMu3KnfBpNtuJHnHxBIxIAQCQePfXUlW3ZEURBMUsgJsrzejw2RlakiiSV16FM7erBXqJ1IcKqdDDKY1BFPMQV0f5UORT7LrUQ5siRUba6DBoI8yvF6EG4eodNHJvyj4AFa7fcLQCKBYh6AwaU-GITskDT9gkHxSOMp6Hg6rRyApgb-bhnu0kmW8yuaF1tFo-3Kq6dW9CYuIhk.AYvE7g6tQwgeD42T2DDKsYj-tlRZxi1k2gZZBdrbh84FbyYwDfxD8u9hD6UneMxMhS05GvPjKBFIX7mZ5IfvzWjgbbqoEgUQWGEtkc9TESTvk2MjhDEhwZkyYg6kz9TiyzFQudlQLbOhLeM7kJhTnGKPlaIt0VQG3li.kDBThMZVKwlk9wUZOnpbYnBxxmZ8Ha1anA6yuN6qld5OuF9CXLvBqJwbNMUuBmabgzt0w1g.1Sy-rnWCYE3smP7TtvV7vhdfFA4DQFMETw9k.KUCbyBD1JneYt68j0Et9Zj-Q9aVzE7HC-xWK.WTEMPI8L.-I3TkcNIABBD3vw7-tRUYsCBzXBeiWfHItBrZBubm74zBzalhrCmP9MwrRATs6sVPL2NTD2l9.wzdba0wK9rTs.4i0NcaWmNst4DC-WnJ6NuAECjmT4e2B50AoZb28BbCusECTBKnTD9cjpxESRNXW2oFGW92RdhQGD1PJso%2F1%2F933c3b54-d91e-43d6-8653-be2e3ff085d8%2F%2F
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/a8a9222e-ddf2-4976-b1fb-c79def449f45/grumi.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::15 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend / Express
Resource Hash: 877381a35b0540fed7a8f3989e44777f67683d6c6e636598bc90e9ef0ef2db18

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 06 Sep 2022 03:15:52 GMT
etag: W/"133f-wxXfRhbrMEBHPJeYUS2+eh9XL5E"
expires: Tue, 06 Sep 2022 03:15:52 GMT
server: Google Frontend
vary: Accept-Encoding
x-backend-response: 27 ms
x-powered-by: Express

GET
H/1.1 200
OK sovrn_standalone_beacon.js Show response
ap.lijit.com/www/sovrn_beacon_standalone/ Frame 2407 12 KB
4 KB 162ms
161ms Script
text/javascript 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/www/sovrn_beacon_standalone/sovrn_standalone_beacon.js?iid=8128488
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/a8a9222e-ddf2-4976-b1fb-c79def449f45/grumi.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: f522106cb8eef17f67ab33bb623590773c6c58f65bfc805fff1f34a0abdf9c75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:52 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Mar 2020 17:51:39 GMT
Server: nginx
ETag: W/"5e628dab-2e98"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Cache-Control: max-age=604800, must-revalidate
Transfer-Encoding: chunked
X-Sovrn-Pod: ad_ap2sfo1
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
Access-Control-Allow-Credentials: true
Expires: Tue, 13 Sep 2022 03:15:52 GMT

GET
H/1.1 204
No Content containertag Show response
ap.lijit.com/ Frame 2407 0
89 B 323ms
162ms Script
text/plain 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/containertag?zoneId=995483&containerId=3&v=4&tid=a_995483_af06a3b3d55f4361a859b922c9f7da79&loc=https://wheregoes.com/trace/20224364602/&gdpr_flag=
Requested by: Host: rumcdn.geoedge.be
URL: https://rumcdn.geoedge.be/a8a9222e-ddf2-4976-b1fb-c79def449f45/grumi.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

X-Sovrn-Pod: ad_ap2sfo1
Date: Tue, 06 Sep 2022 03:15:52 GMT

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ Frame 2407 33 B
327 B 54ms
14ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lb.eu-1-id5-sync.com/lb/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.138.119 , France, ASN16276 (OVH, FR),
Reverse DNS: ns31533570.ip-162-19-138.eu
Software: /
Resource Hash: c83b2b22008593dcf7dfb48d3b88d909d931caf4089210c8e6fa300d02335d84

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Tue, 06 Sep 2022 03:15:51 GMT
transfer-encoding: chunked
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H/1.1 200 101.json Show response
id5-sync.com/g/v2/ Frame 2407 216 B
623 B 17ms
17ms XHR
application/json 141.95.98.67
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/101.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.67 , France, ASN16276 (OVH, FR),

Reverse DNS

ns3216533.ip-141-95-98.eu

Software

Resource Hash

563cbf932d2167a73f2c6648502ee92e70b9249b940a6b87fd4b56be0dae9c33

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://wheregoes.com
date: Tue, 06 Sep 2022 03:15:51 GMT
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK id5_m
pool-usw.creative-serving.com/ Frame 2407 43 B
220 B 158ms
158ms Image
image/gif 52.9.77.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pool-usw.creative-serving.com/id5_m?mongo_uuid=8653be2e3ff085d8&id5id=0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20224364602/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.9.77.73 San Jose, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-9-77-73.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:52 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F88E 42 B
64 B 78ms
50ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssZJZvNjF2N3bazeoegW5R7w7BT4K_-6WPDOkleBxYauBUWKTkbRbzny5zJCfJGx7soHyC1_EXysLgxI218K5hog4h58Ajo0-6uFXjJYvpxTTwmRN2TvSh36QoZ9DECmIsvJPE-mSrLJn-Sd0ZN8KfJx0498znOAboZGlOrBasK7bt_2DkaYLPADQWXUiSmj-TIiKZY35nAKQ7s-yzNYIr-yxxlgAzQbH8LqYwlMHoLXBBS0JeT6v8oaeeOwPwNGS-eNxnB62WqEFojs9Er68GdK3shc3ybD4OSOOULONY5qRlOKiZ4gY7Kyv-B2zbIMzLa0v0-QAnXMWB8ijGGn26ei_oDwjXAv1ggTWH2jQ&sai=AMfl-YTWQBLaY77kEFCWsshoRudmSaNo9C-7BJS1AFyR-duwwoJrBoXJ1VjoB_-jdQIDlTFiAIE_5kigl0WH_oWXXrbI7VCRTLqPYTq4QdRFeSLXgg79vSiwPVqxiM4pCBBbDw&sig=Cg0ArKJSzGpAivlxhXjrEAE&id=lidar2&mcvt=1000&p=474,436,564,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220831&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662434151104&rpt=193&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 5895 0
839 B 7ms
7ms Ping
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F&e=wqT_3QKTBugTAwAAAwDWAAUBCOb22pgGELPH06iXt4-gRBgAKjYJP_89eO3Spj8Rb38uGjIeoT8ZAAAA4FG45j8hbw0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreLHZBYABAYoBA1VTRJIBAQb0jwKYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQzNjQ2MDIvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1ELVFaYkJxZ3JubnJRY1NNb2l4bUQtaDF6cVcwdGU2UmFvNng5U0hPTEJnblppNUlPWU50cy1pS2xWZktKNnpSZmMycXZaOWw5Q0pvdC1tUURxUnFVU1lfcUxSZyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM0OTE3OTk4NjU5ODMxMTI5MDExIgg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdOxv9HTutbTW8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbVE-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDExNzA0MzcwNDM3NLoHDwgAEAAYACAAMAA4ugZAAMgHsdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfC_AOKCAIQAJUIAACAP5gIAQ..&s=8c7d7e5e9dbc1c27082468cd1574bba50af6c440&type=pv&jm=1003&px=436&py=474&bw=728&bh=90&sf=1&sid=4068013851354147938&vd=ct~0|rr~5&sv=227&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/227/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:52 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: fbe8aef2-0847-41d5-9b81-5310da0d1697
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

