femme4.com Open in urlscan Pro
104.21.88.216 Public Scan

Software

sffe /

Resource Hash

3a63b08cb83f8be89139d9fb7c61e75a23732097536f3edafb34ee3919dcf367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1018 / 597 of 1000 / last-modified: 1634654235"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 27102
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 19 Oct 2021 16:56:56 GMT

GET
H2 200 pre_pws.js Show response
fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/ 534 B
1 KB 41ms
6ms Script
text/javascript 151.101.2.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pre_pws.js?type=default
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 95f2cbf262679817a73625e041af10779dddb0b05c81f0418c4c3b89e5f45e8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
age: 20171
x-guploader-uploadid: ADPycduaY1nfXP_8GpvzJQ2r2Zxob4At3ETiw0URIp_9F3eGv5S6Ye5KKxd1KYRvghEuKC8pEYePf3TjvCTU_eMKkA
x-cache: HIT, HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-restarts: 0
x-verify-21-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/pre_pws.js
content-length: 305
x-served-by: cache-mdw17322-MDW, cache-hhn4057-HHN
last-modified: Mon, 11 Oct 2021 20:10:26 GMT
server: UploadServer
x-file-loc: primary0
x-timer: S1634662616.773649,VS0,VE0
etag: "bf661349cca51901bbf66e872a84e79a"
x-orig-url: /script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pre_pws.js?type=default
vary: Accept-Encoding
x-goog-hash: crc32c=iTGIWQ==, md5=v2YTScylGQG79m6HKoTnmg==
x-goog-generation: 1633983026830506
via: 1.1 varnish, 1.1 varnish
expires: Thu, 14 Oct 2021 09:08:04 GMT
cache-control: public, max-age=43200
x-goog-stored-content-length: 534
accept-ranges: bytes
content-type: text/javascript
x-cache-hits: 1, 2

GET
H2 200 pws.js Show response
fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/ 475 KB
140 KB 10ms
9ms Script
text/javascript 151.101.2.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 47a0e9dbf9e885b4760f180c2835444fc0958cc2328e6a1239f3d9ef8443abd6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
age: 1727
x-guploader-uploadid: ADPycduXbLKKG03UGWrO7Wv9W8C5USIYPHiuKRb-cPaX8amvHw4eKUF1mnH1pS1wnYA7i5BAO7x9qL9qspBbt3WrIDo
x-cache: MISS, HIT
x-goog-storage-class: STANDARD
x-split-fraction: 100
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-restarts: 0
x-verify-21-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/s/DE/desktop-pws.js
content-length: 142697
x-served-by: cache-mdw17359-MDW, cache-hhn4057-HHN
x-verify-12-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/s/DE/desktop-pws.js
last-modified: Mon, 11 Oct 2021 20:10:34 GMT
server: UploadServer
x-file-loc: primary0
x-timer: S1634662616.985822,VS0,VE2
etag: "d3893c239b9d5261b95297ee4a775736"
x-orig-url: /script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
vary: Accept-Encoding
x-goog-hash: crc32c=IAbYcw==, md5=04k8I5udUmG5UpfuSndXNg==
x-goog-generation: 1633983034747942
via: 1.1 varnish, 1.1 varnish
expires: Tue, 12 Oct 2021 06:13:23 GMT
cache-control: public, max-age=43200
x-goog-stored-content-length: 486712
accept-ranges: bytes
content-type: text/javascript
x-c-host: S
x-cache-hits: 0, 1

GET
H3 200 cropped-cropped-femme4-wide-logo.png
femme4.com/wp-content/uploads/2020/08/ 14 KB
14 KB 26ms
25ms Image
image/png 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/cropped-cropped-femme4-wide-logo.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d695786f3300c1fdf80b2d5f3d01aefb95f629999b2bdba76114e3df27eeee96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2020/08/cropped-cropped-femme4-wide-logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2797435
vary: Accept-Encoding
content-length: 13937
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 31 May 2021 18:33:22 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "60b52bf2-3671"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B26x0si6ohBE5fPXvG572Mgr2K0h6M1ShkF%2F%2BhTBW1hZtq9TrH3jrRYVc2lZW3gXQOrAQbCxMlG%2F7ai7ZynBqPR2prqSpMDq25Kr%2BvpoYSg66O1%2FXxXrzDmO%2B8Jr"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae5f86ef9de-PRG

GET
H3 200 wp-emoji-release.min.js Show response
femme4.com/wp-includes/js/ 18 KB
5 KB 48ms
47ms Script
application/javascript 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3260281
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Jul 2021 19:02:13 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ff06b5-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JByfSwd%2Fosf5QoWjbCSyvBLtuakPGjMg1vTI3p7mWyqV3HECMnFhOCM0OHn3OCtOskUg%2B6onIilcMal1ypTSyu8%2F43iGGHVvo%2Bnu4LLAjgRs%2BPy2Mjjef8fuys4s"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a0b8ae5f86ff9de-PRG

GET
H3 200 offside.min.js Show response
femme4.com/wp-content/plugins/gp-premium/menu-plus/functions/js/ 6 KB
3 KB 29ms
29ms Script
application/javascript 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.1.0-alpha.3

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ab6ba1e7e051b464b2a5855abc359ba0f4cde98edc2335e2648bbfe5a35cf38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.1.0-alpha.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2598145
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 19 Sep 2021 10:42:02 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"614713fa-1631"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UWoIkI2QZaAVcbYbS%2FhWz2M0rvxBYtHzcRQhE4%2BCvXsulwZguBuvZ%2F2B4u63twk1KcMy7NFhH%2FQpGM%2FccpAy4S8P%2BI20LlQU%2FhlAkVlMdsPCr2QS4MkFFG8tEnw2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a0b8ae57fb4f9de-PRG

GET
H3 200 main.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 29ms
29ms Script
application/javascript 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/main.min.js?ver=3.0.4

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0901279dec1117310802c450665b34a60788da4a00e066d2de367327cd13456

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/generatepress/assets/js/main.min.js?ver=3.0.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3260281
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Jul 2021 22:48:58 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ecc6da-1c98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2RBdy%2BVK1a4kD9%2BTnPbl6Kyx3yBSKJ%2FSFtCf49RoRhmxbWz7iUWS6BX4VILwminQamWxdL5bU3Ux6gU8eKhDtaXcFSFgDLr4kzfMoR50ZQvxwDVmIsAZhLil6lk5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a0b8ae5aff0f9de-PRG

GET
H3 200 navigation-search.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 2 KB
1 KB 27ms
26ms Script
application/javascript 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.0.4

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

199898d01ee6a242c64dc62559177261862ebfd52ee6903eddb87017cfa6d295

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.0.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3260281
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Jul 2021 22:48:58 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ecc6da-87a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MBSjJ3b9jZo2Z652IQR9tRLvEKEVzPlb3eOyNpWBp59hmKUZj3OliyZq5eC9b7gOEw5neyCdKLio%2BYNDnT8OP2YyPJPWhNFefQKLwknfkoKIguPW2kAyPvTeumnK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a0b8ae5d836f9de-PRG

GET
H3 200 back-to-top.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 712 B
1 KB 34ms
34ms Script
application/javascript 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.0.4

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3768f04f42b79eb4e04658f9afcdab75362a71eed99e851b05312b74964907aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.0.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2797435
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Jul 2021 22:48:58 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ecc6da-2c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vRX6D6MuE236JpJ37VBMBc1tuXoBB8Jb7N0RGzEFE1IYLZwmOPejHYmJ6ot1a3L2Pfd%2B48N1GcL1rPQIRgbQz1zWeAL%2FCaXkeTE5Ps4gampSfZZgW2Z90z4d9VhY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a0b8ae5e852f9de-PRG

GET
H3 200 wp-embed.min.js Show response
femme4.com/wp-includes/js/ 1 KB
1 KB 29ms
29ms Script
application/javascript 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-includes/js/wp-embed.min.js?ver=5.8.1

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.8.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3260281
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 06 Jun 2021 11:47:44 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60bcb5e0-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eR4NF6%2FoJkqbYWPO2BKFSimZNvb%2BT8Sjb3yBwHH7rJJmlbJEHbOySbQoBLvzcqb1VW%2BUHtpS5WyjAX9952Sm3nvsTMIFXdzAlyY25OxK6t8kv4Jk9CvRt4yvcjga"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6a0b8ae5e855f9de-PRG

GET
H2 200 7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v22/ 30 KB
31 KB 37ms
8ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:300,300italic,regular,600,600italic,800,800italic,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 06:58:19 GMT
x-content-type-options: nosniff
age: 208717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31120
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 20:50:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 17 Oct 2022 06:58:19 GMT

GET
H3 200 stay-awake.jpg
femme4.com/wp-content/uploads/2021/10/ 29 KB
29 KB 36ms
35ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/stay-awake.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbf0802fe5882be9637727e0b98f9416e354cb71b94cbcfe7c63b37c835c0ebb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/stay-awake.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 21890
vary: Accept-Encoding
content-length: 29302
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:48:13 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "616567ed-7276"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kzrrGDssoj1FyeIrklmCMOtO8E6FsAf3Eosg3Mg7sG6s4tOYTXG4UyB91FSWOLESIj7jQnssrcjEybaSu1FPjN0Z6nsglDhmSqftny0g9gfw3Yry4Q4J1zkDEI5R"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628b0f9de-PRG

GET
H3 200 Honey.jpg
femme4.com/wp-content/uploads/2021/10/ 98 KB
98 KB 54ms
54ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Honey.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55fdb026bafc5c05888471a5528d8420cebb8a8a6bd1a6b1ef65a387b92ce8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Honey.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 108398
vary: Accept-Encoding
content-length: 99886
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:45:12 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61656738-1862e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j14rG9oxofhB%2BxzZerdClUmCV3bUHbRbxniGkHUxml1LwiRG19aSpP4lAraZgkDvTbdYAIP%2FEzb57qvDYszqTiK5WMia4mPhQeF%2Bi%2BDff6Z6doJzyFbRon3NQ62S"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628b4f9de-PRG

GET
H2 200 f4adac497b863ad69ea15904029c6a8c
secure.gravatar.com/avatar/ 990 B
1 KB 33ms
6ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/f4adac497b863ad69ea15904029c6a8c?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="f4adac497b863ad69ea15904029c6a8c.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/f4adac497b863ad69ea15904029c6a8c?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Tue, 19 Oct 2021 17:01:56 GMT

GET
H3 200 Psychologist-768x908.jpg
femme4.com/wp-content/uploads/2021/10/ 51 KB
51 KB 92ms
90ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Psychologist-768x908.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0cfba76569008d0f6e9e617877f4aac8c94bd978835a0bc33890f9019a6627d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Psychologist-768x908.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 192914
vary: Accept-Encoding
content-length: 51998
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:41:40 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61656664-cb1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m2XFNVSaMmgZxFCP6%2BxhYVWaVpAOasqgQqF6CulVLnf%2BEDL8Px4XQkS5LvYoaNlkkp%2BQXb34whNpHZqoKJFvWgxfzpM6sIYyN5n4QQkq8WhXCsvB5gVhY3B6QDDm"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628b7f9de-PRG

GET
H2 200 fbf3863867f87bded433f0ce7af120d1
secure.gravatar.com/avatar/ 990 B
1 KB 34ms
7ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/fbf3863867f87bded433f0ce7af120d1?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="fbf3863867f87bded433f0ce7af120d1.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/fbf3863867f87bded433f0ce7af120d1?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Tue, 19 Oct 2021 17:01:56 GMT

GET
H3 200 Make-Up-Mistakes.jpg
femme4.com/wp-content/uploads/2021/10/ 92 KB
92 KB 112ms
110ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Make-Up-Mistakes.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e557d55298f3d88ceffd41813ee74c53adc9ede49a3c0c7e69d871e8c1a59c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Make-Up-Mistakes.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 270039
vary: Accept-Encoding
content-length: 93843
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:29:25 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61656385-16e93"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8qTC2fMgTbe8CRiayPpPGO4cBI6n3MaqoOyoRqq7ooICTJT8oAhP%2B8SeWwx2QVPGoJREHg9eYf40vsNh0OfptPtGRv9I6Abvc3NX3797wlarxDiJlf%2BHJCZDuGfv"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628ccf9de-PRG

GET
H2 200 5fe07f4e824a37b592515798eabb9975
secure.gravatar.com/avatar/ 990 B
1 KB 34ms
7ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fe07f4e824a37b592515798eabb9975?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fe07f4e824a37b592515798eabb9975.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fe07f4e824a37b592515798eabb9975?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Tue, 19 Oct 2021 17:01:56 GMT

GET
H3 200 Boost-Immunity.jpg
femme4.com/wp-content/uploads/2021/10/ 130 KB
131 KB 131ms
129ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Boost-Immunity.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb035f63f2d8bffd94ec268c3b8136113e9cfb2fdf05243b60f8425d2420998c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Boost-Immunity.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 369530
vary: Accept-Encoding
content-length: 133512
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:23:05 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61656209-20988"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bkYsf8%2Bq%2BOdnhxrHs0mMPwbH7WbCJGo34netXnCfjFnzBnRt4g3s9aZLrvc87Y3zmlw8OrhAk8srhRrwYXkRK5E%2BXJ1yKudPwVaOQfIOXyIXTvCX%2FMxLcjAOX9D7"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628cff9de-PRG

GET
H3 200 Inner-Peace.jpg
femme4.com/wp-content/uploads/2021/10/ 109 KB
110 KB 172ms
169ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Inner-Peace.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0caef3656b201ae8acf3d138c4654c28d5b6019a296d415751d2a1fc869246b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Inner-Peace.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 442675
vary: Accept-Encoding
content-length: 111642
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 12 Oct 2021 10:14:22 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "61655ffe-1b41a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8YqrSOGW9sjqjt4seDu0%2F4dR3RvT4asxynKAXlwdAbA6mYwLGBmlZ%2BXK%2FuATyS9LNEwfPtrEYNbRvMg2SqhQqqtqP7iWDrgWV0%2FmmHRrXliUX5Q5vcxm5uSnGEMA"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628d0f9de-PRG

GET
H2 200 62725d79a7f6043808f5d53ad24b62a1
secure.gravatar.com/avatar/ 990 B
1 KB 33ms
7ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/62725d79a7f6043808f5d53ad24b62a1?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cd7fed18a4a3bf5287cf7318c717fe4cb80aedb0dce2c8101244fe4d14f3726e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="62725d79a7f6043808f5d53ad24b62a1.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/62725d79a7f6043808f5d53ad24b62a1?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Tue, 19 Oct 2021 17:01:56 GMT

GET
H3 200 Linden-Tea.jpg
femme4.com/wp-content/uploads/2021/10/ 110 KB
111 KB 190ms
188ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Linden-Tea.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a68518511702523aefe74705401c6e8591b04a2dd1b9373006931bd330ff0928

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Linden-Tea.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 527822
vary: Accept-Encoding
content-length: 112729
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 07 Oct 2021 14:18:29 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "615f01b5-1b859"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MPiRE43ENtuzCSr%2BWWJe3LqWs9rT4wQ8896PCWkYzey2IFrd3wtS8124LKinO%2BXJ31msd2oR2ys0YpHTyl3%2BpgiChq2PQzin55saGQC9wGWWVZUQMciuPuAE4Fmm"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628d1f9de-PRG

GET
H3 200 jeans-this-season.jpg
femme4.com/wp-content/uploads/2021/10/ 68 KB
68 KB 211ms
209ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/jeans-this-season.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fe3f085fec50b00a625bc8fa5deb0809186ca1d9c61d0c99054fa071ca1177c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/jeans-this-season.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 594051
vary: Accept-Encoding
content-length: 69399
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 07 Oct 2021 14:13:54 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "615f00a2-10f17"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KCjG5zP3kp%2B%2FTqRxOJi%2F%2FxlfgfgT2xoW81wiwO%2F4mdpyD45UzglCFOjCRaIBqxYQ3NGc3JnQX7aX41UE2ShO%2FEQc98XmEAkanLHdF3rhtaa1NuCNt7VR%2FjOAIDPA"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628d3f9de-PRG