img300x250wdjawinkategorie-1649059990393.jpg
a1.awin1.com/ads/awin/18692/ Frame E081
Redirect Chain

https://www.awin1.com/cshow.php?s=2679424&v=18692&q=383790&r=500221
https://ui2.awin.com/ads/awin/18692/img300x250wdjawinkategorie-1649059990393.jpg
https://a1.awin1.com/ads/awin/18692/img300x250wdjawinkategorie-1649059990393.jpg

75 KB
75 KB

34ms
8ms

Image
image/jpeg

18.66.97.65
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a1.awin1.com/ads/awin/18692/img300x250wdjawinkategorie-1649059990393.jpg
Requested by: Host: analytics.fatmedia.io
URL: https://analytics.fatmedia.io/banner?id=5fa951fbb7c3f4001322c5d9&l=5fa951ffb7c3f4001322c5dc&c=5fa951fbb7c3f4001322c5d0&desc=p161_300x250&pubid=bsw_fmx&ssp=bsw_fmx&pubdomain=wheregoes.com&clickUrl=https%3A%2F%2Fpool-usw.creative-serving.com%2Fclick3%2Fpl3.rc9UPpEkGuQzt4InazzVW0.OciiilOq9RoUAvyf-ugxkixNPLEv4nzwQJ4EgTawT87QodB7ZN0ObEbr7di0UqNNY6r9nXtOcWkZiDZL54iYOcouFL15ahqhkb4Q-aEINw3qGF8i7J7mWaL23LOKIv4gr2PCqkXPKfV1NMPaDSzXarKtL2xlyRZoLRnBXzgxDmC.n-EJu4r7JeMW0ulB1UxZPLsjN8Y-AJBeevgBClIJvalLSzGnWYNYuq0Zy3pDXSJWX-HlXwHJPMYuiR8PNd1Z2Ts8icp5jzObPEZq-miGCTAb-I8fra-iQr4b4PTrSfbZyMh0x7zBvdF5hZkGwwmRv-2WwnBgVirdEQ5U85e0cYIq6UaJvOV6qcGk-6TJKt5vF4F9HNI.8mw23h9Zeafp6BERyxnzpY5dhiEjlFd1vmwqT5NIisaFLY1vMGGe9TRSN6-byGhiC.6shWfuO2bRVo7OeT-irPnL9F62WafRZwF0e-AEYAG4vRKCiQU3Z6AT.9GhySVJhwasd6EYxo30iaPx2xpXF9.Dg.Falla1UP8fGqkvuPbFzYQoaanUW2O8wkrAw3TDeimnyXZwQYdbKbcKL443CI4ggzT-hkgvkAcJ0wBBjFCumbE1KN.MRnKMwEGa3ReGtfluLIiBFeDiULMlv2ik0qLuE6LopINySF7jhpXmsGkGbolxg.ELICuU8ltVau9xVW8ybsEfMu3KnfBpNtuJHnHxBIxIAQCQePfXUlW3ZEURBMUsgJsrzejw2RlakiiSV16FM7erBXqJ1IcKqdDDKY1BFPMQV0f5UORT7LrUQ5siRUba6DBoI8yvF6EG4eodNHJvyj4AFa7fcLQCKBYh6AwaU-GITskDT9gkHxSOMp6Hg6rRyApgb-bhnu0kmW8yuaF1tFo-3Kq6dW9CYuIhk.AYvE7g6tQwgeD42T2DDKsYj-tlRZxi1k2gZZBdrbh84FbyYwDfxD8u9hD6UneMxMhS05GvPjKBFIX7mZ5IfvzWjgbbqoEgUQWGEtkc9TESTvk2MjhDEhwZkyYg6kz9TiyzFQudlQLbOhLeM7kJhTnGKPlaIt0VQG3li.kDBThMZVKwlk9wUZOnpbYnBxxmZ8Ha1anA6yuN6qld5OuF9CXLvBqJwbNMUuBmabgzt0w1g.1Sy-rnWCYE3smP7TtvV7vhdfFA4DQFMETw9k.KUCbyBD1JneYt68j0Et9Zj-Q9aVzE7HC-xWK.WTEMPI8L.-I3TkcNIABBD3vw7-tRUYsCBzXBeiWfHItBrZBubm74zBzalhrCmP9MwrRATs6sVPL2NTD2l9.wzdba0wK9rTs.4i0NcaWmNst4DC-WnJ6NuAECjmT4e2B50AoZb28BbCusECTBKnTD9cjpxESRNXW2oFGW92RdhQGD1PJso%2F1%2F933c3b54-d91e-43d6-8653-be2e3ff085d8%2F%2F
Protocol: H2
Server: 18.66.97.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-65.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 509f8eedfc9467822d611368534f9f6fce9d1de8f5f58cc500404a5c190573ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://analytics.fatmedia.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: 0mUeGpG2Pf3O.G_E5evjvQ5PWy1RzTdE
via: 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront)
etag: "08c62fe2a228c40ea94d11f61a59894a"
last-modified: Thu, 30 Jun 2022 07:57:05 GMT
server: AmazonS3
age: 79380
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=43200
date: Mon, 05 Sep 2022 05:14:00 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 76326
x-amz-cf-id: EmNLfcOK06W8hznY6Jx61WPIv8zeWjUHt0caGdhEp-DQ4f0h7_Rl4w==

Redirect headers

location: https://a1.awin1.com/ads/awin/18692/img300x250wdjawinkategorie-1649059990393.jpg
date: Tue, 06 Sep 2022 03:15:52 GMT
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 95F1 42 B
64 B 51ms
51ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvk_vyQAUUyoOvTaJTUQUXGQIHXhxMn-sqgEckIAF2_NdIbWhVEgbBjyjK_n3LLtJlWWWtsp3FaFg-unbvB24DIsF_QS4rYgBREcM_YeBtZuRaSiwcZupbuu2ZR33khgpf5GJVe7Jhy9cta9mXsSRS8n_spk1rfu9ww7lM9EIgxcGN4a2QKqsTGEKNSFMQbVtXohFhGOkJaDf3A0O3Do_X4YtUB04lE9zaWu_-_2C0NX5f0_1nQDkh26ta1tMLAkSZv8_Cy4lnsa4mhMF-jEyRnzYwnJtzNRuX3n5b5SdnWUzG90RDMlGj6hKvf7ZsCPFLNBkt01EHPFNoehY6hm53J1Gn--IXbiVVKx1xXQwmRyAiZhE21&sai=AMfl-YRTgKeP8a1rUaGqi1-i6WmfuIXdjPlxPCa_Kuo_FXBOCUZNeh5v9JtZMYLLKoR4GCKbrN-DZJ59elfyMmkbgHqr6-84vG20g2FoThfZgFWcM4JLZSQXNXX971GTb6-YxQ&sig=Cg0ArKJSzKMRr3XM0uJrEAE&id=lidar2&mcvt=1000&p=1127,276,1217,1004&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220831&bin=7&avms=nio&bs=0,0&mc=0.81&if=1&vu=1&app=0&itpl=19&adk=3878002045&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662434151130&rpt=288&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://90dd5502202c6ccd26043b108254149c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E3E8 0
747 B 7ms
6ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:52 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 03b25844-ae64-44d5-b517-16a7835aaebd
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 23DE 0
0 51ms
51ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstnWH1r7U_vWTc6LVlF6IEEpJoSUFFtVoLNA5cdYccNUmh8gg8CCvDdYqvV7idZUICUcj4rTy_yIkROhSbOpoKdPetCuf3XklpW0dNKyXfvcAD4yXKAlGq92Cpi-_Z91wxK7B9c6UhgQsJpsjVfHfO5_dwZ4KkVfmeJuwF5GbwXs87z4St_M4bcWxtZBBUxM8KVfhdeclHQU3SRvrcQenEM8hB7KAIfoVlrDzBxluIjaVRIcvK1OBe4GITlSBZmmtHzEiMBgfAHwyTFYa00zWWUEmsiR5L_x6oBICufH_6yLXph0Vf1ZvLa6XzzBuAuS5Fy9jHf8dH3BQrHtb9OW7wMft6JsQ&sai=AMfl-YRiSqRzH0MWYV5DR4RLRj9wJG9UuL7caPNyeXl7lAHepaoMtYg8e2-8el6BjaRtRNqKgncmaZQo_IPaMnoCgncvsNrYTXQpIy13ntzuqsIDFCYAsawz4siULpVIIJ9NrQ&sig=Cg0ArKJSzLHjNKmiMLgBEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 06 Sep 2022 03:15:52 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 06 Sep 2022 03:15:52 GMT

GET beacon
vpod1q.qa.lijit.com/ Frame A5B3 0
0

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 6252 0
843 B 7ms
7ms Ping
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKsC_BMrAUAAAMA1gAFAQjn9tqYBhCQxMS33M7flkoYjvLP54i57KseKjYJfs1y2eicpz8RHhoWo661oT8ZAAAAwB6F6z8hHhoWo661oT8pfc0JJNAxAAAAgD0Ktz8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXjD1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGpBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0uwREQUtBT2pzdjFjRmdxNXZjdVA2b1dyN1FjS3F4a2Q4OGcyUTdCR2JqTm9ZT0xtYzdoei13RmRKQ2NSYTVqWHhpT0dyU2h4cnBBeUNrQ0NNNFc5Tkg5ekVSWnR6VEIteDNJd3BvbXYxZ3RULTZWLTRveEw2dU9mMktmT2pvcThXRDVBUnY1eHBDNmRzUE12SjI4WXF4OTdWWmJpaHBxMnc5WW80aDBYemQxczVWNHpUTlB5NU1RcUJpcFllWFZFS1pMMnVpR2d3dFRMT1ZuN2RZZjh1Q3NaQVdvNmdnc2dmaU0yOXJUeDNIWklhTUFNMUItdGxScGN2aDFZdDdmRGF5VHpjYVBXOUZFd0d1TGlGNUxmOHVoWjFRNFZ3ZmlRcWFINTA5cnhrOU5pX2QtMnphWVdRaU1SUzdXbXRvZTlXaExqWU1zUkxiWmFib0sybFh2SEZTb2lHWW9nWTRDSE04MlBNUEFRejdhSkElMjUyNnNhaSUyNTNEQU1mbC1ZUVZSZ3VTcEtTVk13TlZobjBlcDBUSHVTcUFsSm1VSmN3bEJvWDg1dnR2dHFkMU5FSHZycUpnRVVtTWZaWVVMVUJLdFVmMDZXaHd2b3B2dXlOMlFncF84M3BOU1dSWE00MG1lUnlvbFRzTVBjbUlUSHZTQ1k3OTg2YVRvYVFXUFElMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TGlFN25yUTRWaEdFQUUlMjUyNmZic19hZWlkJTI1M0QlMjU1Qmd3X2Zic2FlaWQlMjU1RCUyNTI2dXJsZml4JTI1M0QxJTI1MjZhZHVybCUyNTNE8AEA2AIA4AKf8D_qAhZodHRwczovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1BQm04Q09NWS1jUGlCN1ZDTVdueTRiSE0zaVhCR0pCM0I4RExzQlZzYzc0MUlCYW9yVjNkVWExSk1BQkFEci1UZ3BEMFZLUmJKNmJfc0JrT0NaaE9EaEt5YmNIZyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM1MzQ1MDY3Mzc3MDcyNjExODU2Igg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQPMTc4LjE2Mi4yMDkuMTM0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBf-Uus_X8tyfesAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBbzgG_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzcxODEzMDE4MDW6Bw8IABAAGAAgADAAOLoGQADIB8PWBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHwvwDiggCEACVCAAAgD-YCAE.&s=14154b96e4147618b97b8fc9a145a6bbe46e8dec&type=pv&jm=1003&px=0&py=0&bw=728&bh=90&sf=0.81&sid=6308979721398473639&vd=ct~0|rr~5&sv=227&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/227/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:52 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a5692d52-8abe-4971-a00a-0dd49ad071cb
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E1DB 0
747 B 6ms
6ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:52 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1c287b2b-969d-456b-8dca-580c8f0b33ba
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 publishertag.prebid.123.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 53ms
17ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.123.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:52 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 11:21:03 GMT
server: nginx
etag: W/"6271101f-15b58"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 07 Sep 2022 03:15:52 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0351 42 B
64 B 56ms
55ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstxurl_mZBUa69X4Vkd5ykYHSHsPjMywNDKFeMzKU9onS9ySafVQZvkZwnQ71CbpzxIp_81WAHnY3g5Cjd4ZZQl0_4La6_oeZQcWfITrZnfQTkf7wMTjmKYjeYtmn4S1X4fCYAxiw&sig=Cg0ArKJSzHjALlK42IPDEAE&cid=CAASF-Ro-lGiQU9mzooea2RwexGRHEIbo4x5&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220831&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662434151155&rpt=608&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 71BE 15 KB
6 KB 14ms
14ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

96250b0de15d90f6e2e2ee39329e3060c7bc4a15e69cb6933039664f024f7efd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:52 GMT
server: Kestrel
server-processing-duration-in-ticks: 852814
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 49ms
24ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

d91c38797a4f40c02b517763adb6b8d25ca0d0af244856025ecc3543b8540679

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:52 GMT
content-encoding: gzip
last-modified: Tue, 23 Aug 2022 00:22:08 GMT
server: nginx
etag: W/"63041db0-15cdc"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 07 Sep 2022 03:15:52 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 65F1 42 B
64 B 55ms
54ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstfqihgeKd7vY1wwu_TH1qkAzUy5TRWStTX_ZGU1ntCpfuLeLj32Z5MVfRXju1K6XCPwKgitvbunIGq58qc6irkbuABW9_8Peh-2rmh2wkfbpSPMNBTPjesp7cNcoCA8ujcnGjSSQ&sig=Cg0ArKJSzCgb79N7NQCUEAE&cid=CAASF-Ro2ms9Ct20GTEMl0FCo3GuqM0kYxNh&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20220831&bin=7&avms=nio&bs=0,0&mc=0.81&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662434151442&rpt=413&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 71BE
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=9O3MHXxMSUxVbzhnbGtTWSsrV2t2VzQxTXVtUVVyZU55eFlmNHkyN3l3SGNydnhOUjVuN2lMM2tvd2htS0doam9YZkJwSSs1QVd3cndicEJ3M1d4TEdnYmRqSkxnRXRjZ25LazBPbmhTVUFTb3BFek9WNXBicUs5YThLaG...