GET
H3 200 negative-calories.jpg
femme4.com/wp-content/uploads/2021/10/ 124 KB
124 KB 224ms
222ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/negative-calories.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7c6dfb35aee19e01ffb75158bcaa6cecf78b3aa2b9e7801ec37e7e1e5ec3b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/negative-calories.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 700670
vary: Accept-Encoding
content-length: 126530
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 07 Oct 2021 14:09:25 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "615eff95-1ee42"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FElwuMMTzSrE8%2FM5ETJFVaLxibA6TMb8jU2lULkOLyMek2Keq89%2B8HVmDnEZ7ZuUJCWcqY2qM%2Fpvz%2FoXzyIQRXxPHGlwTK%2F3fc8Gf87tQSwYb%2FTpGCmMV1U0H9Mr"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628d5f9de-PRG

GET
H3 200 weekend.png
femme4.com/wp-content/uploads/2021/10/ 537 KB
537 KB 243ms
242ms Image
image/png 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/weekend.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee562ea623dcbb107aed65647bb07d40fefde7777a12d7f13b408fd580e39184

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/weekend.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 777718
vary: Accept-Encoding
content-length: 549438
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 07 Oct 2021 14:06:20 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "615efedc-8623e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gHfOP3Uk05kN%2BjYPH0gVQ3TzYtjrFB7ZmcGm6sJgipW53wO51j9A3l6SPsHhRZLl5Ki20HPPfcmsWMjpZ%2BlV3JBcLTnZACBgRjWxI%2BVJXIGxCSe8IbkZTt4DiIT8"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628d6f9de-PRG

GET
H2 200 ce76f0a205df5e92bbd271be4d62f3b0
secure.gravatar.com/avatar/ 990 B
1 KB 32ms
7ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/ce76f0a205df5e92bbd271be4d62f3b0?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cd7fed18a4a3bf5287cf7318c717fe4cb80aedb0dce2c8101244fe4d14f3726e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ce76f0a205df5e92bbd271be4d62f3b0.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ce76f0a205df5e92bbd271be4d62f3b0?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Tue, 19 Oct 2021 17:01:56 GMT

GET
H3 200 Visceral-Fat-768x512.jpg
femme4.com/wp-content/uploads/2021/10/ 32 KB
33 KB 326ms
324ms Image
image/jpeg 104.21.88.216
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/10/Visceral-Fat-768x512.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.88.216 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b2eb7d4ea6caa1268fe0e833de89d977d87dfa3706546c0166f8371b421a0dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/10/Visceral-Fat-768x512.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 855936
vary: Accept-Encoding
content-length: 33183
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 07 Oct 2021 14:01:23 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "615efdb3-819f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6ehDyruwH9WkW0g%2BFPRXQBbb0DO2ISz5E%2Bh%2FyK%2Bwt6kdNtZBX18OyeZXAk1PWLknJGRtpp2niOFQbbcZgRq%2FdPMJdvYKE6%2BKFhxUcWK7Ta6a74FzrxkAJY8GyZxQ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6a0b8ae628d8f9de-PRG

GET
H2 200 ccba12e601d86d01313aaba2e5068ddd
secure.gravatar.com/avatar/ 3 KB
3 KB 32ms
8ms Image
image/png 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/ccba12e601d86d01313aaba2e5068ddd?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 59db76fa6af3c862afdf7bb5fd17a7aec959dba92dcf31c632bec81bf6cfa83b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Wed, 22 Nov 2017 13:51:34 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ccba12e601d86d01313aaba2e5068ddd.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ccba12e601d86d01313aaba2e5068ddd?s=35&d=mm&r=g>; rel="canonical"
content-length: 2802
expires: Tue, 19 Oct 2021 17:01:56 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ 43 KB
12 KB 74ms
27ms Script
text/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 46fdebdce62f84f8b2e9c76573b39345130911dd3519f94197dc0c62e8a16c00

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H3 200 pubads_impl_2021101201.js Show response
securepubads.g.doubleclick.net/gpt/ 361 KB
122 KB 31ms
17ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3739f7e3f233afefaaf897a2c109cd3dcce3799125f58957b4a622b610511a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 124532
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 08:35:04 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 19 Oct 2021 16:56:56 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 139 B
127 B 31ms
17ms XHR
application/json 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f14.1e100.net

Software

cafe /

Resource Hash

fb168c52becca15fed6f0e1d5ee52f3756fdce0f65cfecdd9e0b641ae69cf8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 102
x-xss-protection: 0
expires: Tue, 19 Oct 2021 16:56:56 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 31ms
6ms Script
text/javascript 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-149428601-5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Oct 2021 16:38:54 GMT
server: Golfe2
age: 3350
date: Tue, 19 Oct 2021 16:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Tue, 19 Oct 2021 18:01:06 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 2501 4 KB
1 KB 19ms
19ms Script
text/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5df26b7d2e20afcf5e6362472b3e6a731bd7860b6f3a389937f3a18d4e57af58

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 31ms
14ms XHR
text/plain 142.250.186.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=79840439&t=pageview&_s=1&dl=https%3A%2F%2Ffemme4.com%2F&ul=en-us&de=UTF-8&dt=Femme4%20-%20For%20Her&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=2029716973&gjid=1026878850&cid=1538701705.1634662616&tid=UA-149428601-5&_gid=81296579.1634662616&_r=1&gtm=2ouai0&z=385029471

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.174 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
930 B 75ms
38ms Script
application/javascript 104.26.9.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 118470
x-amz-request-id: txa9f7a43a20cf4c4c9390f-00616d2a11
x-amz-id-2: txa9f7a43a20cf4c4c9390f-00616d2a11
last-modified: Mon, 18 Oct 2021 08:01:51 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NDX2n7jBSEAnPz0m%2B97IpZoBiv7%2FBoUhhyMUwTtgSA7nSea2DLQYg0sCAqixeZ7WU9NRvw%2BwxHPh1CCplC1BgAQGZ%2FQy8yT%2FaQz0aO20PbYTAzwK1ed40AkyTHwTWx3V"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1634544111259554
cf-ray: 6a0b8ae7bc754114-PRG

GET
H2 200 arj Show response
pubwise-d.openx.net/w/1.0/ 173 B
557 B 77ms
51ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubwise-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Ffemme4.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=a84da11d-d398-40a7-875c-f03f1d5b81c0&nocache=1634662616264&pubcid=c048491c-0a70-45ae-b123-ecce8f8bf365&schain=1.0%2C1!pubwise.io%2C6758a5%2C1%2C%2C%2C&aus=728x90%2C320x50%2C300x50%2C320x100%2C1x1%2C970x90&divids=femm_adhesive&aucs=&auid=545648436
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 01dd8d1ac15a5cdd6f98b251b838d45c024083f6c21af29e201ca456e5fc3744

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
server: OXGW/16.217.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://femme4.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
184 B 134ms
108ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: 1caee9b2e378b579d4a579841a50e8d5
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
110 B 63ms
30ms XHR
text/plain 52.29.20.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.20.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-20-215.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Tue, 19 Oct 2021 16:56:56 GMT
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 1 KB
2 KB 211ms
91ms XHR
application/json 185.86.139.96
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 9f2038aed580dc53581071dd1cdec620188dcee55c5f33bf449c6efd6aa0f68f

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 6%3b22%3b114
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 1 KB
2 KB 202ms
83ms XHR
application/json 185.86.139.96
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: c79d9c735f244078bc350aca7c569d0f7c7b4254fa21365436bce4c79725a229

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 6%3b20%3b113
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 11 KB
6 KB 258ms
244ms XHR
application/json 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

fra15s46-in-f10.1e100.net

Software

nginx/1.17.9 /

Resource Hash

eb37eb8de8cf7a5a256b5e5eb4f7ab7b4494e89010e56cc70c2cb16f026883ec

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:56 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7044d09e-6084-45d9-a5d5-d711b63ab6db
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
166 B 289ms
95ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 1
date: Tue, 19 Oct 2021 16:56:56 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
642 B 58ms
17ms XHR
application/json 216.52.2.48
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.15.0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: ee312c2d3d7d7dc0460a6f1ab5cf5bc6a3c766587c6432402e82eeefb5b7750e

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:56 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
294 B 142ms
102ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: e60ef34e37c1185b9b7b38bee4921c20dbd0e642ffc37e0a52bb8d87e7c61998

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H2 200 iab_consent_sdk.v1.0.js Show response
live.primis.tech/content/ClientDetections/ Frame 2501 19 KB
6 KB 16ms
15ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
etag: W/"5e441350-4be0"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 19 Oct 2022 16:56:55 GMT

GET
H2 200 DetectGDPR2.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame 2501 9 KB
3 KB 18ms
17ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-228f"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 19 Oct 2022 16:56:55 GMT

GET
H2 200 DetectGDPR.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame 2501 8 KB
3 KB 17ms
16ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-1ef8"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 19 Oct 2022 16:56:55 GMT

GET
H2 200 hls.0.12.4_2.min.js Show response
live.primis.tech/content/video/hls/ Frame 2501 256 KB
86 KB 21ms
20ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
last-modified: Thu, 13 Aug 2020 08:36:05 GMT
server: nginx
etag: W/"5f34fb75-3ff27"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 19 Oct 2022 16:56:56 GMT

GET
H2 200 prebidVid.4.43.0_13.min.js Show response
live.primis.tech/content/prebid/ Frame 2501 399 KB
148 KB 46ms
45ms Script
application/javascript 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5c84708631cddfa3597b604735767e3fd7615c4016ff9fa7902b4b7624b327f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
last-modified: Tue, 12 Oct 2021 09:22:03 GMT
server: nginx
etag: W/"616553bb-63de8"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Wed, 19 Oct 2022 16:56:55 GMT

GET
H2 200 liveVideo.php Show response
live.primis.tech/live/ Frame 2501 555 KB
154 KB 59ms
59ms Script
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1634662616&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: d4c77a7e12e5c101c75203b2b60eab5a714f7a2dee137145c17e8dafaa953ec4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
content-type: text/html; charset=UTF-8

GET
H2 200 adagio.js Show response
script.4dex.io/ 71 KB
22 KB 54ms
21ms Fetch
application/javascript 104.26.9.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.9.169 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 071ae33974e54b0b7586b5ecc94a40ab118f7df9a387f351231095b51aafe93e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 118446
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx04b2dbcdab474249bd4b5-00616d2a11
x-amz-id-2: tx04b2dbcdab474249bd4b5-00616d2a11
last-modified: Mon, 18 Oct 2021 08:01:50 GMT
server: cloudflare
etag: W/"cae476c264f28e37aca638d685ba55b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6H0E0ZeTJ7wHrWpRO0E6gDxmsvnc9rml3LK16poDlzjOjdDn61ecmhwAEAmOpE0dpKiZ9gQRmXAnap8iNFilgHHub6JvtR%2BoCsMxEksOymTtvxPU61KdllazFd2GbSY%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1634544110326910
cf-ray: 6a0b8ae83c5e412c-PRG
access-control-allow-headers: Authorization

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
140 B 140ms
111ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-nkmm
alt-svc: clear

GET
H2 200 primisslate.css
live.primis.tech/content/video/css/ 17 KB
5 KB 15ms
15ms Stylesheet
text/css 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/css/primisslate.css
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 10:07:25 GMT
server: nginx
etag: W/"5f3ba85d-45c8"
content-type: text/css

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 2501 133 KB
36 KB 77ms
34ms Script
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: Server /
Resource Hash: da263eff6489f28a35d328a1a5895db9adb14c22c40cd35d0afce85414cac701

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: zTpXqDhrs..xkKPVKkqB8HVtw0cnTzHi
content-encoding: gzip
etag: e2b905aea413c4d7479fb2bb9cbc6c65
age: 105
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 1ARYZ07S705FVK3SJJKK
date: Tue, 19 Oct 2021 16:56:01 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: gJb3VwHsUQ_aHpZgL4oLFXnS1I9faReopvoRRw8KRCsIQ9LAahAxIw==

GET
H3 200 css
fonts.googleapis.com/ Frame 090B 2 KB
550 B 33ms
19ms Stylesheet
text/css 172.217.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 15:03:12 GMT
server: ESF
date: Tue, 19 Oct 2021 16:56:56 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 16:56:56 GMT

GET
H3 200 css
fonts.googleapis.com/ 2 KB
550 B 19ms
17ms Stylesheet
text/css 172.217.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f10.1e100.net

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 16:40:47 GMT
server: ESF
date: Tue, 19 Oct 2021 16:56:56 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 19 Oct 2021 16:56:56 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F762 14 KB
5 KB 34ms
9ms Document
text/html 184.30.20.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.198 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-198.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=120773
expires: Thu, 21 Oct 2021 02:29:49 GMT
date: Tue, 19 Oct 2021 16:56:56 GMT
vary: Accept-Encoding

GET
H2

200

liveCS.php Show response
live.primis.tech/live/ Frame E558
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D94%26advUuid%3D%24...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=94&advUuid=91594c61-30fd-11ec-8a2b-16877d160406

0
223 B

23ms
23ms

Document
text/html

63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=94&advUuid=91594c61-30fd-11ec-8a2b-16877d160406
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: live.primis.tech
:scheme: https
:path: /live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=94&advUuid=91594c61-30fd-11ec-8a2b-16877d160406
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

server: nginx
date: Tue, 19 Oct 2021 16:56:55 GMT
content-type: text/html; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 19 Oct 2021 16:56:56 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: audience=91594c61-30fd-11ec-8a2b-16877d160406; expires=Wed, 19-Oct-2022 18:03:36 GMT; path=/; domain=.spotxchange.com; SameSite=none; Secure
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=94&advUuid=91594c61-30fd-11ec-8a2b-16877d160406
X-fe: 74
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

GET
H2

200

liveCS.php Show response
live.primis.tech/live/ Frame 556B
Redirect Chain

https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D98%26advU...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=98&advUuid=e44190f5-efb1-42aa-af90-b20507e4838d

0
223 B

17ms
17ms

Document
text/html

63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=98&advUuid=e44190f5-efb1-42aa-af90-b20507e4838d
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: live.primis.tech
:scheme: https
:path: /live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=98&advUuid=e44190f5-efb1-42aa-af90-b20507e4838d
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

server: nginx
date: Tue, 19 Oct 2021 16:56:56 GMT
content-type: text/html; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

vary: Accept, Accept-Encoding
set-cookie: i=c048491c-0a70-45ae-b123-ecce8f8bf365|1634662616; Version=1; Expires=Wed, 19-Oct-2022 16:56:56 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.217.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=98&advUuid=e44190f5-efb1-42aa-af90-b20507e4838d
date: Tue, 19 Oct 2021 16:56:56 GMT
content-type: text/html
content-length: 0
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 55C1 2 KB
1 KB 1719ms
475ms Document
text/html 62.149.0.137
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.137 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: cc86365-03.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: 10424daca90a3213938d84d8259098b2146af39aa01f3bdbee1d1b8f8d2f037c

Request headers

Host: s.console.adtarget.com.tr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Server: VertaMedia 1.0
Date: Tue, 19 Oct 2021 16:56:57 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 824
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Encoding: gzip

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 2501 130 KB
10 KB 65ms
64ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMwQyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMmA3NwAyMxZ2nWRyo182MGJxZTE2OTA1ZWIkOTI3NmQ3MmxmJTJGqzyxNwE2ZDZxNDU3NzUjNwA2NwI1NTA5OS5gpDQzqzyxX2NioaRyoaRsnWQ9MTxjMwM4OCZ2nWRsY29hqGVhqF9xZXNwPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X3RcqGkyPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X2R1pzF0nW9hPTY1JzRyYaVaSW5zo3JgYXRco249Jat9NwxjJax9MmxjJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmEmMDJEMmEmOTVGMmEmOTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmYmOTMjN0Q3QwU5MmMmOTMjN0Q3QwY2MmE3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwxmLwAhNDU3Nl42MlgTYWZupzxyMxY1MmphMmYzpGkurWVlQXBcSWQ9JzNmqXVcZD02MTZyZwuxODMkYwt4JzNvqXN0ZXI9MTYmNDY2MwYkNwQ0MCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: c9af2b0b84918e7f1a6e9e3b072214ea44f67bc5d537ab0e3f3d8b11368e9ed4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 10123