433 B
657 B

51ms
16ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=9O3MHXxMSUxVbzhnbGtTWSsrV2t2VzQxTXVtUVVyZU55eFlmNHkyN3l3SGNydnhOUjVuN2lMM2tvd2htS0doam9YZkJwSSs1QVd3cndicEJ3M1d4TEdnYmRqSkxnRXRjZ25LazBPbmhTVUFTb3BFek9WNXBicUs5YThLaGw0ZnBQUERKUVpnWEltMlZ4OEpWbHFLb2Q0VFB5VGdnRlRzQUhGYmtzYUlQeDJyR2psbGhnc3JwWm9TN3JaRnNDcnVtM2IybU0zeHFaZC9GQmltd2NmenYzL2Z5VFFqVUdoL3A1VnM0b3ZRZWYxSzV4aGpXWHR1akw3ajQ5SkQrellBa2cvN0xDOFRHb2xCRERMaFMzV0VDaVRmMFN4Zz09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4dd232d8efbefd6afdced0f189e228e6b215f93518425a0c9ebd1583a79fed38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1989737
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:52 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
location: https://mug.criteo.com/sid?cpp=9O3MHXxMSUxVbzhnbGtTWSsrV2t2VzQxTXVtUVVyZU55eFlmNHkyN3l3SGNydnhOUjVuN2lMM2tvd2htS0doam9YZkJwSSs1QVd3cndicEJ3M1d4TEdnYmRqSkxnRXRjZ25LazBPbmhTVUFTb3BFek9WNXBicUs5YThLaGw0ZnBQUERKUVpnWEltMlZ4OEpWbHFLb2Q0VFB5VGdnRlRzQUhGYmtzYUlQeDJyR2psbGhnc3JwWm9TN3JaRnNDcnVtM2IybU0zeHFaZC9GQmltd2NmenYzL2Z5VFFqVUdoL3A1VnM0b3ZRZWYxSzV4aGpXWHR1akw3ajQ5SkQrellBa2cvN0xDOFRHb2xCRERMaFMzV0VDaVRmMFN4Zz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 527143
content-length: 0
expires: 0

GET
H/1.1 200
OK ct
ap.lijit.com/data/error/ Frame 2407 0
100 B 160ms
160ms Image
text/plain 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/data/error/ct?zoneid=995483&tid=a_995483_af06a3b3d55f4361a859b922c9f7da79&msg=Fire%20Tags%20Not%20Called&stack=Error%0A%20%20%20%20at%20https%3A%2F%2Fvap2sfo1.lijit.com%2Fres%2Fsovrn.containertag.new.min.js%3Fcid%3D3%26zid%3D995483%26v%3D4%26tid%3Da_995483_af06a3b3d55f4361a859b922c9f7da79%26gdpr_flag%3D%26loc%3Dhttps%253A%252F%252Fwheregoes.com%252Ftrace%252F20224364602%252F%3A61%3A285
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Connection: close
X-Sovrn-Pod: ad_ap2sfo1
Date: Tue, 06 Sep 2022 03:15:53 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 23DE 42 B
64 B 50ms
50ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssT7Q_yFuuk3ONlazbeVUI0sVvFez1d8CN8HZX8586BQEMNT2Sd4GZyXHeoho06L_rqSz5lTY03ZY_n2uCe6KR0krRqzIAm7B3PMspCq8xy6_ALD8Glyk49U1SCpjmEz4ABSXY2GkMrpK6wr8DfX5wrmJTz7KscTwYCWdgpm_0NAhpnn2Tadv6H8B4_JM61oRzfWPrNTJxSbcQ9RjMvvlZyjsOgqtqsWZmJht2IgAdbENMlL5iPQ7dnniOMySS3UTJ8ZjaLa8V98OQyJt4g42oHhQIkjshq9gQ4GS4iGsURG-eraI8vYdg9DEaoJc_Jh9WqqG7a2koh6R5LkDPFFtzz42WKvjedFL4szw&sai=AMfl-YRavw-kqXGmcnURUgAGXApX8AvpcjYyGs-GCXPO0Y-In5nSQwS6t8dHnT_oZ63sJ0K6DGWfcWaO37OrqMcDMmSvtQNZCsRkEEb48-8EL52p5vFFmoZ11_aWEYhcrqGvUA&sig=Cg0ArKJSzCrhSRVrKeHjEAE&id=lidar2&mcvt=1000&p=666,1091,916,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220831&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1662434151114&rpt=1391&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame 6193 0
0 158ms
158ms Document
text/plain 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Tue, 06 Sep 2022 03:15:53 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2sfo1

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame AEA6 52 KB
17 KB 7ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 80834
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 06 Sep 2022 03:15:53 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 31 Aug 2022 04:48:29 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2, 629239
X-Served-By: cache-lga21953-LGA, cache-fra19165-FRA
X-Timer: S1662434154.913039,VS0,VE0

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 59CA 9 KB
4 KB 34ms
7ms Document
text/html 13.32.99.50
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.50 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-50.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7efdca1ce8a8ee4fb50887d9f88bdace1026e0f76ea1e64a802b97402d825a79

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 80692
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Tue, 06 Sep 2022 00:05:29 GMT
etag: W/"3b058e9cd661ca6990301a82cf5d448f"
last-modified: Wed, 17 Aug 2022 23:23:08 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 d262e104d5d9dd6a4a52f090bdf9395c.cloudfront.net (CloudFront)
x-amz-cf-id: YbX-ept1BWADJm1ekUp1kuLbBEmC72q1ZgR3s2ULQrUMUaNn_JJYCw==
x-amz-cf-pop: FRA60-P3
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:049b4e88-3480-44ce-bc71-9207efe847a1
x-amz-meta-codebuild-content-md5: 77e8f986028c7819a018b65a51e4d1c5
x-amz-meta-codebuild-content-sha256: 4cf0411e60b9185dacd3ae0196e3adabe45eed1b64ea27e89ed58c43c33d4297
x-cache: Hit from cloudfront

GET
H2 204 /
onetag-sys.com/usync/ Frame D5B9 0
0 15ms
15ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1662434150315

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 8A5D 281 B
573 B 41ms
7ms Document
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Sep 2022 03:15:53 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Unused62: 8096267
Vary: Accept-Encoding

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame 5331 258 B
495 B 104ms
104ms Document
text/html 34.224.253.29
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1662434150645&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.253.29 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-253-29.compute-1.amazonaws.com
Software: / Express
Resource Hash: cb8223f111e367f49b7019c6cf9a53e2c6c9452173430bccb0d418716c51ac75