GET
H2 200 chunklist_480.m3u8 Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 476 B
730 B 42ms
8ms XHR
application/vnd.apple.mpegurl 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/chunklist_480.m3u8
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 823aa71cdb2672d4101e3641bd61655f2b58fc75f014ffc7f46110ca22e2c17e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:27 GMT
server: Tengine
etag: "616d6dcf-1dc"
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 476
x-proxy-cache: HIT, HIT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 20ms
18ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTUjJaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA1NDY0JaN0YT0jJat9NwxjJax9MmxjJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9qW5xZWZcozVxX2ZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZlnT02QmY5NmY2NTUmNmQ2MTp0NmM3QmpmNxImMTqCNTQmMDqEN0I2NDMlMmAmMwMkMxQmMTMjMxQmMTM5NUYmMTM5N0Q3QwpmMmEmNTMlMmUmMDMjMmEmMTqEN0I0MmM1Mmp3RDqCNTM2NDU3MmU2QwVBNTp1QTpjNwI2RDU2NxI1ODMlNUE2QmYlNTpmMTZDNEU0MmM1NxE2MwMlMmAmRDqEN0I2MwYmNwt3MwZGNxQ2NTqEN0I3MTY0NwU3MmZCNmQ2RwpjN0Q3QwZGNmp2OTZFNwQ2Rwp3NmM3RDqCNTtmNwM5MmA3RDqCNTxmMmM5MmA3RDqCNwYmMTqEN0I0QmMkMmAmNmM0Mmx3REZFRxUzZGyunWQ9JaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAyMwAyMwuXnW5xo3qmJTIjTyQyMwAkMC4jJTNCJTIjV2yhNwQyM0IyMwB4NwQyMwxyMwBBpHBfZVqyYxgcqCUlRwUmNl4mNvUlMCUlOEgIVE1MJTJDJTIjoGyeZSUlMEqyY2giJTI5JTIjQ2ulo21yJTJGOTMhMC40NTp3LwYmJTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02MTZyZwuxODMkYwt4JzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmQ2NwI2MTY0MmIzqWyxPVNyn2yhZG9TUGkurWVlNwE2ZWY4ZDt0ZTRyZvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 2501 43 B
220 B 54ms
13ms Image
image/gif 18.194.4.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=sekindo&user_id=616ef8d831b88&custom_data=616ef8d831b88;live.primis.tech&gdpr=1&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.4.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-4-47.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:56 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 2501
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=93&advUuid=3b7d7de6-cff9-4a80-b358-b8ff2a595177

0
223 B

17ms
17ms

Image
text/html

63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=93&advUuid=3b7d7de6-cff9-4a80-b358-b8ff2a595177
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=93&advUuid=3b7d7de6-cff9-4a80-b358-b8ff2a595177
date: Tue, 19 Oct 2021 16:56:56 GMT
server: _
content-length: 0

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 2501
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=192962&cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D99%26advUuid%3D
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D99%26advUuid%3D&s=192962&C=1
https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=99&advUuid=YW742NdE85lWkO3vXgCJ2AAABKEAAAIB

0
223 B

17ms
17ms

Image
text/html

63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=99&advUuid=YW742NdE85lWkO3vXgCJ2AAABKEAAAIB
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=99&advUuid=YW742NdE85lWkO3vXgCJ2AAABKEAAAIB
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 334
Expires: Tue, 19 Oct 2021 16:56:56 GMT

GET
H2

200

liveCS.php
live.primis.tech/live/ Frame 2501
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D105%26advUuid%3D%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Flive.primis.tech%252Flive%252FliveCS.php%253Fsource%253Dexternal%2526csuuid%253D616ef8d831b88%2526pixel%253D%2526advId%253D105%2526ad...
https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=105&advUuid=8000878581923869095

0
223 B

16ms
16ms

Image
text/html

63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=105&advUuid=8000878581923869095
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:56 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5ba13e2b-8077-43ff-a682-2218e64b1334
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://live.primis.tech/live/liveCS.php?source=external&csuuid=616ef8d831b88&pixel=&advId=105&advUuid=8000878581923869095
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vid616d6d4576e06066255099.jpg
video.primis.tech/uploads/cn24/video/users/converted/30760/video_60bde16905eb1927747393/ 7 KB
7 KB 27ms
7ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn24/video/users/converted/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.jpg?cbuster=1634561418

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

2bbd479b8ff77bdf475e38bc844d62f6e8e429a49fd14cc73ffb677af3a26e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:50:19 GMT
server: Tengine
etag: "616d6d8b-1cc4"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 01 Nov 2021 13:43:14 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 7364
x-proxy-cache: HIT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 2501 54 KB
7 KB 47ms
47ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMwQyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMmA3NwAyMxZ2nWRyo182MGJxZTE2OTA1ZWIkOTI3NmQ3MmxmJTJGqzyxNwE2ZDZxNDU3NzUjNwA2NwI1NTA5OS5gpDQzqzyxX2NioaRyoaRsnWQ9MTxjMwM4OCZ2nWRsY29hqGVhqF9xZXNwPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X3RcqGkyPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X2R1pzF0nW9hPTY1JzRyYaVaSW5zo3JgYXRco249Jat9NTpmJax9MmIlJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmEmMDJEMmEmOTVGMmEmOTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmYmOTMjN0Q3QwU5MmMmOTMjN0Q3QwY2MmE3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwxmLwAhNDU3Nl42MlgTYWZupzxyMxY1MmphMmYzpGkurWVlQXBcSWQ9JzNmqXVcZD02MTZyZwuxODMkYwt4JzNvqXN0ZXI9MTYmNDY2MwYkNwQ2NlZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 15859c3062db63c570534f1f923d3e7bf7e31d30a2beea7d5f8edc8d5c0b8e57

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 6417

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 2501 54 KB
7 KB 50ms
49ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMwQyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMmA3NwAyMxZ2nWRyo182MGJxZTE2OTA1ZWIkOTI3NmQ3MmxmJTJGqzyxNwE2ZDZxNDU3NzUjNwA2NwI1NTA5OS5gpDQzqzyxX2NioaRyoaRsnWQ9MTxjMwM4OCZ2nWRsY29hqGVhqF9xZXNwPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X3RcqGkyPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X2R1pzF0nW9hPTY1JzRyYaVaSW5zo3JgYXRco249Jat9NDAjJax9MwI1JaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmEmMDJEMmEmOTVGMmEmOTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmYmOTMjN0Q3QwU5MmMmOTMjN0Q3QwY2MmE3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwxmLwAhNDU3Nl42MlgTYWZupzxyMxY1MmphMmYzpGkurWVlQXBcSWQ9JzNmqXVcZD02MTZyZwuxODMkYwt4JzNvqXN0ZXI9MTYmNDY2MwYkNwQ2OCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 69b6d4da05c05cb0bf79fdd85a8181add381a3ba7e9bda26d4a611a1ba95695a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:55 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 6419

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame 2501 39 KB
5 KB 40ms
40ms XHR
application/json 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMwQyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMmA3NwAyMxZ2nWRyo182MGJxZTE2OTA1ZWIkOTI3NmQ3MmxmJTJGqzyxNwE2ZDZxNDU3NzUjNwA2NwI1NTA5OS5gpDQzqzyxX2NioaRyoaRsnWQ9MTxjMwM4OCZ2nWRsY29hqGVhqF9xZXNwPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X3RcqGkyPVRbnXMeV2VynlgcovgInXN0o3J5KlUlODEjJTJGMTteLSfkMCUlRwI0JTI5JaZcZF9wo250ZW50X2R1pzF0nW9hPTY1JzRyYaVaSW5zo3JgYXRco249Jat9NTpmJax9MmIlJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmEmMDJEMmEmOTVGMmEmOTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNwI2MmY4NmI2RwZENwU3RDqCNmE2NDY1NmM2Qwp0NxY3MDqEN0I2Rwp3Nwx2RTY0NxY3NmpmN0Q3QwU4MmYmOTMjN0Q3QwU5MmMmOTMjN0Q3QwY2MmE3RDqCNEMmMTMjMmpmNDM5N0RGRUZFJzymQXBjPTAzZ2ViTGF0nT01MC4kMTt4Jzqyo0kiozp9OC42ODQmJaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAeJTI4V2yhZG93plgOVCfkMC4jJTNCK1qcowY0JTNCK3t2NCUlOSgBpHBfZVqyYxgcqCUlRwUmNl4mNvfyMwuLSFRNTCUlQlgfnWgyK0qyY2giJTI5K0Nbpz9gZSUlRwxmLwAhNDU3Nl42MlgTYWZupzxyMxY1MmphMmYzpGkurWVlQXBcSWQ9JzNmqXVcZD02MTZyZwuxODMkYwt4JzNvqXN0ZXI9MTYmNDY2MwYkNwQ2OSZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0j
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D31302D31395F31397D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F77696E646F77737D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.114.97&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&isSinglePageFloatSupport=0&csuuid=616ef8d831b88&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=1&flow_bottomOffset=115&impGap=1&flow_width=400&flow_height=225&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=seenboth&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 33ca2194216178302b1a0adcff13ee12db6d7fceb3c7d0ee735576cf875a0016

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 4997

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 29ms
11ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 84559
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 18 Oct 2022 17:27:37 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 090B 15 KB
15 KB 8ms
7ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 84559
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 18 Oct 2022 17:27:37 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 2501 0
211 B 372ms
323ms XHR
application/json 3.66.59.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.59.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-59-71.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 204
No Content 196297 Show response
search.spotxchange.com/openrtb/2.3/dados/ Frame 2501 0
1 KB 115ms
33ms XHR
application/json 185.94.180.124
SPOTX-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://search.spotxchange.com/openrtb/2.3/dados/196297?src_sys=prebid
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 185.94.180.124 , Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:56 GMT
X-SpotX-Timing-Transform: 0.000513
X-SpotX-Timing-SpotMarket: 0.008850
X-SpotX-Timing-Page-Mux: 0.000450
X-SpotX-Timing-Page-Require: 0.000460
X-fe: 054
Connection: keep-alive
X-SpotX-Timing-Page-Cookie: 0.000043
X-SpotX-Timing-Page: 0.016518
Pragma: no-cache
X-SpotX-Timing-Page-Context: 0.000409
Last-Modified: Tue, 19 Oct 2021 16:56:56 GMT
Server: nginx
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
X-SpotX-Timing-SpotMarket-Primary: 0.008850
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
X-SpotX-Timing-Page-Misc: 0.005774
X-SpotX-Timing-Page-Exception: 0.000001
X-SpotX-Timing-SpotMarket-Secondary: 0.000000
X-SpotX-Timing-Page-URI: 0.000018
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 204
No Content 171621 Show response
search.spotxchange.com/openrtb/2.3/dados/ Frame 2501 0
1 KB 144ms
62ms XHR
application/json 185.94.180.124
SPOTX-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://search.spotxchange.com/openrtb/2.3/dados/171621?src_sys=prebid
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 185.94.180.124 , Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:56 GMT
X-SpotX-Timing-Transform: 0.000548
X-SpotX-Timing-SpotMarket: 0.037315
X-SpotX-Timing-Page-Mux: 0.000276
X-SpotX-Timing-Page-Require: 0.000301
X-fe: 070
Connection: keep-alive
X-SpotX-Timing-Page-Cookie: 0.000024
X-SpotX-Timing-Page: 0.045831
Pragma: no-cache
X-SpotX-Timing-Page-Context: 0.000283
Last-Modified: Tue, 19 Oct 2021 16:56:56 GMT
Server: nginx
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
X-SpotX-Timing-SpotMarket-Primary: 0.015570
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
X-SpotX-Timing-Page-Misc: 0.007072
X-SpotX-Timing-Page-Exception: 0.000001
X-SpotX-Timing-SpotMarket-Secondary: 0.021745
X-SpotX-Timing-Page-URI: 0.000011
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
adx.adform.net/adx/ Frame 2501 5 B
445 B 128ms
75ms XHR
application/json 37.157.4.25
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/?rp=4&bWlkPTEwNzQzODMmdz01NzMmaD0zMjImcHJpY2VUeXBlPW5ldCZtaW5wPTIuNyZ0cmFuc2FjdGlvbklkPTE5MmEzMGQ0LThlYzMtNGVmNC1hOTY1LWU0NzI0NTJmODM2Ng%3D%3D&pt=net&stid=62d60675-efe7-4fca-814f-adf5f32d0fc4&gdpr=1&gdpr_consent=&fd=1&url=https%3A%2F%2Ffemme4.com%2F

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.25 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

566f1f7d64379342927e78274c526e634c394fda54cf4145d698b815952d01f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 5
expires: -1

GET
H2 200 vid616d6d4576e06066255099_thumb.jpg
video.primis.tech/uploads/cn24/video/users/converted/30760/video_60bde16905eb1927747393/ 959 B
1 KB 9ms
8ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn24/video/users/converted/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099_thumb.jpg?cbuster=1634561418

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

219a5efdc9e13b95cc1216eeadd6e35de690beaa836aaf475bd135ba73529c7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:50:20 GMT
server: Tengine
etag: "616d6d8c-3bf"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 01 Nov 2021 13:43:19 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 959
x-proxy-cache: HIT

GET
H2 200 vid616c962e76510365477004_thumb.jpg
video.primis.tech/uploads/cn24/video/users/converted/24271/video1511884217/ 2 KB
2 KB 10ms
8ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn24/video/users/converted/24271/video1511884217/vid616c962e76510365477004_thumb.jpg?cbuster=1634506290

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

730bf8643b11a73e39c63b2ecffaac7071400c65d797fc2d78072666c71b0fab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Sun, 17 Oct 2021 21:32:10 GMT
server: Tengine
etag: "616c965a-79e"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 31 Oct 2021 22:47:08 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1950
x-proxy-cache: HIT

GET
H2 200 vid611e399c7e1da928705195_thumb.jpg
video.primis.tech/uploads/cn14/video/users/converted/24271/video1511884110/ 2 KB
2 KB 11ms
10ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn14/video/users/converted/24271/video1511884110/vid611e399c7e1da928705195_thumb.jpg?cbuster=1629370784

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

a5085a4070c8a7a855c4cfee9e3f6bd56969127d768193475fad8fb07e076904

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Thu, 19 Aug 2021 11:01:11 GMT
server: Tengine
etag: "611e39f7-733"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Wed, 20 Oct 2021 08:08:31 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1843
x-proxy-cache: MISS

GET
H2 200 vid61679d2674490768484779_thumb.jpg
video.primis.tech/uploads/cn20/video/users/converted/24271/video1511884217/ 3 KB
3 KB 11ms
11ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn20/video/users/converted/24271/video1511884217/vid61679d2674490768484779_thumb.jpg?cbuster=1634180395

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

bdb69d1282898c8fd3fe63c4c17a2bade5b1916678515715adbfc6cb66b2f375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Thu, 14 Oct 2021 03:01:56 GMT
server: Tengine
etag: "61679da4-a21"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Thu, 28 Oct 2021 04:02:53 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 2593
x-proxy-cache: HIT

GET
H2 200 vid61506fad7b6f5854588561_thumb.jpg
video.primis.tech/uploads/cn2/video/users/converted/24271/video1511884110/ 2 KB
2 KB 14ms
13ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn2/video/users/converted/24271/video1511884110/vid61506fad7b6f5854588561_thumb.jpg?cbuster=1632661424

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

b17829be3c11de51d736bcd300d8613eb257e6f658fc31d16228280ae94dcd7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Sun, 26 Sep 2021 13:05:25 GMT
server: Tengine
etag: "61507015-8bd"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 24 Oct 2021 14:35:36 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 2237
x-proxy-cache: HIT

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
57 B 105ms
103ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-bnnf
alt-svc: clear

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
6 KB 189ms
189ms XHR
application/json 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

f090789c570a75285d4a0fd2a6ea38b2cdd44b25986654d76242238436ca90fa

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:56 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4f8e6a4f-4674-41b5-9619-7449ff99d453
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 vid616d6d4576e06066255099.jpg
video.primis.tech/uploads/cn24/video/users/converted/30760/video_60bde16905eb1927747393/ 7 KB
7 KB 9ms
9ms Image
image/jpeg 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn24/video/users/converted/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.jpg?cbuster=1634561418

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),

Reverse DNS

Software

Tengine /

Resource Hash

2bbd479b8ff77bdf475e38bc844d62f6e8e429a49fd14cc73ffb677af3a26e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:50:19 GMT
server: Tengine
etag: "616d6d8b-1cc4"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 01 Nov 2021 13:43:14 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 7364
x-proxy-cache: HIT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
157 B 103ms
103ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: e3a23b269461d23d1b1770b4524f1a62449a60bc3ba2115ed286506871d51b7e

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
78 B 109ms
109ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: f1902fe7a43a9180db4751d6f20119fe
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
18 B 95ms
95ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 1
date: Tue, 19 Oct 2021 16:56:56 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 106ms
106ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-zs09
alt-svc: clear

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 37ms
16ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
9 KB 401ms
401ms XHR
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2877213304704200&correlator=1349579889322524&output=ldjh&impl=fif&eid=31063136%2C31062526%2C31063140&vrg=2021101201&ptt=17&sc=1&sfv=1-0-38&ecs=20211019&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_adhesive&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=970x90%7C728x90%7C320x50%7C320x100%7C300x50%7C1x1&prev_scp=hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.00%26hb_adid%3D5752d7d06823d12%26hb_bidder%3Dappnexus&eri=5&cookie_enabled=1&cdm=femme4.com&bc=31&abxe=1&dt=1634662616738&dlt=1634662615707&idt=513&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1150&adks=3023198139&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=1538701705.1634662616&ga_sid=1634662617&ga_hid=79840439&ga_fc=false&fws=516&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b65edf7a4d3ced7c54a84419781ec66518cde331859752ba7b4e1821c26afb9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9609
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CE56 6 KB
4 KB 96ms
27ms Document
text/html 142.250.186.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 19 Oct 2021 16:56:56 GMT
expires: Wed, 19 Oct 2022 16:56:56 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 w_480_00000.ts Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 263 KB
264 KB 12ms
12ms XHR
video/mp2t 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/w_480_00000.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: c0bf79f436bc29a8b714182afc3130eb62939d43bcef9a89ee36eba0c7017298

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:23 GMT
server: Tengine
etag: "616d6dcb-41dd4"
content-type: video/mp2t
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 269780
x-proxy-cache: HIT, HIT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 2501 6 KB
3 KB 27ms
10ms XHR
application/javascript 143.204.95.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.95.188 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-95-188.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: c91ZTIbLZrDqT0mloV_AD7.LNsTlhW69
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 72849
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 07 Oct 2021 01:02:33 GMT
server: AmazonS3
date: Tue, 19 Oct 2021 16:24:30 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 822RK9-yP1MrTVpRZB3nt_oR0Hj9dqBsqKW5shkHYbZ8pC97Y4EBVw==

GET
BLOB 200
OK e1630ee0-105c-472f-82e1-36e0bb4309a2
https://femme4.com/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://femme4.com/e1630ee0-105c-472f-82e1-36e0bb4309a2
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Length: 66258
Content-Type: text/javascript

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame F762 0
42 B 72ms
17ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=83358080&p=159196&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=1&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.primis.tech%2Flive%2FliveCS.php%3Fsource%3Dexternal%26csuuid%3D616ef8d831b88%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:54 GMT
content-length: 0

GET
H2 200 w_480_00001.ts Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 388 KB
389 KB 7ms
6ms XHR
video/mp2t 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/w_480_00001.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 0725d6d8dc214c8a1a15a59d07e68e06ae4d3b650096c12625d6f9b8d991c924

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:24 GMT
server: Tengine
etag: "616d6dcc-60fbc"
content-type: video/mp2t
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 397244
x-proxy-cache: HIT, HIT

GET
H2 200 w_480_00002.ts Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 359 KB
360 KB 7ms
7ms XHR
video/mp2t 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/w_480_00002.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: 348ebe89d9755e39de9b4be7d8de1256fcaf7071fa805dd2d28e001fce6512c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:24 GMT
server: Tengine
etag: "616d6dcc-59c70"
content-type: video/mp2t
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 367728
x-proxy-cache: HIT, HIT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
158 B 136ms
136ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: 3d5b7be6d8f3490ca04b06ee80cd75dc6152294d7d8c76a46efd4cfd30293448

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
20 B 98ms
97ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 1
date: Tue, 19 Oct 2021 16:56:56 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
67 B 109ms
109ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: 7fa2d3290e45a12c5ccc1f6356b133a1
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
7 KB 138ms
137ms XHR
application/json 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

bd3121889806ea32705de3bc8bf0a11e283cdaeb233fcddceccbf72f62a52e8d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:57 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 65a1b6a1-a7e3-4486-832e-3cbd4369c071
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 108ms
107ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-5wlp
alt-svc: clear

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
16ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
9 KB 347ms
347ms XHR
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2877213304704200&correlator=3602807960882039&output=ldjh&impl=fif&eid=31063136%2C31062526%2C31063140&vrg=2021101201&ptt=17&sc=1&sfv=1-0-38&ecs=20211019&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_sidebar_2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C160x600&fluid=height&prev_scp=hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_adid%3D585447cb0f6b9ef%26hb_bidder%3Dappnexus&eri=5&cookie_enabled=1&cdm=femme4.com&bc=31&abxe=1&dt=1634662616916&dlt=1634662615707&idt=513&frm=20&biw=1600&bih=1200&oid=2&adxs=1066&adys=1252&adks=4061998808&ucis=2&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=308x0&msz=308x0&ga_vid=1538701705.1634662616&ga_sid=1634662617&ga_hid=79840439&ga_fc=false&fws=4&ohw=1600&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2baa7bd41dc895bf0f2f00d7a02c4680e939ac6ec90e14e57859263b2ad6d66d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9577
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 w_480_00003.ts Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 450 KB
451 KB 9ms
9ms XHR
video/mp2t 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/w_480_00003.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: f0f1ba5bcd3130d393e51c2de047a31edbf5fa9e1493fee5f0201a4ed29bc4e8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:24 GMT
server: Tengine
etag: "616d6dcc-7096c"
content-type: video/mp2t
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 461164
x-proxy-cache: HIT, HIT

GET
H2 200 w_480_00004.ts Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 424 KB
424 KB 10ms
9ms XHR
video/mp2t 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/w_480_00004.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: a3d7522ab4a984c8206323627347b5fc7fc99723514365da7ac1f65ef3556213

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:25 GMT
server: Tengine
etag: "616d6dcd-69e34"
content-type: video/mp2t
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 433716
x-proxy-cache: HIT, HIT

GET
H2 200 w_480_00005.ts Show response
video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/ 429 KB
430 KB 8ms
8ms XHR
video/mp2t 83.229.84.43
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn24/video/users/hls/30760/video_60bde16905eb1927747393/vid616d6d4576e06066255099.mp4/w_480_00005.ts
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/video/hls/hls.0.12.4_2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 83.229.84.43 , Nigeria, ASN204548 (CLOUDWEBMANAGE-IL-FR, US),
Reverse DNS
Software: Tengine /
Resource Hash: dd41ff0c1ce4173657bd06c5eca321d766345a48c91b9f3b1a0753552f8bef74

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:56 GMT
last-modified: Mon, 18 Oct 2021 12:51:25 GMT
server: Tengine
etag: "616d6dcd-6b43c"
content-type: video/mp2t
access-control-allow-origin: *
expires: Tue, 02 Nov 2021 16:56:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 439356
x-proxy-cache: HIT, HIT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 2501 369 KB
123 KB 134ms
20ms Script
text/javascript 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e915b42bd3104526660e0dc21d2c6495a63a70f1ed68a199a34f4a37e15c03f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125411
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 18ms
18ms Image
image/gif 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTYzp2VlqzVlVGygZT0kNwM0NwYlNwE2JaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY2MDMkMwYzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaZcZF9uqGx9nW50ZXJjpz9go3RyoHRxJaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAyMwAyMwuXnW5xo3qmJTIjTyQyMwAkMC4jJTNCJTIjV2yhNwQyM0IyMwB4NwQyMwxyMwBBpHBfZVqyYxgcqCUlRwUmNl4mNvUlMCUlOEgIVE1MJTJDJTIjoGyeZSUlMEqyY2giJTI5JTIjQ2ulo21yJTJGOTMhMC40NTp3LwYmJTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02MTZyZwuxODMkYwt4JaJ2ow03ODEjJzF0qGVgpHRNqWk0nXBfnWVlPTIjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmQ2NwI2MTpjMDQzqWyxPVNyn2yhZG9TUGkurWVlNwE2ZWY4ZDt0ZTRyZvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 66 B
149 B 105ms
105ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: d29d5e646c034bc276d35f92c3ef70ff5a520802375c52083faa750ea435b659

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
642 B 29ms
28ms XHR
application/json 216.52.2.48
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.15.0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 04a17649563d993379ff001cb4a77af0a3d2546cbbf7efc693485225e3d109f3

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:57 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 33ms
33ms XHR
text/plain 52.29.20.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.20.215 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-20-215.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Tue, 19 Oct 2021 16:56:57 GMT
access-control-allow-credentials: true
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 12 KB
6 KB 140ms
140ms XHR
application/json 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

6e98c9d967fe0ebb9d1ebf253e0482963c6ce3fb1c8b017354ac545d111e2aba

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:57 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: becbc2a4-25e7-49c9-b7d4-e3a71f26a703
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
68 B 108ms
108ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: b016cd996bcdb30b8c9601aae5a9b7eb
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

GET
H2 200 arj Show response
pubwise-d.openx.net/w/1.0/ 172 B
359 B 32ms
32ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubwise-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Ffemme4.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=63b6d9f0-99f8-4a94-8a69-d31ee1e0d819&nocache=1634662617049&pubcid=c048491c-0a70-45ae-b123-ecce8f8bf365&schain=1.0%2C1!pubwise.io%2C6758a5%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%2C320x50&divids=femm_leaderboard&aucs=&auid=545648434
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: f163d0028091e3f66e4a32fba25d6251ecf85b5138907b2f324285d4488b93c8

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
server: OXGW/16.217.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://femme4.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 163
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
20 B 93ms
93ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 1
date: Tue, 19 Oct 2021 16:56:56 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 1 KB
2 KB 97ms
97ms XHR
application/json 185.86.139.96
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e7c38f6c15912c335bfe3f88236a15bcfcf02d6ae51fe6f3b13c0875a3b0459e

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:56 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 6%3b10%3b110
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 105ms
105ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-8g3p
alt-svc: clear

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 13 KB
7 KB 323ms
323ms XHR
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2877213304704200&correlator=2611823986057590&output=ldjh&impl=fif&eid=31063136%2C31062526%2C31063140&vrg=2021101201&ptt=17&sc=1&sfv=1-0-38&ecs=20211019&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_sidebar_1&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C160x600&fluid=height&prev_scp=hb_format%3Dbanner%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_adid%3D607e03a5dedd3d3%26hb_bidder%3Dappnexus&eri=5&cookie_enabled=1&cdm=femme4.com&bc=31&abxe=1&dt=1634662617060&dlt=1634662615707&idt=513&frm=20&biw=1600&bih=1200&oid=2&adxs=1066&adys=675&adks=647099778&ucis=3&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=308x0&msz=308x0&ga_vid=1538701705.1634662616&ga_sid=1634662617&ga_hid=79840439&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51f588cc731a1864bf3b7be6674812c941e3777a7dd7c5f2f19e2680bec21b00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7457
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E5ED 6 KB
3 KB 26ms
11ms Document
text/html 142.250.186.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 19 Oct 2021 16:56:56 GMT
expires: Wed, 19 Oct 2022 16:56:56 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 70ms
27ms XHR
application/json 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021101201&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad253b40d15b7519267f9a004f1b3f0016e306218da7ce98277f69efde61ab4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8536
x-xss-protection: 0

GET
H3 200 bridge3.485.1_en.html Show response
imasdk.googleapis.com/js/core/ Frame 4D45 577 KB
189 KB 23ms
8ms Document
text/html 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95031080831fd62b0946bfb827edf9279ddf3afa0711940b8d27e627f62046ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.485.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 193945
date: Mon, 18 Oct 2021 05:09:54 GMT
expires: Tue, 18 Oct 2022 05:09:54 GMT
last-modified: Mon, 11 Oct 2021 16:34:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 128823
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 2501 44 KB
17 KB 67ms
25ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2501 107 B
122 B 20ms
19ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
56 B 104ms
103ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-nt4r
alt-svc: clear

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 18ms
18ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 350ms
350ms XHR
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2877213304704200&correlator=3286160735889402&output=ldjh&impl=fif&eid=31063136%2C31062526%2C31063140&vrg=2021101201&ptt=17&sc=1&sfv=1-0-38&ecs=20211019&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_leaderboard&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C970x250%7C970x90%7C728x90&fluid=height&prev_scp=hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.02%26hb_adid%3D61b2dcdda93c0c%26hb_bidder%3Dappnexus&eri=5&cookie=ID%3D717a52a41cb98136-22107f63faca0026%3AT%3D1634662616%3AS%3DALNI_MbFMpgYUf_0VYtoc0tUxPaKL68miA&cdm=femme4.com&bc=31&abxe=1&dt=1634662617215&dlt=1634662615707&idt=513&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=71&adks=2602073323&ucis=4&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x25&msz=1590x0&ga_vid=1538701705.1634662616&ga_sid=1634662617&ga_hid=79840439&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d644cd5f37157b39a6384695873c073e3fa0252610e5f523dfabc21df9590f14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 8557
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 93E4 624 B
998 B 42ms
18ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhih_tKzATAB&v=APEucNVi5XiHBZ1EHXicY2SthDQ99JZ1luG6V-gsurn_55fF71X5DIN7_OgssqarP80ARFAsFwYdZEwVm14v0BnkZRe87pAIjg