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
content-length: 258
content-type: text/html; charset=utf-8
date: Tue, 06 Sep 2022 03:15:53 GMT
etag: W/"102-CBNc/zjNheMos7etqW45cPnlvVs"
expires: -1
pragma: no-cache
vary: Origin
x-powered-by: Express

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 1B68 23 KB
8 KB 43ms
20ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C359%2C97%2C55%2C99%2C3012%2C3011%2C3010%2C244%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C294%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C336%2C3014%2C337%2C338%2C339%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1662433800000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

2ea2aa3b1a9b047d36a0fb8450a75c34697113a1856f7f843ee12cbe21ddb2d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8335
content-type: text/html; charset=UTF-8
date: Tue, 06 Sep 2022 03:15:53 GMT
expires: Thu, 08 Sep 2022 03:15:53 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame AEA6 0
747 B 7ms
6ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:53 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7fe63bf4-137c-494e-b667-c215b4b16908
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 38C8 15 KB
6 KB 30ms
7ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=55153
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 06 Sep 2022 03:15:53 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 06 Sep 2022 18:35:06 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame DCB4 4 KB
2 KB 110ms
31ms Document
text/html 34.248.206.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.206.77 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-206-77.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3d0716235cf2777a1a128b12284686f4da68ec7851317f52b42f1a81f0011363

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 06 Sep 2022 03:15:54 GMT
etag: W/"087e15dd1182fcbc6752e3ee8ef8a4d34"
server: nginx
timing-allow-origin: *

GET
H2 204 /
onetag-sys.com/usync/ Frame C310 0
0 15ms
15ms Document
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame DF08 802 B
1 KB 98ms
18ms Document
text/html 185.86.137.108
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.108 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: d72e2f79fc0e22e1e41767906530c30068966d4f975e1dc44b8ac9c0391d9531

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 802
content-type: text/html
date: Tue, 06 Sep 2022 03:15:53 GMT

GET
H2

200

usermatch Show response
r.casalemedia.com/ Frame EE4E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
2 KB

98ms
47ms

Document
text/html

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ca5a610cfbb83e9071cb176230f26c72685125ca002a0ef7f77c28dbd825157

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 74640af72caab96f-AMS
content-encoding: br
content-type: text/html
date: Tue, 06 Sep 2022 03:15:54 GMT
dropped-udsids: 230|241|45|39|51|218|152|46
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=99o8F3DODw%2B49ijbJKxG1zPi3qEQSDOOI1iRqGZ%2F4BFR2TU1Xs2JiaAJoDS40SXkNEgAZnYgWFELneD%2FiEQ3ePLD%2BaRjXUde6LCm4yrbxubycu3WP4DA9t0Ae2oV6ZpZrYxj"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 74640af6995c0095-AMS
content-type: text/html; charset=iso-8859-1
date: Tue, 06 Sep 2022 03:15:54 GMT
expires: 0
location: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BLmrwkoXblwSIlGkQOFFJKFFTeOjMpkv%2FjYNJxestzWyiYUWtPNyVO2bSK1MVASomnu8WCwbydkyyD3GzSRHmfVqpN%2BvR8O%2BgZaObK7vH8VJ09uL7ZdRSlDhaI%2BgpNhsPM21Z2SM6wW5AQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame CFEE
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
573 B

7ms
7ms

Document
text/html

23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Sep 2022 03:15:53 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Unused62: 8096267
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 06 Sep 2022 03:15:53 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 59CA 0
239 B 8ms
7ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Content-Type: image/gif

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=2186411619028039950

0
344 B

32ms
32ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=2186411619028039950
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:53 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:53 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 816fae86-afac-44ba-be98-cfc73851e03e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=2186411619028039950
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=FRMjtRZH8kxoUmq5Q3GLpnIG

0
350 B

33ms
32ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=FRMjtRZH8kxoUmq5Q3GLpnIG
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:53 GMT
pod: X-Sovrn-Pod: ad_ap5ams1
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://ads.servenobid.com/sync?pid=310&uid=FRMjtRZH8kxoUmq5Q3GLpnIG
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
content-length: 0
expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 59CA 0
277 B 270ms
164ms Image
text/plain 209.191.163.208
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.191.163.208 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 06 Sep 2022 03:15:54 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2sfo1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H/1.1 404
Not Found getuid
x.yieldlift.com/ Frame 59CA 0
0 407ms
96ms Image
text/plain 52.71.232.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.232.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-232-26.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://ads.servenobid.com/sync?pid=321&uid=OPTOUT

0
336 B

32ms
32ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=OPTOUT
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=321&uid=OPTOUT
pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
etag: OPTOUT
content-type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5109685624192571350

0
344 B

32ms
32ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5109685624192571350
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5109685624192571350
Date: Tue, 06 Sep 2022 03:15:54 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 59CA 0
498 B 407ms
98ms Image
text/plain 69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-26
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=d64b55ef-5f3a-4561-9e36-ecd763873cca&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
357 B

32ms
32ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=d64b55ef-5f3a-4561-9e36-ecd763873cca&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=d64b55ef-5f3a-4561-9e36-ecd763873cca&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Tue, 06 Sep 2022 03:15:53 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-H5pmTvNE2uE7H0yMj7FzYCR.BaAP7VVdCeT8xYg-~A

0
367 B

33ms
33ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-H5pmTvNE2uE7H0yMj7FzYCR.BaAP7VVdCeT8xYg-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-H5pmTvNE2uE7H0yMj7FzYCR.BaAP7VVdCeT8xYg-~A
date: Tue, 06 Sep 2022 03:15:54 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

us
sync.go.sonobi.com/ Frame 59CA
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS1mZmM2YzJmNS0yMThjLTMwZjYtYWE4Ny00NThiMGQ0MWE0YTkqU2h0dHBzOi8vYWRzLnNlcnZlbm9...

0
498 B

119ms
97ms

Image
text/plain

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS1mZmM2YzJmNS0yMThjLTMwZjYtYWE4Ny00NThiMGQ0MWE0YTkqU2h0dHBzOi8vYWRzLnNlcnZlbm9iaWQuY29tL3N5bmM_cGlkPTM0NiZ1aWQ9dWEtZmZjNmMyZjUtMjE4Yy0zMGY2LWFhODctNDU4YjBkNDFhNGE5MgISBjgB

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-25
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS1mZmM2YzJmNS0yMThjLTMwZjYtYWE4Ny00NThiMGQ0MWE0YTkqU2h0dHBzOi8vYWRzLnNlcnZlbm9iaWQuY29tL3N5bmM_cGlkPTM0NiZ1aWQ9dWEtZmZjNmMyZjUtMjE4Yy0zMGY2LWFhODctNDU4YjBkNDFhNGE5MgISBjgB
pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cache-control: no-store
content-length: 0
vary: origin
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 59CA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ups.analytics.yahoo.com/ups/58632/occ?verify=true
https://ads.servenobid.com/sync?pid=339&uid=y-H5pmTvNE2uE7H0yMj7FzYCR.BaAP7VVdCeT8xYg-~A