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJW2SxDWo8rDAhih_tKzATAB&v=APEucNVi5XiHBZ1EHXicY2SthDQ99JZ1luG6V-gsurn_55fF71X5DIN7_OgssqarP80ARFAsFwYdZEwVm14v0BnkZRe87pAIjg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 19 Oct 2021 16:56:57 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmIj1YMAQVSkXfBqRDErTfJcbvJPu7BIadeQA161CtyKCElXvFBXjkBL3hG; expires=Thu, 19-Oct-2023 16:56:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E5ED 12 KB
9 KB 56ms
32ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMBo5PH2_RypifFmsi2VEbbyiVakzXy5-aRvBVKvZ9X1QGQAoJJBs4VgBlKoRSSximC4NfZHc0wSVMCyK2a8zHn7IuILQF91CoXJtPF-w9k0eHN7meOWDBgDTDyFp0NbwCZO-y4tncR6xw2tO3uAUIzRkuVw&dbm_d=AKAmf-D7cPSM9He1kNUVdEZVxoOKXQWaBzXzd_r_zjlHHmjsFeOLYVqDGu_Arc43mHUDK8TLTklNOT16fZO2w9o8JVlJN1Sp4Z-eqyHug51D-QTaD2kXbZ0fzfOSMoin5Sk4xy4ei3AzJkrAqxy3c5LIFwwY9FF_h27mF7Zb6E8pBsN1u3PhMpTF_oxX-jaUo-814_B2TzEOIusgfnFmiUcx3v57U7dwMEvSEtrmUQMmi0S-H0vQbmzaPgoViUkslImWYxEoZZl18-tgw3r_4J14517-iPvHa9feuPZCyEo06FMKBHhys_bQfnrzDHzhi51hF4vg9ZFBr46VlMDLO-hNoUsoknaq8s_27X01g-HP4JDwib4ps95lspufsGlGaWmk5GUvZhz260h3ll9yMV6NOd2PYg5JaD37xmU3VTVObek7cyqZcx6kQR2LoAarzR-ddtsEPOGIC1eYlXKrTYWKDxQBt7MKIoTjIzG7nawekEEZbO1sF-33TejkWl_ADDlItdZV-JycRoWeDpbQtG9eFcNFjskVasBIjqsA4TlGx-k4K_SxU0R9N4ytaUy4g_Mt-0botURRV4MecQlj48VmYZqU0_2GDDowVxVnpJJonTFYgDErliAzITkFRkX0_cuC2pFZRZ81pQ5xBp9M8eZdtM5KWiKubXJpLWKOGb7l8hinjOwPesKgCxfQn2H-5zq-i0pq3aFg0Oy0L7PZtlNI68Vgx0f1Hs60KWGORmvRbzyPnFSo95Y5yThu2wPPz6TvLivprEPL7zF_Cp-m2gRrbzXGxhHzVgwwINvAYjueF0S8SYGkMMCmtWSXqDE9oAcbYHWOVmChyubh6noFt-Jg9WVeGddvHeWIhIUbRrzuXyO02kujqsXxLxjEJwB_nlTZ81CjoX_8txQzO8H0mObCrWgakS39FJq-LQG4ScuYOrsAt4bnlgA5dhltDUGWtIY3wLKuXCcPdlORxTAm1WTPFD7yjRcLhpfQ-sfIj1vKaluKxbKTyTgVbSz8oyzvccrQg9I0qpYn5bQipbXR1gJ6f_CpGwTFECB-uriDX_GXR7WKoX8VP7Iw1Jup9qnsHqzPp09bchdvGYg8rAHWbN5xDVsB7yuYw2tx23v2YXSsIgST7f41DLlAm1euYu9McbdGv9xtzZr5HTYIKu382syFlpLLtTOgW4uUV5WwFg-pSbDATkfjhxxag5umO0aMtkmCXPj6OQAzBRwW_Vj87r5aU54nt5tFoJwpQAVmDgr_xqlTFSb6l4cnLQMW5_RD9WR0plqfcFI3VvBZfS6NUM3lT9Q9uBsd2pSnBbcyRYUk7IGPwRbDcDAnkjpsXmwR5F7TveC8F4UVkFJkWhs6Mg-QgGXTjBmmkyWO1saKsS2k3d01t5sGNsbvxDJ5AtlEVPFtze5pflC3fzLA8dxNKK7PtceRnJdgZDhFmZU-D5FZYXZ4yXFHkk9JXyUx9AJnC_Tk18JzLqa3rWFScuLCOchh0dE19O1qfKBV71PTpjDhWoQz_DkCnlP_B5W9klY4C9NzhXQU8G9Q66YD5B4VLLt6dOYbtFpcF7pojHVhOJ3z6sOSa60Z6Byn2ToB3LBV5yxIv29ew3sLsZTT7M3E1YQD7BNm7SrhfB3Io7IpQf5LMqpsWfOu507tv4huYAwqMQGriqIqHFb3jbusrHcdtK0Df1iJTYrIZWFnV1lOfCxcv4OcqRuni-XfFS9A8cfaJYaNWh9hESW7uKwCpdXMvzFvEV1OE0uwnkDvDRiC9qql_3F_fUotd7QGsLgq08s9GqjXwtiFxMgfE4_1hEKD15sQuQU2qFXd4XPf9x2jkponiKSaIeUCcHWs4D6f-A5id316HUtqJ66R7bVoOduai6aze6D3q1SxKtEPxMHfZF4KsSvBVzg9fIT-9hxaHPzhmgeZjrNHn1CgZ-e6xXC8BGIHmuYxqW2JVH24BF9bVwkH5xgFRmUyWY6aiHLZKg0wHmvr1-kjWeqWrAIAZA-ZUKaR5DquWpqNFc9NqlfSdfqa6mCDtW7sYyOfyQ0pSGfnKQgixQ2i2gZExgHoMKWO3ebwpikR-gZc2oKLP2m5D6VB1p_W0_o1-C2soDW8oyhbXQeLvAwJMPaEjABFiYCWhHoEKQQ1zE_Ju63eHhIK_AHwDvqYgnCGk95fprchgNXxl5s7rLDFAN1qAL030D1Tf19mIT1qC5y92i8txnPCinO_Y-6yArBOgLkIZFhfm-qalpjOtAeJ99rDDcwzuSKc2NqEoDvsFNERDZRT8mJCgnbod7mq7XDn8hfV7fvz__7PId-edLnApqvbzn1udhx3Yeejqiw4QqH672dLNEYdq15SgpnJPmwTT89FWxJsygeBJn_3A7zpw9ehPrEX72_wIu7EWpadPMpsnPFNnN2SSzZtKAARz5Vffdcsx2QZsjGAwdO8rybahsxqazp3PYibXPkyvsWqChOQ_vaLY_L9R7U0c_8YvshzYY-BpH_FtHNPExBTkrY4ErRO-hqVObvNbrgjsqlakaRuK4n2eivpXzodF1mWqQZaOcgr_XmihM3AdTHs7g3lVXYKOhwuJY1uvz0vH-P26n1IyQ&cid=CAASFeRoRgCHAIrZuWAsLfIPLH32iLy3Sw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b62793569d03b6e606ac4515c33d25a4177efc660257c29f3955d48072a46b6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8840
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E5ED 42 B
63 B 70ms
47ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ActuPWMPZ2nUFUDJO_QcHNnCWmWGXzDK8zkMWxI_RrNe1x5A4XSvJWKOCWNFT2Hc_C8Z-uIy6c8NMQeyhn3iyGT4J8sbpbsuIHe1E4mju1vn4ZzsU

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame E5ED 57 KB
19 KB 91ms
46ms Script
text/javascript 74.125.71.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXAZ8aUWvovVB_AEpsI3rRDjv5oXdyS7R5f397XTRrZIfR-NWc&d=CnkAoCZ_4OJaj9Oilkj5-AZcxxTPYVocK87b6GrwBdRC5S4fxUZR_cmfzKsf4ZleJ2zU5X8KuIWv3GDqHKX6bUU1vWMZ6pmXbRQSzkaFadylHdVroMo48ZHM71thy8UyyzvD3kRCCo78Ik91XmHLdlZVXmPzg6uuX-xcEokSAKAmf-Clgvgbw4AEeXODpppZcOnJzQsky_JA4Id3fO9Nq1x1mypRgLhW1_cVie8MVFA5YtovseqhsUh4DUjJCHNGVUO6NkMyyqYhxsenSyPwdP3VXxjTwWtNYih_9ecf4xv4QDbx1f2Lr5a9HmUXdF01Vhe_pYAjzRUCgskNHd6I6bFPXAFkHc1AH1IEc2T5oTL526ajHLBRbwIyIv25mwmY6CYFwSvkeG5dgX1zLskvMNS2g0IxMF2yqeMinOFZdX6FW4vM-cdLaWfHE5_BO74gFvRuBWMPKoxOSdEhkjAPuGqhMDl1RA9kVB4Xi8TRooz7sNINMc9EyOEHiKt2_R6KwvUSbESViuP28bfJMxGbZZEBVtX4RK-93PierYDtlgr69Ea6uAAZhZFCBdAI28qH2WjiLLqDqi76Pjs-Lj22xt0sUHkbpIEJBBhIeF-D2pegDzLyPnwny8ShGsnbrUH3XdXlDHfRFVUakm4ofRwAxa5RXOcohq-HgSrmynxh8l33FsXUGSs5FVx1UXuGshbVqEt_X4JuRh1whvo52n00U_qFBs8-rstCpYdtgTCZI4A7FwlEojMZG9e7sIrFwATF37mXUaP2iVMRF8jMrjURfVjF7szCgtOtEzwul6ZJ3rw4lPLS3l0akdK4FcyhDXMjuQ9h_87LDKep0MKnPy5ERpc8DXagpUJTf7zFNVAPciBER-Rx0g-dtWmHrsGZzOyKWVyqkUhyrT8aBmAvX6lRIgdbIqDXQ0rCajFFd-6f40bJYyPzPCm4XAxwNO6nFtclI8qc1sgFx-P6aV6tPQJ_pQcNK4oPA7vEPHRxv6kOslWlXmZg-za7rPuEJg3nbwy_XVHMNxwvbxo3JSE9Fex7lAd6Em2bz4AK3MYELe5Jc8_f5JlSzD0FCmG3MTDE-YkuTALSyXR0z3Faut-2xpiZJDpZA8Ey37T_t9zHnLWGCh1z5s_tvB0yAihmuZibr_CfvQJudpIyFmax_5ZnVwMw3i5fnlAiZfsBvVYmheC80z-M8lOA2Epw8bevou9IOiJFaNZVMq_ZdGBOW5s7LGyq6dB63Bfzvy3EX_W9BG5cGZTpBnfUXWF9lpEo326V-hVzHQGXS5zCVfLt1Z1akV7SR02ZZT40D92S6_HtDLkgWQsaY8BYNuJlZJBhvtmYeftRyy07grJcgEgSG6thMhvqh6w85v8MF5MRjrW-V7n57K4bPwVcAol9MuGE2Fh2NPEqflI5VUmKuFsEves7MRVwq3J26_Or3v-N6gVzveyq0SqfrtYU5dq7o0KRsA17IQfedF9nK1ozeq0lawpF5NrKC9yHZSdAmn47EVY8cp0oNWepYM77qM2TjUFezMgPEbUFrcWNMUsZUOlIub9QBvCZkRccsu5IuQEsdf9e46qNCHOK4IPQxsBbiOk4Y3HEj02N7i9pE1cy6u7Ib44ZCqdpRnUqSIycFsgQHOQGjmcp-9K7fI-rpMOfiMmUCF8rIxWfkikBJUjljafQh63NtrB5uVcqttPb2N3aiHssqSXr1YzXQownK-6ZJD9oWTOIHKt7TWHpyAoTPnHKdFNYY-gmfTV9TAWx7fP43P8DgH6nx7Htydb5EGdnGoBNg3N89X5K2bPAFvuNJ_LpUIvSWecxHZ9SifynqJgQaEi6xlAAksEwr8eoc5SzozpI2Sa2ebBkjBh-hLj9U2mdtmUOEJTsGM_0gvHsk9_eWAD93asLJcvB9VTuK8f8rb9_yVH1KJcttGcFsIx5jbd9bCncbSwVxmmRjPo0f9T4KKrVd-CgBAE_BuBqRLmeNJWupu9cG2oKWtEDB15GoKEn2swfLVKzIeN2d8L974dCiSwe_nSnMeR_dt563NbV9mCWAtiQiz0gQmjyqktn2VkpCdoC-v4pm5Rlel0zNR5E8mM5RS5kQX_7An3EFXguL-LdFdCgz3ksPWjhcHx7VQhzaJgkPk-_9AIxs8GcQvlRYL1Xh9jDITeAE-vDPE_X5tX1zaFjqHEeQf3uf5ykJKuqSsymm4_hbB3S6GJHFBoVT2ayPe9KKkrPhwxVHSEvQa-RxBn8RE0VxyO07PmdPsQg4tdJDniEQ46etBOgg6V7n5a6NFoy503tG0rANIo_3OKwqUJHxEbS2aGjkwaxfTB8XxVgg19jOUFg-cJK4nNhkRPo9HVDkvaIZn6ZcsCRPl0L3clS5dpmhzkY_EtJSDca-P_C9u9qpKMDlRTtUW7bH21aZ1xB9J5YIQAq0KkKIquoUs8_pVBpK_zBkA0juLIzwFycCC2O4QoFQms12Lb6JsAdMnDWESJMWb6GZ3epoF7JJd4cGXuoZaSfXs2-7kDNpQiBS1zTLHRPosBEXmIaRIXVKbdNnolSL8P53azlJMpQO_Q0KYJM9w6fzkD5FZmsrtjZLCKLP7OnMDwYA1CD9Z8pD7wgb20y5asUZNI0BP8oB_0PHFY2m8MujtfbT1G00FPqiISLeODOUELVl1KJN7IrPyuQPxWZs8hEJHkRPxfpjSw8cyFAAti9TVr0dqa01yyel2FZtDAz0NE8b7pI1Nbem9CnYUWTLpAh50tsh7YaaRa70vTE_5E_sSoZ9P_uQ01FEesv-h0tSeSiZn3kVA39urnTw1widBEAbNttcHFP9Ge2HaifFzekyJlVOEdpxg09N8VPHgmOw2NiNEkRSr6R6mwez2oERQNEPPRCvSJhjkVcEpdTXeoRemm9SADHiIqoRa5TzoFSqAT1__PumMKr0qDmYO9lTACSDvKn4gHSxYxHDvcvsHGZO7SVkYyCCyI3qgXeRl2YJBAT4OKvLlDadlpxRDS_B6zYfXoIQlujycpV0LW9UtwlWpB85BR-VYtP_rh-R1TWvrb1z9kCHE-QszhyVDZSw4J2dYegtmUj2Inxk5cSN4-reTUnkXvqVES3ooRtVwCdw1zg2y6Wk_HSleRgGBs1n49Y9BFiMDq50ksMoyilIB8k0bl6wxXMyZzPvA0RFBjTHQwJBedXLUcCCwtxx5X5wiVuuRdJNco1cBQel0x5FiCEL3Yj9yEf-pVzkN568frdpsrNuJO1_p4WBu2cOql214njPHqGGhkIABIV5GhGAIcAitm5YCwt8g8sffaIvLdLYAE