0
367 B

32ms
32ms

Image
image/avif

52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-H5pmTvNE2uE7H0yMj7FzYCR.BaAP7VVdCeT8xYg-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-H5pmTvNE2uE7H0yMj7FzYCR.BaAP7VVdCeT8xYg-~A
date: Tue, 06 Sep 2022 03:15:54 GMT
server: ATS/9.1.10.25
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 8A5D 31 KB
10 KB 7ms
7ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c65209840749be7df4eb7f2c6d291d39d51594aa86afaf30e550d2cb2b3d1368

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Aug 2022 20:46:19 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=39786
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9378
Expires: Tue, 06 Sep 2022 14:18:59 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 38C8 0
42 B 60ms
13ms Script
text/plain 198.47.127.19
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=27127763&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:53 GMT
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame CFEE 31 KB
10 KB 7ms
7ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c65209840749be7df4eb7f2c6d291d39d51594aa86afaf30e550d2cb2b3d1368

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Aug 2022 20:46:19 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=39785
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9378
Expires: Tue, 06 Sep 2022 14:18:59 GMT

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame 5331 2 KB
1 KB 62ms
22ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1662434150645&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 26 Aug 2022 17:37:48 GMT
server: cloudflare
age: 6095
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 74640af6ef7db960-AMS
content-length: 1168
expires: Tue, 06 Sep 2022 05:15:54 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 5331 70 B
264 B 109ms
34ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1662434150645&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 204
No Content sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame CFEE 0
239 B 430ms
100ms Image
image/gif 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=duration_media&khaos=L7PMDBY3-17-2DRG
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Content-Type: image/gif

GET
H2 200 sync
ads.servenobid.com/ Frame DF08 0
344 B 33ms
33ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=8611217143155106663&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

redir
rtb-csync.smartadserver.com/ Frame DF08
Redirect Chain

https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=&_bee_ppp=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADsVU7GLXcAAA9_bAu5SQ&gdpr=0

43 B
452 B

17ms
17ms

Image
image/gif

185.86.139.57
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADsVU7GLXcAAA9_bAu5SQ&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.57 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:53 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADsVU7GLXcAAA9_bAu5SQ&gdpr=0
Date: Tue, 06 Sep 2022 03:15:54 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2 204 /
s.ad.smaato.net/c/ Frame DF08 0
241 B 45ms
7ms Image
text/plain 2600:9000:223f:6000:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:6000:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
via: 1.1 3a21078459f955a33f79dacf082781c4.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: gKnPjQ7oYJ-_SKoedYmTxkkKk_fxugpzEW7qNbRzm43HgMkMOcqa9g==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame DF08
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=8c276316-bb69-4300-93d6-d6e36752461b&gdpr=0&gdpr_consent=

43 B
425 B

106ms
19ms

Image
image/gif

185.86.139.57
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=8c276316-bb69-4300-93d6-d6e36752461b&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.57 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:53 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date: Tue, 06 Sep 2022 03:15:54 GMT
Server: MT3 4505 5b23575 master zrh-pixel-x3 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=8c276316-bb69-4300-93d6-d6e36752461b&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 06 Sep 2022 03:15:53 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame DF08
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=3126579784788445483&gdpr=0&gdpr_consent=

43 B
408 B

47ms
17ms

Image
image/gif

185.86.139.57
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=3126579784788445483&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.57 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:53 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
server: nginx
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=3126579784788445483&gdpr=0&gdpr_consent=
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=2186411619028039950

35 B
250 B

183ms
32ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=2186411619028039950
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: b14c3ec0-6b9d-4aa4-a3cb-0b8de7d3d15a
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usersync.gumgum.com/usersync?b=apn&i=2186411619028039950
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
odr.mookie1.com/t/v2/ Frame DCB4
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_a8120756-3f3f-42cd-8d5a-8533220222b4&gdpr=0&gdpr_consent=&us_privacy=1---
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=dedcc7c7-365c-4a8d-be24-02066c0593aa&ssp=gumgum2&gdpr=0&gdpr_consent=

43 B
356 B

62ms
18ms

Image
image/gif

34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=dedcc7c7-365c-4a8d-be24-02066c0593aa&ssp=gumgum2&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=dedcc7c7-365c-4a8d-be24-02066c0593aa&ssp=gumgum2&gdpr=0&gdpr_consent=
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame DCB4
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28mtoxHAqlq3P_kEtw4mcIA_ggjee1hYj_LeF79zCDIFx8hxErXR5cqzmRlYMOIFP7%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_a8120756-3f3f-42cd-8d5a-8533220222b4&obuid=ENC(mtoxHAqlq3P_kEtw4mcIA_ggjee1hYj_LeF79zCDIFx8hxErXR5cqzmRlYMOIFP7)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://bh.contextweb.com/bh/rtset?pid=562709&ev=1&us_privacy=${us_privacy}&rurl=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dpulsepoint%26uid%3D%7BuserId%7D%26obUid%3DmtoxHAqlq3P_kEtw4mcIA_...
https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid={userId}&obUid=mtoxHAqlq3P_kEtw4mcIA_ggjee1hYj_LeF79zCDIFx8hxErXR5cqzmRlYMOIFP7&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&ev=1&us_privacy...

0
145 B

91ms
90ms

Image
text/plain

70.42.32.63
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid={userId}&obUid=mtoxHAqlq3P_kEtw4mcIA_ggjee1hYj_LeF79zCDIFx8hxErXR5cqzmRlYMOIFP7&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&ev=1&us_privacy=${us_privacy}&pid=562709
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 70.42.32.63 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:55 GMT
Cache-Control: no-cache
X-TraceId: 6b411b4bea15fae2c5f335c866ef5093
Content-Length: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://sync.outbrain.com/cookie-sync?p=pulsepoint&uid={userId}&obUid=mtoxHAqlq3P_kEtw4mcIA_ggjee1hYj_LeF79zCDIFx8hxErXR5cqzmRlYMOIFP7&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&ev=1&us_privacy=${us_privacy}&pid=562709
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-dd6bdcf45-xc7tj
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=a9762432-03af-48d5-a0a4-cd8c2e380129

35 B
250 B

94ms
33ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=a9762432-03af-48d5-a0a4-cd8c2e380129
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 06 Sep 2022 03:15:54 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usersync.gumgum.com/usersync?b=opx&i=a9762432-03af-48d5-a0a4-cd8c2e380129
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-fbcfc05b-192f-4710-633a-462e71fc4a43$ip$178.162.209.134

35 B
250 B

32ms
31ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-fbcfc05b-192f-4710-633a-462e71fc4a43$ip$178.162.209.134
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-fbcfc05b-192f-4710-633a-462e71fc4a43$ip$178.162.209.134
Date: Tue, 06 Sep 2022 03:15:54 GMT
Connection: keep-alive
Content-Length: 129
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-NGo61pdE2pcRvdAgNJFfmjYknFNE6pn0kC09~A

35 B
250 B

89ms
31ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-NGo61pdE2pcRvdAgNJFfmjYknFNE6pn0kC09~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 06 Sep 2022 03:15:54 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://usersync.gumgum.com/usersync?b=oth&i=y-NGo61pdE2pcRvdAgNJFfmjYknFNE6pn0kC09~A
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=1732d2e8-4306-44cb-8583-6316affe4716

35 B
250 B

33ms
33ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=1732d2e8-4306-44cb-8583-6316affe4716
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=1732d2e8-4306-44cb-8583-6316affe4716
Date: Tue, 06 Sep 2022 03:15:54 GMT
X-CI-RTID: 4f868984-0fc9-4c57-a724-23ebd829ce45
Connection: keep-alive
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H2 204 services
sync.technoratimedia.com/ Frame DCB4 0
293 B 296ms
93ms Image
text/plain 132.226.63.138
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 132.226.63.138 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 186684760
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame DCB4 0
44 B 299ms
96ms Image
text/plain 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:53 GMT
content-length: 0
server: c

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_a8120756-3f3f-42cd-8d5a-8533220222b4&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=-wMHe0qovVZBv5RZIu3j&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2LLXJVEGKMDRN53FMWSCOY2VEWSJOUZWU...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=-wMHe0qovVZBv5RZIu3j&us_privacy=1---

35 B
250 B

32ms
31ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=-wMHe0qovVZBv5RZIu3j&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
P3p: CP="We do not support P3P header."
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=-wMHe0qovVZBv5RZIu3j&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=07f968c5-245e-4de1-8bac-00fbebc91f0d

35 B
250 B

33ms
32ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=07f968c5-245e-4de1-8bac-00fbebc91f0d
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=07f968c5-245e-4de1-8bac-00fbebc91f0d
date: Tue, 06 Sep 2022 03:15:54 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://usersync.gumgum.com/usersync?b=rhy&i=OPTOUT

35 B
250 B

167ms
33ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=rhy&i=OPTOUT
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=rhy&i=OPTOUT
pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
etag: OPTOUT
content-type: text/html

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=oTSza7QDUCc0&ev=1&pid=558355

35 B
250 B

34ms
32ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=oTSza7QDUCc0&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://usersync.gumgum.com/usersync?b=pln&i=oTSza7QDUCc0&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-dd6bdcf45-xc7tj
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame DCB4
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=8611217143155106663

35 B
250 B

34ms
34ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=8611217143155106663
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=8611217143155106663
date: Tue, 06 Sep 2022 03:15:54 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame DCB4 0
357 B 37ms
32ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_a8120756-3f3f-42cd-8d5a-8533220222b4
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame FF7D
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=28576316-bb6a-4300-8a42-4beb506cbab0&gdpr=0&gdpr_consent=

35 B
250 B

102ms
34ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=28576316-bb6a-4300-8a42-4beb506cbab0&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: Tue, 06 Sep 2022 03:15:53 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4505 5b23575 master zrh-pixel-x26 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=28576316-bb6a-4300-8a42-4beb506cbab0&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 995C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=Yxa7agALzPA6-QBC
https://usersync.gumgum.com/usersync?b=atm&i=Yxa7agALzPA6-QBC&gdpr=0&gdpr_consent=&_test=Yxa7agALzPA6-QBC

35 B
250 B

57ms
31ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=Yxa7agALzPA6-QBC&gdpr=0&gdpr_consent=&_test=Yxa7agALzPA6-QBC
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Tue, 06 Sep 2022 03:15:54 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=Yxa7agALzPA6-QBC&gdpr=0&gdpr_consent=&_test=Yxa7agALzPA6-QBC
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-fra19130-FRA
x-timer: S1662434154.252530,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame B139 170 B
188 B 59ms
30ms Document
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9hODEyMDc1Ni0zZjNmLTQyY2QtOGQ1YS04NTMzMjIwMjIyYjQ=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Tue, 06 Sep 2022 03:15:54 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 6DBE 15 KB
6 KB 10ms
7ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=55152
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 06 Sep 2022 03:15:54 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Tue, 06 Sep 2022 18:35:06 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame 4DB9 70 B
265 B 40ms
33ms Document
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Tue, 06 Sep 2022 03:15:54 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 83CB
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY2...
https://cs.emxdgt.com/umcheck?apnxid=2186411619028039950&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY29tL3VzZXJzeW5jP2I9ZW14Jmk9JEVNW...
https://usersync.gumgum.com/usersync?b=emx&i=2186411619028039950brt57551662434154130212f1

35 B
250 B

92ms
36ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&i=2186411619028039950brt57551662434154130212f1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 0
content-type: text/html
date: Tue, 06 Sep 2022 03:15:53 GMT
location: https://usersync.gumgum.com/usersync?b=emx&i=2186411619028039950brt57551662434154130212f1

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame EE8A
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=Yxa7asCo8X4AAI7PvggAAAAA

35 B
250 B

33ms
32ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=Yxa7asCo8X4AAI7PvggAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Tue, 06 Sep 2022 03:15:54 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=Yxa7asCo8X4AAI7PvggAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 5
X-SO-Cluster-ID: 30
X-SO-HostName: a-ad40236.dc2p.scaleout.jp
X-SO-IP: 178.162.209.134
X-SO-Key: Yxa7asCo8X4AAI7PvggAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":30,"gdpr":true,"ipv4":"0.0.0.0","key":"Yxa7asCo8X4AAI7PvggAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40236"}
X-SO-LB-Hostname: m-tgng26.dc4p.scaleout.jp
X-SO-Upstream-ID: a-ad40236

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 4F1C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
https://usersync.gumgum.com/usersync?b=iex&i=Yxa7alu8hX.RW7ynVVoGOgAA%265138

35 B
250 B

124ms
33ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=iex&i=Yxa7alu8hX.RW7ynVVoGOgAA%265138
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 74640af73d7041e8-AMS
content-type: text/html
date: Tue, 06 Sep 2022 03:15:54 GMT
expires: 0
location: https://usersync.gumgum.com/usersync?b=iex&i=Yxa7alu8hX.RW7ynVVoGOgAA%265138
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PCnqVc7VO3Jtl%2FuOTdEgQbTHAfvrr%2Bjix4DKsMtYZf0EJc%2FBG53CRD0LS4vfmkux%2FNk01nSB73lxUsajQQZlznCAjC4Io31MP7qDrQnJY7ToA1jEqTQOS9bx%2BvNncdyhvnMMHSZ%2F1am2uw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 0307
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=MwjrVNhwX9tXnNuGJZul&pi=gumgum&tc=1

35 B
250 B

127ms
35ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=MwjrVNhwX9tXnNuGJZul&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 06 Sep 2022 03:15:54 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Tue, 06 Sep 2022 03:15:54 GMT Tue, 06 Sep 2022 03:15:54 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=MwjrVNhwX9tXnNuGJZul&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4DFC
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
573 B

8ms
7ms

Document
text/html

23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 06 Sep 2022 03:15:54 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Unused62: 8096267
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 06 Sep 2022 03:15:54 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame 5331 31 KB
24 KB 22ms
19ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1662434154098&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=ls6vabcf7ubw&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 26 Aug 2022 17:37:48 GMT
server: cloudflare
age: 6101
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 74640af74816b960-AMS
content-length: 24217
expires: Tue, 06 Sep 2022 05:15:54 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 8A5D
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L7PMDBY3-17-2DRG