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.71.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53a22397fc1c2af5430e94fbf943e179085fc19edb76e2e6a1132c29ef5f8bed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19128
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame E5ED 27 KB
9 KB 41ms
8ms Script
text/javascript 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont8&w=728&h=90
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 16f561250d2639560a1443b9ba16ef46c45027d56c08361cc6e2e5620426b3fe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 11:16:00 GMT
content-encoding: gzip
server: nginx
age: 20456
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: bNgMppXc0UPZeCKB2uaKodPs0mi19HNndG2KXrgjqLhisiP8h7xO4g==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame E5ED 3 KB
1 KB 31ms
7ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:55:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:55:58 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E5ED 123 KB
38 KB 45ms
15ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame E5ED 14 KB
7 KB 29ms
6ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:54:55 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 38ms
19ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H3 200 container.html Show response
d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 897C 6 KB
3 KB 8ms
7ms Document
text/html 142.250.186.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 19 Oct 2021 16:56:56 GMT
expires: Wed, 19 Oct 2022 16:56:56 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame E5ED 41 KB
15 KB 23ms
7ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMBo5PH2_RypifFmsi2VEbbyiVakzXy5-aRvBVKvZ9X1QGQAoJJBs4VgBlKoRSSximC4NfZHc0wSVMCyK2a8zHn7IuILQF91CoXJtPF-w9k0eHN7meOWDBgDTDyFp0NbwCZO-y4tncR6xw2tO3uAUIzRkuVw&dbm_d=AKAmf-D7cPSM9He1kNUVdEZVxoOKXQWaBzXzd_r_zjlHHmjsFeOLYVqDGu_Arc43mHUDK8TLTklNOT16fZO2w9o8JVlJN1Sp4Z-eqyHug51D-QTaD2kXbZ0fzfOSMoin5Sk4xy4ei3AzJkrAqxy3c5LIFwwY9FF_h27mF7Zb6E8pBsN1u3PhMpTF_oxX-jaUo-814_B2TzEOIusgfnFmiUcx3v57U7dwMEvSEtrmUQMmi0S-H0vQbmzaPgoViUkslImWYxEoZZl18-tgw3r_4J14517-iPvHa9feuPZCyEo06FMKBHhys_bQfnrzDHzhi51hF4vg9ZFBr46VlMDLO-hNoUsoknaq8s_27X01g-HP4JDwib4ps95lspufsGlGaWmk5GUvZhz260h3ll9yMV6NOd2PYg5JaD37xmU3VTVObek7cyqZcx6kQR2LoAarzR-ddtsEPOGIC1eYlXKrTYWKDxQBt7MKIoTjIzG7nawekEEZbO1sF-33TejkWl_ADDlItdZV-JycRoWeDpbQtG9eFcNFjskVasBIjqsA4TlGx-k4K_SxU0R9N4ytaUy4g_Mt-0botURRV4MecQlj48VmYZqU0_2GDDowVxVnpJJonTFYgDErliAzITkFRkX0_cuC2pFZRZ81pQ5xBp9M8eZdtM5KWiKubXJpLWKOGb7l8hinjOwPesKgCxfQn2H-5zq-i0pq3aFg0Oy0L7PZtlNI68Vgx0f1Hs60KWGORmvRbzyPnFSo95Y5yThu2wPPz6TvLivprEPL7zF_Cp-m2gRrbzXGxhHzVgwwINvAYjueF0S8SYGkMMCmtWSXqDE9oAcbYHWOVmChyubh6noFt-Jg9WVeGddvHeWIhIUbRrzuXyO02kujqsXxLxjEJwB_nlTZ81CjoX_8txQzO8H0mObCrWgakS39FJq-LQG4ScuYOrsAt4bnlgA5dhltDUGWtIY3wLKuXCcPdlORxTAm1WTPFD7yjRcLhpfQ-sfIj1vKaluKxbKTyTgVbSz8oyzvccrQg9I0qpYn5bQipbXR1gJ6f_CpGwTFECB-uriDX_GXR7WKoX8VP7Iw1Jup9qnsHqzPp09bchdvGYg8rAHWbN5xDVsB7yuYw2tx23v2YXSsIgST7f41DLlAm1euYu9McbdGv9xtzZr5HTYIKu382syFlpLLtTOgW4uUV5WwFg-pSbDATkfjhxxag5umO0aMtkmCXPj6OQAzBRwW_Vj87r5aU54nt5tFoJwpQAVmDgr_xqlTFSb6l4cnLQMW5_RD9WR0plqfcFI3VvBZfS6NUM3lT9Q9uBsd2pSnBbcyRYUk7IGPwRbDcDAnkjpsXmwR5F7TveC8F4UVkFJkWhs6Mg-QgGXTjBmmkyWO1saKsS2k3d01t5sGNsbvxDJ5AtlEVPFtze5pflC3fzLA8dxNKK7PtceRnJdgZDhFmZU-D5FZYXZ4yXFHkk9JXyUx9AJnC_Tk18JzLqa3rWFScuLCOchh0dE19O1qfKBV71PTpjDhWoQz_DkCnlP_B5W9klY4C9NzhXQU8G9Q66YD5B4VLLt6dOYbtFpcF7pojHVhOJ3z6sOSa60Z6Byn2ToB3LBV5yxIv29ew3sLsZTT7M3E1YQD7BNm7SrhfB3Io7IpQf5LMqpsWfOu507tv4huYAwqMQGriqIqHFb3jbusrHcdtK0Df1iJTYrIZWFnV1lOfCxcv4OcqRuni-XfFS9A8cfaJYaNWh9hESW7uKwCpdXMvzFvEV1OE0uwnkDvDRiC9qql_3F_fUotd7QGsLgq08s9GqjXwtiFxMgfE4_1hEKD15sQuQU2qFXd4XPf9x2jkponiKSaIeUCcHWs4D6f-A5id316HUtqJ66R7bVoOduai6aze6D3q1SxKtEPxMHfZF4KsSvBVzg9fIT-9hxaHPzhmgeZjrNHn1CgZ-e6xXC8BGIHmuYxqW2JVH24BF9bVwkH5xgFRmUyWY6aiHLZKg0wHmvr1-kjWeqWrAIAZA-ZUKaR5DquWpqNFc9NqlfSdfqa6mCDtW7sYyOfyQ0pSGfnKQgixQ2i2gZExgHoMKWO3ebwpikR-gZc2oKLP2m5D6VB1p_W0_o1-C2soDW8oyhbXQeLvAwJMPaEjABFiYCWhHoEKQQ1zE_Ju63eHhIK_AHwDvqYgnCGk95fprchgNXxl5s7rLDFAN1qAL030D1Tf19mIT1qC5y92i8txnPCinO_Y-6yArBOgLkIZFhfm-qalpjOtAeJ99rDDcwzuSKc2NqEoDvsFNERDZRT8mJCgnbod7mq7XDn8hfV7fvz__7PId-edLnApqvbzn1udhx3Yeejqiw4QqH672dLNEYdq15SgpnJPmwTT89FWxJsygeBJn_3A7zpw9ehPrEX72_wIu7EWpadPMpsnPFNnN2SSzZtKAARz5Vffdcsx2QZsjGAwdO8rybahsxqazp3PYibXPkyvsWqChOQ_vaLY_L9R7U0c_8YvshzYY-BpH_FtHNPExBTkrY4ErRO-hqVObvNbrgjsqlakaRuK4n2eivpXzodF1mWqQZaOcgr_XmihM3AdTHs7g3lVXYKOhwuJY1uvz0vH-P26n1IyQ&cid=CAASFeRoRgCHAIrZuWAsLfIPLH32iLy3Sw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 21:12:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 17 Oct 2022 21:12:41 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 2E76 12 KB
5 KB 13ms
8ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 19 Oct 2021 16:40:30 GMT
expires: Wed, 19 Oct 2022 16:40:30 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 987
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0523 783 B
1 KB 63ms
25ms Document
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

dbe426665ddab54b65dec8529331544add0fc8904ec19daee4aeb80ae029d3bf

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TgEQI6FEsL9k9/RaXcW8qA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 19 Oct 2021 16:56:57 GMT
date: Tue, 19 Oct 2021 16:56:57 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-TgEQI6FEsL9k9/RaXcW8qA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 4D45 24 KB
6 KB 241ms
241ms XHR
text/xml 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=210717225781095&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.485.1&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=8B823963-A793-448D-9EC0-3E7186C4571A&eid=44750820&url=https%3A%2F%2Ffemme4.com%2F&dt=1634662617350&cookie=ID%3D717a52a41cb98136-22107f63faca0026%3AT%3D1634662616%3AS%3DALNI_MbFMpgYUf_0VYtoc0tUxPaKL68miA&scor=962725078891107&ged=ve4_td1_er29.-2164.182.-1864_vi0.0.1200.1600_vp0_eb16488

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7039b4935879617f92125077f41acd1134576ab97cdd8fed4e52d77123c00812

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6531
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 93E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1

43 B
1014 B

27ms
13ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhih_tKzATAB&v=APEucNVi5XiHBZ1EHXicY2SthDQ99JZ1luG6V-gsurn_55fF71X5DIN7_OgssqarP80ARFAsFwYdZEwVm14v0BnkZRe87pAIjg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:57 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 93E4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YW742NdE85lWkO3vXgCJ2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1

43 B
894 B

18ms
18ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhih_tKzATAB&v=APEucNVi5XiHBZ1EHXicY2SthDQ99JZ1luG6V-gsurn_55fF71X5DIN7_OgssqarP80ARFAsFwYdZEwVm14v0BnkZRe87pAIjg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:57 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 93E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFlm6k-Yx0tOnEn7lU9RAHU&google_cver=1

43 B
1006 B

123ms
122ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFlm6k-Yx0tOnEn7lU9RAHU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhih_tKzATAB&v=APEucNVi5XiHBZ1EHXicY2SthDQ99JZ1luG6V-gsurn_55fF71X5DIN7_OgssqarP80ARFAsFwYdZEwVm14v0BnkZRe87pAIjg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 570ff1e8-955c-4ca7-95b2-67a4fb35eecf
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFlm6k-Yx0tOnEn7lU9RAHU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 93E4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

170 B
243 B

20ms
20ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 052a3e53-02d3-4776-a617-e39b9576e17c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame E5ED 114 KB
39 KB 39ms
15ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Origin: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 11:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21069
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 11:05:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/ Frame E5ED 8 KB
3 KB 17ms
15ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXAZ8aUWvovVB_AEpsI3rRDjv5oXdyS7R5f397XTRrZIfR-NWc&d=CnkAoCZ_4OJaj9Oilkj5-AZcxxTPYVocK87b6GrwBdRC5S4fxUZR_cmfzKsf4ZleJ2zU5X8KuIWv3GDqHKX6bUU1vWMZ6pmXbRQSzkaFadylHdVroMo48ZHM71thy8UyyzvD3kRCCo78Ik91XmHLdlZVXmPzg6uuX-xcEokSAKAmf-Clgvgbw4AEeXODpppZcOnJzQsky_JA4Id3fO9Nq1x1mypRgLhW1_cVie8MVFA5YtovseqhsUh4DUjJCHNGVUO6NkMyyqYhxsenSyPwdP3VXxjTwWtNYih_9ecf4xv4QDbx1f2Lr5a9HmUXdF01Vhe_pYAjzRUCgskNHd6I6bFPXAFkHc1AH1IEc2T5oTL526ajHLBRbwIyIv25mwmY6CYFwSvkeG5dgX1zLskvMNS2g0IxMF2yqeMinOFZdX6FW4vM-cdLaWfHE5_BO74gFvRuBWMPKoxOSdEhkjAPuGqhMDl1RA9kVB4Xi8TRooz7sNINMc9EyOEHiKt2_R6KwvUSbESViuP28bfJMxGbZZEBVtX4RK-93PierYDtlgr69Ea6uAAZhZFCBdAI28qH2WjiLLqDqi76Pjs-Lj22xt0sUHkbpIEJBBhIeF-D2pegDzLyPnwny8ShGsnbrUH3XdXlDHfRFVUakm4ofRwAxa5RXOcohq-HgSrmynxh8l33FsXUGSs5FVx1UXuGshbVqEt_X4JuRh1whvo52n00U_qFBs8-rstCpYdtgTCZI4A7FwlEojMZG9e7sIrFwATF37mXUaP2iVMRF8jMrjURfVjF7szCgtOtEzwul6ZJ3rw4lPLS3l0akdK4FcyhDXMjuQ9h_87LDKep0MKnPy5ERpc8DXagpUJTf7zFNVAPciBER-Rx0g-dtWmHrsGZzOyKWVyqkUhyrT8aBmAvX6lRIgdbIqDXQ0rCajFFd-6f40bJYyPzPCm4XAxwNO6nFtclI8qc1sgFx-P6aV6tPQJ_pQcNK4oPA7vEPHRxv6kOslWlXmZg-za7rPuEJg3nbwy_XVHMNxwvbxo3JSE9Fex7lAd6Em2bz4AK3MYELe5Jc8_f5JlSzD0FCmG3MTDE-YkuTALSyXR0z3Faut-2xpiZJDpZA8Ey37T_t9zHnLWGCh1z5s_tvB0yAihmuZibr_CfvQJudpIyFmax_5ZnVwMw3i5fnlAiZfsBvVYmheC80z-M8lOA2Epw8bevou9IOiJFaNZVMq_ZdGBOW5s7LGyq6dB63Bfzvy3EX_W9BG5cGZTpBnfUXWF9lpEo326V-hVzHQGXS5zCVfLt1Z1akV7SR02ZZT40D92S6_HtDLkgWQsaY8BYNuJlZJBhvtmYeftRyy07grJcgEgSG6thMhvqh6w85v8MF5MRjrW-V7n57K4bPwVcAol9MuGE2Fh2NPEqflI5VUmKuFsEves7MRVwq3J26_Or3v-N6gVzveyq0SqfrtYU5dq7o0KRsA17IQfedF9nK1ozeq0lawpF5NrKC9yHZSdAmn47EVY8cp0oNWepYM77qM2TjUFezMgPEbUFrcWNMUsZUOlIub9QBvCZkRccsu5IuQEsdf9e46qNCHOK4IPQxsBbiOk4Y3HEj02N7i9pE1cy6u7Ib44ZCqdpRnUqSIycFsgQHOQGjmcp-9K7fI-rpMOfiMmUCF8rIxWfkikBJUjljafQh63NtrB5uVcqttPb2N3aiHssqSXr1YzXQownK-6ZJD9oWTOIHKt7TWHpyAoTPnHKdFNYY-gmfTV9TAWx7fP43P8DgH6nx7Htydb5EGdnGoBNg3N89X5K2bPAFvuNJ_LpUIvSWecxHZ9SifynqJgQaEi6xlAAksEwr8eoc5SzozpI2Sa2ebBkjBh-hLj9U2mdtmUOEJTsGM_0gvHsk9_eWAD93asLJcvB9VTuK8f8rb9_yVH1KJcttGcFsIx5jbd9bCncbSwVxmmRjPo0f9T4KKrVd-CgBAE_BuBqRLmeNJWupu9cG2oKWtEDB15GoKEn2swfLVKzIeN2d8L974dCiSwe_nSnMeR_dt563NbV9mCWAtiQiz0gQmjyqktn2VkpCdoC-v4pm5Rlel0zNR5E8mM5RS5kQX_7An3EFXguL-LdFdCgz3ksPWjhcHx7VQhzaJgkPk-_9AIxs8GcQvlRYL1Xh9jDITeAE-vDPE_X5tX1zaFjqHEeQf3uf5ykJKuqSsymm4_hbB3S6GJHFBoVT2ayPe9KKkrPhwxVHSEvQa-RxBn8RE0VxyO07PmdPsQg4tdJDniEQ46etBOgg6V7n5a6NFoy503tG0rANIo_3OKwqUJHxEbS2aGjkwaxfTB8XxVgg19jOUFg-cJK4nNhkRPo9HVDkvaIZn6ZcsCRPl0L3clS5dpmhzkY_EtJSDca-P_C9u9qpKMDlRTtUW7bH21aZ1xB9J5YIQAq0KkKIquoUs8_pVBpK_zBkA0juLIzwFycCC2O4QoFQms12Lb6JsAdMnDWESJMWb6GZ3epoF7JJd4cGXuoZaSfXs2-7kDNpQiBS1zTLHRPosBEXmIaRIXVKbdNnolSL8P53azlJMpQO_Q0KYJM9w6fzkD5FZmsrtjZLCKLP7OnMDwYA1CD9Z8pD7wgb20y5asUZNI0BP8oB_0PHFY2m8MujtfbT1G00FPqiISLeODOUELVl1KJN7IrPyuQPxWZs8hEJHkRPxfpjSw8cyFAAti9TVr0dqa01yyel2FZtDAz0NE8b7pI1Nbem9CnYUWTLpAh50tsh7YaaRa70vTE_5E_sSoZ9P_uQ01FEesv-h0tSeSiZn3kVA39urnTw1widBEAbNttcHFP9Ge2HaifFzekyJlVOEdpxg09N8VPHgmOw2NiNEkRSr6R6mwez2oERQNEPPRCvSJhjkVcEpdTXeoRemm9SADHiIqoRa5TzoFSqAT1__PumMKr0qDmYO9lTACSDvKn4gHSxYxHDvcvsHGZO7SVkYyCCyI3qgXeRl2YJBAT4OKvLlDadlpxRDS_B6zYfXoIQlujycpV0LW9UtwlWpB85BR-VYtP_rh-R1TWvrb1z9kCHE-QszhyVDZSw4J2dYegtmUj2Inxk5cSN4-reTUnkXvqVES3ooRtVwCdw1zg2y6Wk_HSleRgGBs1n49Y9BFiMDq50ksMoyilIB8k0bl6wxXMyZzPvA0RFBjTHQwJBedXLUcCCwtxx5X5wiVuuRdJNco1cBQel0x5FiCEL3Yj9yEf-pVzkN568frdpsrNuJO1_p4WBu2cOql214njPHqGGhkIABIV5GhGAIcAitm5YCwt8g8sffaIvLdLYAE

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:46:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:46:29 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame E5ED 23 KB
9 KB 16ms
16ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

599ad71fae7cb8d014f7c2d29b8450bc7c34f8e32d49fa103716becef8ae9964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9283
x-xss-protection: 0
server: cafe
etag: 1044373809082006429
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:55:15 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BCB4 624 B
297 B 34ms
19ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhjt_tKzATAB&v=APEucNVF62HzgF9f1eS6RqPZuIhhGro2-lMoEN4WyF7Yx85XOT6lvn2xWfX6dmd6je2y6cQubTUqYqte3SC7QppPW8Hl1u9MYg

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJW2SxDWo8rDAhjt_tKzATAB&v=APEucNVF62HzgF9f1eS6RqPZuIhhGro2-lMoEN4WyF7Yx85XOT6lvn2xWfX6dmd6je2y6cQubTUqYqte3SC7QppPW8Hl1u9MYg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkzsWzsWPIuTqb3yAHlZbmZ6uex8H8hZg07UiFtMOkYlgqlZrcls6mTmlPtE74
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 19 Oct 2021 16:56:57 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 897C 12 KB
9 KB 51ms
36ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ACJHI3S0R8vQR9z6Lu_KLgb_Zs1tdqrGMa0f_tSkYGIU66wEqH9nujtsUU3syWhYhIoFIFr11Dz3TWgu_PUweTZTSOAMq9kkBlDJLhSE1DHpDTvGQf8kFyYAzBzjc63hQKKjTzqrJbSJx4zHe8hll6NsHk7g&dbm_d=AKAmf-B7yPm2E3DAiIAQK33E1DI-HXfMvNL6Hj3QqSoSS-9wOcXA0SZmiKK_Ey6enml8SgL2eYjCP9s9_8metRDSgfXjNJeasx6l-gdCkiI1oVspftlq8-cEtA2YPy7ljlgHezqGU5OF4xZP1k911fkh13Cq8TWfKrzbo-A6E-MudvdpsBoFasCArqY8jM_qu7q_bBkYR0C9yOrlO7h05DJAlRf3isX08-DE8oi77Y4cpgd8XOh2X7kIgU7F5964y8CRMULv1w2r70w55QA3uO25x47M1EhSMkEVCw0-5vmoxbTr0_R5suT4ROc_jl_wApumt9PLPJuAwarhpR0iunnsS005aavG6HGO7xBFNWsJERut8uYUwJylLEel1ysO_mLQCQSIET1wTNlo8pXgJLsyQ4jYBzY8KzrGQVOKVSTZ8uEYi78aMtJqVnfKewpjBn1N4kED0EJ_nzxpVcaVcWAL-QXmEZREkUEW6KdLocXJPJCQAkC-XgP4wYZZIjUbIDhkstIQEdx7OaHikTw1RZ2kHYaDfS-iZ46UWMh41tIxNnyokJ1Naboh9b8Me_r93TAMNktBzk3XA7oW4qtAPrAlX2IHCupYrHYfu-NqTPFT_QVGyrypYF7kES2-XJ9tbiAeWJJQOcVjbP4srZnAkr-2WS5wcIM3dmYzZIMSRoMhv-AC30TjeqDdPXtrUOmsu8dX9RLq7FXrYqCYNo1MANASc3GFKiYPkSQSMNk6OBYlKb87twuoLzt0sIesXkTjF27a9Mqz6mGFESdytc9IgEsjjBbjyIwImPlQmsPNtaNf8eOuxZjh456LcpVSc39D5FuelefEjp2DwAWGssHIFpveWYDSgvrLXcA8gWBDJFibAjOsANkSyQ6Zhzui6pyqcYiGhVdVtb_cEZFYrs6cKOc7ZsSIgrBcqB-bn-BOk6bp_ap7uWjSKHQ87kPMMYpteGfZD0aK-ODp2lfFHIlYkTsDrpHF760kCWeIqji3OHhDvt8K6qjdLEeYjmeoZ4rSpa1pvwADaSJC72nFZDy450kTAJ8cU_YjShkr_rNYzBhz5ApIedVj9UWLA-XxXmAJpgk1ya3vJ-g2Pq1k1IUMdQg2UPcvBg518lzXZyTn3J_Ek-y3ePxJYd3V2LtYAsXT9CaR4ubVM9pJ5toKWhSn6s690UySQvtId15VbBH3j4j0jc_Q1FRI-hOoOzWgcfMlGEDwcEM0Argzc8Tr2YnXf9I7TYPtVqvvV508i6vL0cUSR01vsq9U_iTF8jYNTBfAvIBKnbTQ24cA05qHlIsGW9r9vKasz0_WLl9FuQaCPXgY6Tl1zqxqCU7mXnrz1T9csmrd14smUzL49qvBWsTXG1mceG6kp-2xq2HYru5bKXIyHIQdwhISUiRUHLI_PfxDXXXHOSVHB1hAEuDCzCGB2KSOChfhO-1rJ2YPcAgvm48KoTbcEMy_caz0r53SD5lFOk4OMlvz3O9HcpzW57IwT5tjF8-6XcZfH6jfXrEiTZXydl90Tt22azHvIHxni_o34pquF0ZlQXswY4-iyKQOmL2omhVgxMyHs7fIgfYMt5qNh5AbNToXxB5wGTqefXCB54cfyfC_GNDn9myrdeFr1j1NoSTYf-S8NiT56J8hD-7fZPoESNUIX-Y8r5582gVWyuQUCBqBVNPlYc0uE8JDOrwiivdFq1Tl_NDuxJfMf9ikW56LWkkbnJCVHYUJ_D231Nt3pt2pjBrJgfP2QwIlYNSYMPJPv2rUqf8_F7JwD_hdj3Zd3gb57WaNhP8thR9g4688ZKcI1M0bFuHscbsuxwQFjFPrhKK7fVGBf5d9nt6QN1kRAkGUJWcTFMVePRGogsemoOP8olU-euHE66DVeKT8SxSgfT3M2hGwQotJLkZYalKhQnzUmlfgmR9Ius7XsKv_h0D4j4KM7Q4cQxDkz64qdDoGQ95EF_tb76z3ofeO8wYObTffZUXcPd_nl7wn4ATGgdyoPqVKmhNc9_qNdHoyvWXt4ePz2ErOooRiWKCT-CzbF3VaBD-AfFKn23BPL8wELdEmjRyByIu8wHldiNoOfmAYLqrAuiWfR2rHzySb3SvN54f9gQBP80FUt0f9hZCjP90v00DozvSgeXk2qdhc3oGbLAURUsFN7JVkYcMozXEygRYxcTOS4tU9HSc6LUFG5LMpqFEZDHjZ4YAxU-iNBPbhsc5KGgUzU1fKUjIx2C2su4F32lrmTmO4vWnqcW5TFy3ePKbdHluggaiYaclrW84fnutvBwLnne3Iunrx7-LoRiieSY6Ga4JiRsAk2af7zmEPZmYOhsBzuU2-KAPV2I0gt_JdKRCGWPPn854DxtjkkXoSTU4DR7NXKRO1dsRRBsWhaNAPjBRzzNGc_M1DMwafYc3lvcOqGywhw8lEuhxRSVICI20aMkiWNj98WAn5yIy0hjC4IVQJ5G6P8Oc3sak-v-P9jUE3Morjl1ShLEg6yWsh3iewB9GmTsUUOCf-4tnBvnesD_DbHROvfuwHop9Pu42x4P4VY61x8As-LQM2xzgGuD2_0hhnXRpNHAni7X2hZE86SwFggmhQoUkWTLkHVt5PxQ&cid=CAASFeRouMW7hp0SNS_xXZbwgfHSuNBrbw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b87b1ea827a23459bb825809e6cb65053bf3ba9a27093d34e9485e539695a180

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8806
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 897C 42 B
63 B 49ms
48ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CxmDVzGvlYYSS22Bzrz94Cajra1_QoD0pSF8f0VKGqVQaMzsRk1dlxnw-D0JaYSpYYFmZ-9MJfEXBMdHGIqwHrAsaIp5KBNt-i7t6DbCfwfWvF6XY

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 897C 57 KB
19 KB 77ms
52ms Script
text/javascript 74.125.71.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXjzL6wT50NKHrVvnVYuDTzXJgolMuCI9CLLBrUBF5BG_ERTuU&d=CnkAoCZ_4OsLLKGNyFLLZ-_3BZYA115vQjgCwodPVywx7Xu0DyxgusTNWMcyeGsWs1p-os6kPUYqGzJDVLYzfAyAC8gMBs-ech_4MAhOUy2gTq1X_woPEZ6Vs7RJddj6v26xzXpSOvmcWTSosfWt-b0Gzv_ELXMZInoCEpkSAKAmf-BcHzbgHfzupEdM3a9_KoVNsP3Zfp4glngGMWrXnZbkNePRjj_vMQFqvFgHa5b12X2wzkNTLm7U8xrckaVYL1ojXR7FRypIVReXpALagJWMx_rhdYA021UFfeRvgqBCKc9nLnmqvu5qaWaQb2zACPmb_XcBwMIKc3abRWyIBTFPnCXhY9QkzQNo6m-ajS01yH58pcppACr2Aif7oW2a-muZnGxsiAQMU-zM-NXco1ttBP77nFoF5Aq-v8KeC-GjUIol6ZVC98zIMvg-CL5juQLAEsFW8CT6lFjkhe-KDYLA51wFDOvQ_Fj4GaQZStCXouGf-YtY1wCCPsJjsNivYFWKBZwVmJ65JchvP0UiOOXB3N0ja54VyTR19DSt-ko4fY3BQBl4MxkeFfcRH6pYNvwChkc3oA8L1xWv2dXgg4-WJEr-JzuMVeOyCA3YV0_71icBdVqYT523gOYBZG3MsYHMLoDC-AQFKriNREig3YxE3wCPmQMI5Ez9SH5FhrET79oZumtmXoQSTGSxgNVjrI_R5UiwyrIb58mSXWhJvO3XEESoVO9Tw6N13my_OKqx_AdJOmDfXJ7Fqyb2wuOjO12WDxFSRg9Exuarkdv2yGfJ3V3JKo_UlwZgnDLeuq0WTdQFaRH5CW1jPdvHc2ajWp7GgyOvf0FdALQ6PKyNhmXyTtL6zijrq-fkgEp3x39R_mVnPW_GN_kqlCPpjghd0YdjvocI46W17ZJ5K_zL1SXSuXxuM3JWz9QcXMnNarPXRttJbK6_ZGVGA8Pq2eeEOZnAvnNlMRcBb-tYV2cWcqvvXFsEGPJRAevr_-smxBz6Ehh8eIZaCCv6sdUBECw1Cn_s_giidPim3aLcBXGlWwnFdAj-N6lor-5YHvRnhDIltjKFDe9y66hku-srJjiucqfKBoz4zySX0hoOKhu4zynS_8Uj-ZJln7qLpqdKhJZm5okf4EQkALg6Ykttfmc68xWhPK2JYAWcr3gMvPQS8Ws0O80JgqSAkozUZsADmtfYppSgzXBLqtuy_MkxvzKsf0khqSAdWsHOygjG8ov8-cg0lzYPR2A-I6dzK40tlbQ4-R6t1aXLoO7B56F66Uamy4aguu1Mtkgj5KnqluXka_7zapyJwJCgbs2y2R1sTnng4dwS19ApgKwmhfMiDnjUKtkx9aGG0yST93KdTcBXwHKBE45Ne7WK-umxfug7DIshsZycZZARhwFO8p5o-VsNTGSjiLzX3qpR167GAGh6gGqHafK3gqfa9b7d13Dotv38L0SGsWIOqywxt1bPW9eAeqJBVS6hdectANYSkxvv_G8wPQ9x_U4w5G6sa68mw8aKk_9uc97ZbmpVHGdcahQ61sPhPQS8HcnL9cDVypb_zJcwVC6S4uVA9q6CU0yQ-Lj4xRRjMgjhLAqun6IUx315mbJ2P9Mg7qtXeG6K-vc6TBVE2ZWH6fxHYoTDVHzt1s6AqOLqPcVapjVcagrRIXTESOWpznxIWMnrEjAZGIOmVXysJOwEpozVnLcs1gUa-FOEah4EHHU5Re8ff9RQsmkmpb6cP17Yp8Vg6ILhRYY4Z7zZd5fd8G76aJh_wpHw9V1AuxHYpiH7mj1ri1PDZEOvEaBjY7k_u8V1k2OfFySFrIwxGNwaW3yvas1QaQ0xDJO80ivJLvKBh_UU-hB_ddDRhxclLENYw2pvoWdGtElhwx7vLqYnNImTi2A2Sn4tpmkUyqp5VaOILQqg7apt3-l6vrST688oyTx8FpWRCsGIgtITKriYSHlx1ifvj0K7dH69NcbyNEnzps1nbsCpr5OycwLee1vPHpKVD44mf9wNW7QMbFGefHsgYKqzVoBoCjDOwh_xAzW_o-YaSqM4qn3z7vZ1kTJmi-HdQ8P0fD1zRZ6mDj5MPfvjAXoQxqoQu9rGDsqm_aFW-yf_XtH03fekIgN0sBgwalQNvg0XGZGZOJsJJhVmjS_SByyLlcFsKxpGgorapIzDLWqySC1SOWiOy12ZrzEsIQZg1kbm6LiFAervzeWRcO2Eb3kuzmRz0ryzLuEjHjUl0izOInpwh0HKwZ_pnaertBfPD6M7PoZRXay-g9n1361NLzDJuypyNFQwLEiq_XHEv735uLaq_z0k6zKrElakPpwvVUXxJ1564uJjntruPgjc0jpwl_3KctY-WpJCgwbd0HoC4XyVrRcswhTLQjZqDndrPSKh9rt5n_KwLNsmi2wXY3UjwN37en7taZzajuiL3Y82FnnI4su41OURcztgbylicxKB1cIvjbQ3KwAQY4UjLFjLqK9MICFiJVTyunGATebe9j66ZqawWVTkKVu-25G_H8BMnsNjsDUJYwD9nzW2cXZFTwev5jXEi_QKcc5RECnJWPGCNP3I2k2f79bu-A1Wsp4VOy3oPj7VZAR2mDeW_rTrhGMM9UR0_4qU0__bjZ06h7lI_hufj8-oV1uC931i6gG2TH5an43LtI4rvWFalFDFotrlebuT7gIjT0uf0_anHfme3enPKaC12B6-Al1fFgO9v978zmep6GuYy5gJvGDhi58i9tHzo_49PFcthSrwqhlWY_6TXRbWsisg9BWJF6tPgaEcENvE4bFGxCAfxE6xlipWMgNrQ4dTI-oqTkM0skTSWvS_lcJJIlU1r32Qgb0BiRlBV08_F_vNTaWXxUHlISpiOmJJY-kIJoHt12eqlJ-Z9oNqy333Ql47Pvp2W2_LZBCooVjlZffk3dh5GcvXazMltDNBwuXKWZDGMuPLvO8hwcE3dvXfews22ptqkUT2HfsRDuPdIyQDN-OwQ_VOCyhMUb-mICQBCMcigOn_SmWnQxYTs4nBQD6UnpHoKMao1i5oqlco2YDjlFxPtfcfsclJBH96rZzB6wV6xKhhiXtYZBFqES43NbZcJHw89g5BouNCtEMXuVc3dyDmvQyhZBtgX_gpSVxX05wHcLR_vO084M-nCck6orAqCigcuSxD88FTA-1oeo8WNkJgRzUJQ5a12mrVh_96YFFj2ADZGoNpwviZM5cIHRjQWyvENwcK9yBWOzjiMqPRG1s41Y0zIDHQokQgvSl-w-AieSsRSRjuvQCNMJ5QTGBciBoZCAASFeRouMW7hp0SNS_xXZbwgfHSuNBrb2AB

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.71.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

358aab25209e969ce8c61928410086a76990ea7ac52f4ed36e23d8fe87152eae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19125
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.truste.com/ Frame 897C 27 KB
10 KB 10ms
9ms Script
text/javascript 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont5&w=300&h=600
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 22f0cec0f55842c96d1900f09d711b653e80e58146428d881c8145e2116cd7d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 10:55:37 GMT
content-encoding: gzip
server: nginx
age: 21680
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: hw9C1o8WYPFB9QtIjUJ9PBL1p7W5NgxkA95Y-PE5Mad5B4Vd8wmP8Q==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 897C 3 KB
1 KB 9ms
8ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:52:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:52:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 897C 123 KB
37 KB 53ms
30ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 897C 14 KB
6 KB 9ms
8ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:54:55 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6005 22 KB
8 KB 7ms
6ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sun, 17 Oct 2021 21:12:41 GMT
expires: Mon, 17 Oct 2022 21:12:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 157456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3974 6 KB
3 KB 7ms
6ms Document
text/html 142.250.186.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 19 Oct 2021 16:56:56 GMT
expires: Wed, 19 Oct 2022 16:56:56 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E5ED 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a3e0de3a11be7bc7d1c8989b3cb3a9187d4a4e0830615b5dfceee3daa85bf6d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/10772884/1634043215370/ Frame 5F08 15 KB
4 KB 25ms
7ms Document
text/html 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10772884/1634043215370/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

629f5372b17afa0623c8723ac58a4c4410d3d15114c9d7bc1e98b5349890dfb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /10772884/1634043215370/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 4052
date: Tue, 19 Oct 2021 15:05:50 GMT
expires: Wed, 20 Oct 2021 15:05:50 GMT
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 6667
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E5ED 0
545 B 82ms
44ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJ2Nw_vbkH_SXQ-0U_gqzgavtcCEMPDXTBhVPCdqKYq7-xCIhLHLTNW-Nr2rQWHt3U1FTczhdL7QNrDiNRviAtyNzGs_dZ9OrpFZP5k_IdUkt7-DdVlfrbedLMPdUh1g&sai=AMfl-YSHdJ6u-DpfPJay0_WYQPXYSV3sDYNVqPtAplsKNcJ8sv088I2rPXR2sPl1IHtDF3IX9WUk5x7whP2b2O4eD6mgzJQ8IK1pMPteMqY&sig=Cg0ArKJSzAhPsinG-VNeEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=145&cbvp=1&cstd=142&cisv=r20211013.19516&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-35-174-146-198.compute-1.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK pixel.gif
tracker.samplicio.us/tracker/3c406903-e253-4888-8238-366019fa5088/ Frame E5ED 35 B
390 B 410ms
98ms Image
image/gif 35.174.146.198
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tracker.samplicio.us/tracker/3c406903-e253-4888-8238-366019fa5088/pixel.gif?sid=2947631&pid=312970486&crid=159397511&device_id=0&cachebuster=4199323978&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.174.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx/1.14.1 /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: nginx/1.14.1
Connection: keep-alive
Content-Length: 35
Strict-Transport-Security: max-age=604800
Content-Type: image/gif

GET
H/1.1

200
OK

firstevent
hpe.demdex.net/ Frame E5ED
Redirect Chain

https://hpe.demdex.net/event?d_event=imp&d_src=615807&d_creative=159397511&d_placement=312970486&d_campaign=25661645
https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=159397511&d_placement=312970486&d_campaign=25661645

42 B
945 B

36ms
35ms

Image
image/gif

52.51.58.216
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=159397511&d_placement=312970486&d_campaign=25661645

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.51.58.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-51-58-216.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v019-005611014.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: R2X6z65MRyo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v019-0da93e24d.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 1LaZrvisTAo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=159397511&d_placement=312970486&d_campaign=25661645
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 897C 41 KB
15 KB 9ms
8ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ACJHI3S0R8vQR9z6Lu_KLgb_Zs1tdqrGMa0f_tSkYGIU66wEqH9nujtsUU3syWhYhIoFIFr11Dz3TWgu_PUweTZTSOAMq9kkBlDJLhSE1DHpDTvGQf8kFyYAzBzjc63hQKKjTzqrJbSJx4zHe8hll6NsHk7g&dbm_d=AKAmf-B7yPm2E3DAiIAQK33E1DI-HXfMvNL6Hj3QqSoSS-9wOcXA0SZmiKK_Ey6enml8SgL2eYjCP9s9_8metRDSgfXjNJeasx6l-gdCkiI1oVspftlq8-cEtA2YPy7ljlgHezqGU5OF4xZP1k911fkh13Cq8TWfKrzbo-A6E-MudvdpsBoFasCArqY8jM_qu7q_bBkYR0C9yOrlO7h05DJAlRf3isX08-DE8oi77Y4cpgd8XOh2X7kIgU7F5964y8CRMULv1w2r70w55QA3uO25x47M1EhSMkEVCw0-5vmoxbTr0_R5suT4ROc_jl_wApumt9PLPJuAwarhpR0iunnsS005aavG6HGO7xBFNWsJERut8uYUwJylLEel1ysO_mLQCQSIET1wTNlo8pXgJLsyQ4jYBzY8KzrGQVOKVSTZ8uEYi78aMtJqVnfKewpjBn1N4kED0EJ_nzxpVcaVcWAL-QXmEZREkUEW6KdLocXJPJCQAkC-XgP4wYZZIjUbIDhkstIQEdx7OaHikTw1RZ2kHYaDfS-iZ46UWMh41tIxNnyokJ1Naboh9b8Me_r93TAMNktBzk3XA7oW4qtAPrAlX2IHCupYrHYfu-NqTPFT_QVGyrypYF7kES2-XJ9tbiAeWJJQOcVjbP4srZnAkr-2WS5wcIM3dmYzZIMSRoMhv-AC30TjeqDdPXtrUOmsu8dX9RLq7FXrYqCYNo1MANASc3GFKiYPkSQSMNk6OBYlKb87twuoLzt0sIesXkTjF27a9Mqz6mGFESdytc9IgEsjjBbjyIwImPlQmsPNtaNf8eOuxZjh456LcpVSc39D5FuelefEjp2DwAWGssHIFpveWYDSgvrLXcA8gWBDJFibAjOsANkSyQ6Zhzui6pyqcYiGhVdVtb_cEZFYrs6cKOc7ZsSIgrBcqB-bn-BOk6bp_ap7uWjSKHQ87kPMMYpteGfZD0aK-ODp2lfFHIlYkTsDrpHF760kCWeIqji3OHhDvt8K6qjdLEeYjmeoZ4rSpa1pvwADaSJC72nFZDy450kTAJ8cU_YjShkr_rNYzBhz5ApIedVj9UWLA-XxXmAJpgk1ya3vJ-g2Pq1k1IUMdQg2UPcvBg518lzXZyTn3J_Ek-y3ePxJYd3V2LtYAsXT9CaR4ubVM9pJ5toKWhSn6s690UySQvtId15VbBH3j4j0jc_Q1FRI-hOoOzWgcfMlGEDwcEM0Argzc8Tr2YnXf9I7TYPtVqvvV508i6vL0cUSR01vsq9U_iTF8jYNTBfAvIBKnbTQ24cA05qHlIsGW9r9vKasz0_WLl9FuQaCPXgY6Tl1zqxqCU7mXnrz1T9csmrd14smUzL49qvBWsTXG1mceG6kp-2xq2HYru5bKXIyHIQdwhISUiRUHLI_PfxDXXXHOSVHB1hAEuDCzCGB2KSOChfhO-1rJ2YPcAgvm48KoTbcEMy_caz0r53SD5lFOk4OMlvz3O9HcpzW57IwT5tjF8-6XcZfH6jfXrEiTZXydl90Tt22azHvIHxni_o34pquF0ZlQXswY4-iyKQOmL2omhVgxMyHs7fIgfYMt5qNh5AbNToXxB5wGTqefXCB54cfyfC_GNDn9myrdeFr1j1NoSTYf-S8NiT56J8hD-7fZPoESNUIX-Y8r5582gVWyuQUCBqBVNPlYc0uE8JDOrwiivdFq1Tl_NDuxJfMf9ikW56LWkkbnJCVHYUJ_D231Nt3pt2pjBrJgfP2QwIlYNSYMPJPv2rUqf8_F7JwD_hdj3Zd3gb57WaNhP8thR9g4688ZKcI1M0bFuHscbsuxwQFjFPrhKK7fVGBf5d9nt6QN1kRAkGUJWcTFMVePRGogsemoOP8olU-euHE66DVeKT8SxSgfT3M2hGwQotJLkZYalKhQnzUmlfgmR9Ius7XsKv_h0D4j4KM7Q4cQxDkz64qdDoGQ95EF_tb76z3ofeO8wYObTffZUXcPd_nl7wn4ATGgdyoPqVKmhNc9_qNdHoyvWXt4ePz2ErOooRiWKCT-CzbF3VaBD-AfFKn23BPL8wELdEmjRyByIu8wHldiNoOfmAYLqrAuiWfR2rHzySb3SvN54f9gQBP80FUt0f9hZCjP90v00DozvSgeXk2qdhc3oGbLAURUsFN7JVkYcMozXEygRYxcTOS4tU9HSc6LUFG5LMpqFEZDHjZ4YAxU-iNBPbhsc5KGgUzU1fKUjIx2C2su4F32lrmTmO4vWnqcW5TFy3ePKbdHluggaiYaclrW84fnutvBwLnne3Iunrx7-LoRiieSY6Ga4JiRsAk2af7zmEPZmYOhsBzuU2-KAPV2I0gt_JdKRCGWPPn854DxtjkkXoSTU4DR7NXKRO1dsRRBsWhaNAPjBRzzNGc_M1DMwafYc3lvcOqGywhw8lEuhxRSVICI20aMkiWNj98WAn5yIy0hjC4IVQJ5G6P8Oc3sak-v-P9jUE3Morjl1ShLEg6yWsh3iewB9GmTsUUOCf-4tnBvnesD_DbHROvfuwHop9Pu42x4P4VY61x8As-LQM2xzgGuD2_0hhnXRpNHAni7X2hZE86SwFggmhQoUkWTLkHVt5PxQ&cid=CAASFeRouMW7hp0SNS_xXZbwgfHSuNBrbw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 21:12:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 17 Oct 2022 21:12:41 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BCB4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1

43 B
894 B

32ms
32ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhjt_tKzATAB&v=APEucNVF62HzgF9f1eS6RqPZuIhhGro2-lMoEN4WyF7Yx85XOT6lvn2xWfX6dmd6je2y6cQubTUqYqte3SC7QppPW8Hl1u9MYg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:57 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJujspLwruvpKdbPv0mSiyw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BCB4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YW742NdE85lWkO3vXgCJ2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1

43 B
894 B

15ms
14ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhjt_tKzATAB&v=APEucNVF62HzgF9f1eS6RqPZuIhhGro2-lMoEN4WyF7Yx85XOT6lvn2xWfX6dmd6je2y6cQubTUqYqte3SC7QppPW8Hl1u9MYg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:57 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame BCB4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFlm6k-Yx0tOnEn7lU9RAHU&google_cver=1

43 B
1006 B

24ms
24ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFlm6k-Yx0tOnEn7lU9RAHU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJW2SxDWo8rDAhjt_tKzATAB&v=APEucNVF62HzgF9f1eS6RqPZuIhhGro2-lMoEN4WyF7Yx85XOT6lvn2xWfX6dmd6je2y6cQubTUqYqte3SC7QppPW8Hl1u9MYg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 704f9023-2423-4de1-961c-4d30b30fcf59
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFlm6k-Yx0tOnEn7lU9RAHU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BCB4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b66538d1-f96e-4e4a-84a3-189d8f89537f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DC46 624 B
299 B 23ms
22ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGLb2krIBMAE&v=APEucNXMEyHaQ1-8_oOu-27FfNj6RvCiBSLM4jqOTF3IGzbkwQ9Fhl9C9tHgu-rrZOnfD0DjzNrxdOgdbcUKt6Nv9LCv0i82MQ

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COefRxCA_O0CGLb2krIBMAE&v=APEucNXMEyHaQ1-8_oOu-27FfNj6RvCiBSLM4jqOTF3IGzbkwQ9Fhl9C9tHgu-rrZOnfD0DjzNrxdOgdbcUKt6Nv9LCv0i82MQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkzsWzsWPIuTqb3yAHlZbmZ6uex8H8hZg07UiFtMOkYlgqlZrcls6mTmlPtE74; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 19 Oct 2021 16:56:57 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3974 61 KB
27 KB 42ms
41ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2DWWrp5ta-aSlZu7HP38bj5CPLaV6Tggv8BmshxFOCRd0Q-mfhE0PjYJCRE3Ucwa_pd2xpoq-87oeVqGWB0hP7D1-IB_0brGeXeDORoI71LdugexfnS1HjK9zNqfu6KFFlRA86ehcY6ZlBujWz8lUDfqtdw&dbm_d=AKAmf-CVyN9BR5uPKmPD6_e-hxhFEEFybG-poSZPUwhM7NEuWnpHXc-ukXhiaF0XW0LgNOmsrYNtwdFIj0y4-tMSaURdInfPrX-CPZ1V8XP2BeZj1MR1xN0QFZjeuQzzhxDqCtCY7E1D-vIbZcKdfgYrPbzj3bmVESn_AhLSZaebZLEh2NdhDN_PgpGSCx47xPZJ1fQdat2cxr7yLnjHWtvYpg6Lb0XpoTGK3xHhlI4GwHuhmPRNNARRlK5ONuXpXCcL6cvz-zA9RSuHBsuwmmmEpULjE6IM7xbQNfv5RJeYuVXUgkC55y902p21mlZGsyksp5IVMSmYD6wCZbsZdMyGY3YCVfJLM0QlaHRUScxvXowy3pBp5KsMigpaw1_33YxnHRNvdLzgguovPAbhYmHeEwjOCydfEKAq9hl76ZG7Ua_IZg0xiQH6Xszss7OMLAaW8yW3_bzziTN3gmwnuCkVso_gnWxNKh5STe8dRA1nnd7KLKU5vwkNgVqe826Ph7K5yaGrsXDh-_8_lEl48c8fFXyCWjHZ-Y78Tajm3YnEiWOHw7xnyu2Npq9Ysz5cvnBqw78HKr7sJU1mIyQnAS0IE_7mPHhbjmWkx3EI1D_6CZP8W3S2uyGmQeqKRBqVwXBhYlzC6ylUO1EUeUDjGvX-AwhhWVekO_f0H3qzH9sO7HU1xVjMqNtFNlqzZGto38_lC0kL7URG7EVQMhqWxfKSNR9Lq06o6OMZ_57maXvlqLUOhbeyZc47MWcGxKGfJVut2GLGJFPg0xcULLvdEm6Q8fjtWxiFv0Ut8gMDPdadSJNIgsZeHLahWVcFx0S6Ds8QV8rUCdAvFZluqcdrv8nowJWXxSWEB3QfqcpVaN_8DjzbjvxJc8W0VWUT7Vi8I6lp7-uMfXtQ492YK5tLAKQmSQydi10UIxHX4exhuwTcSBjFAPw1ltKclyup_HbM4lyUJCRc_wmikXNHBMDvBxGoCYICmB3zFowJvNSVwJtVhjI2Tw_Rye6SeWO7_9503JPw5x7SNCR0r8UPVR2qZ6fU88nd_97gQhiYHpuseUZPgdSmub68wMlZdFacl9NuP4c1M6Y4MrXWpFNibQqlbqeRp2acrJtIOXyAFyGx0nuwyqC1Wp-mUI61t2STZVE-de96haY7cIAecmyTo6AMi9P_L3lkuSmM2UQ8vUXVJuKOactTmkQKC1cSn87MLPa8vpbs8uwhlD6kf_bnH0EqfkqpfW4_7EWeAaxRWF_Cr9f7SsAIxAX0EAttjJ8V7WYMInIv53eugh5QRDRWLkf7ds9SWA6wYnKtQahl9p6lwYQ5-vmbP9V_wBvGRiAW3wwM5BcI-ChmUUN-2ZAYNPLk1NTTeBYIZvuRbob5yvGK0MXX2SpuLDhQyTlQakDmuz2W0VIst_AePjXgo7SIIaGOwyCXMId4gEZFC2b6xAVsA3