0
706 B

243ms
185ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L7PMDBY3-17-2DRG
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:53 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 8D0962C10473418281705FE40FE1B4C1 Ref B: FRAEDGE1107 Ref C: 2022-09-06T03:15:54Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXn+Z07RnabmNHGKQsk4g==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L7PMDBY3-17-2DRG
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 8A5D
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=wygx0ageQwywkKI4zfgidg&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=wygx0ageQwywkKI4zfgidg

43 B
516 B

98ms
98ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=wygx0ageQwywkKI4zfgidg

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: KT6MXY3FPF6JDH7FTRS0
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=wygx0ageQwywkKI4zfgidg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8A5D
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTQxOWEwODQ0ZmM2ZDNkMWJiZGNkMTI2Njk5MzE1MzU0NmY4N2QzZA

170 B
188 B

24ms
24ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTQxOWEwODQ0ZmM2ZDNkMWJiZGNkMTI2Njk5MzE1MzU0NmY4N2QzZA

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTQxOWEwODQ0ZmM2ZDNkMWJiZGNkMTI2Njk5MzE1MzU0NmY4N2QzZA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 8A5D
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/80XjEM-Hp9PumTJNs2AZ4cn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=460402692568796236

0
239 B

25ms
10ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=460402692568796236
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Content-Type: image/gif

Redirect headers

date: Tue, 06 Sep 2022 03:15:54 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=460402692568796236
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 8A5D 70 B
264 B 35ms
33ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 8A5D
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=JvXbgWk3RGCOMEcbx4oQyw&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=JvXbgWk3RGCOMEcbx4oQyw

43 B
556 B

38ms
37ms

Image
image/gif

52.94.220.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=JvXbgWk3RGCOMEcbx4oQyw

Protocol

HTTP/1.1

Server

52.94.220.185 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 2ZT8FJBMKZ1TGDWQ26CN
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=JvXbgWk3RGCOMEcbx4oQyw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 8A5D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEB1yk-cxe-Si-iyfoQ-WE14&google_cver=1

0
239 B

7ms
7ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEB1yk-cxe-Si-iyfoQ-WE14&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEB1yk-cxe-Si-iyfoQ-WE14&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 709414.gif
id.rlcdn.com/ Frame 8A5D 0
98 B 56ms
18ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 4DFC 31 KB
10 KB 19ms
18ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c65209840749be7df4eb7f2c6d291d39d51594aa86afaf30e550d2cb2b3d1368

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Aug 2022 20:46:19 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=39785
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9378
Expires: Tue, 06 Sep 2022 14:18:59 GMT

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame 5331 26 B
231 B 81ms
20ms Image
image/gif 2606:4700::6810:75c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1662434154178&rnd=ls6vabcf7ubw&ifm=1&uai=1&cid=1041&s=wheregoes.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1662434150645&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:75c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
cf-cache-status: HIT
last-modified: Fri, 26 Aug 2022 17:37:39 GMT
server: cloudflare
age: 6216
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 74640af81fa2b97b-AMS
content-length: 26
expires: Tue, 06 Sep 2022 05:15:54 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame 5331 26 B
87 B 82ms
21ms Image
image/gif 2606:4700::6810:75c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1662434154169193&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=wheregoes.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=ls6vabcf7ubw&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=82636925045b11176e18d0378840f62b&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=26&icp=https%253A//wheregoes.com/&irfl=26&irf=https%253A//wheregoes.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-13-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=0&spfnp=0&sp1=Chromefl_andWindows&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_10_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=16
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1662434150645&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224364602%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:75c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
cf-cache-status: HIT
last-modified: Fri, 26 Aug 2022 17:37:39 GMT
server: cloudflare
age: 6200
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 74640af81fa3b97b-AMS
content-length: 26
expires: Tue, 06 Sep 2022 05:15:54 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 4DFC 0
239 B 9ms
9ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L7PMDBY3-17-2DRG
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
Content-Type: image/gif

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame EE4E 170 B
188 B 50ms
49ms Image
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yxa7alu8hX-RW7ynVVoGOgAABK4AAAAB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame EE4E
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yxa7alu8hX-RW7ynVVoGOgAABK4AAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yxa7alu8hX-RW7ynVVoGOgAABK4AAAAB&dcc=t

43 B
605 B

96ms
95ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yxa7alu8hX-RW7ynVVoGOgAABK4AAAAB&dcc=t

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 0X0QV1VYC0E49WEEXA2T
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: PTXTDZF4VS9JB6AHMV5T
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yxa7alu8hX-RW7ynVVoGOgAABK4AAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame EE4E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yxa7alu8hX.RW7ynVVoGOgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEF8KmXAs3X99oyG1PUjWf1A&google_cver=1&gdpr=1&google_hm=2

43 B
881 B

68ms
51ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEF8KmXAs3X99oyG1PUjWf1A&google_cver=1&gdpr=1&google_hm=2
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray: 74640af8ad07b95c-AMS
pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iOSQrkrjsLjnuXGNJFuEb41BRKrqQ%2BNWlM85CiiEc9Z%2F2BWuOjPLkYrf77W1TK8HB8pFfQx11bwrrT4axVdU8FJJSR0HEFC3Mhkpa1rx8%2FS%2B0be9VS5XXg8CUt25g6HCPK58%2FpcDDJc0xw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEF8KmXAs3X99oyG1PUjWf1A&google_cver=1&gdpr=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 341
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame EE4E 70 B
264 B 43ms
41ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame EE4E 43 B
220 B 10ms
8ms Image
image/gif 18.185.150.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=index&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.150.148 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-150-148.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date: Tue, 06 Sep 2022 03:15:54 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=Yxa7alu8hX.RW7ynVVoGOgAA%261198
dpm.demdex.net/ Frame EE4E 0
0 40ms
39ms Image
application/json 34.252.39.216
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Yxa7alu8hX.RW7ynVVoGOgAA%261198?gdpr_consent=&us_privacy=&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.39.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-39-216.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame EE4E
Redirect Chain

https://sync.extend.tv/r.gif?exchange=index
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d7968722-817e-41d1-a262-4ed88e05d0e1

43 B
847 B

48ms
47ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d7968722-817e-41d1-a262-4ed88e05d0e1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray: 74640afa2f23b95c-AMS
pragma: no-cache
date: Tue, 06 Sep 2022 03:15:54 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BJUxKb1ph6ShI7hqSAzkHZRZ7gjC6lhDEf5M%2FwSCf8i5uYLBmF5NZxAkLwd2YgXeAXeMQMog%2BXV0OWhqfwlBEFHYYT7U57h9nABzmMX5MZ4CFQhl%2FZscCtuxHJ4y9xPKJHMRh8wwac%2B1SQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 06 Sep 2022 03:15:54 GMT
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=152&external_user_id=d7968722-817e-41d1-a262-4ed88e05d0e1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 132
Expires: Tue, 29 May 1984 15:00:00 GMT

GET
H/1.1 400
Request failed due to privacy signals getuid
secure.adnxs.com/ Frame EE4E 0
0 8ms
6ms Image
text/html 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2 200 sync
ads.servenobid.com/ Frame EE4E 0
356 B 41ms
40ms Image
image/avif 52.212.200.243
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=Yxa7alu8hX-RW7ynVVoGOgAABK4AAAAB
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.200.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-200-243.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 03:15:54 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame AEA6 0
747 B 8ms
7ms Script
text/html 37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS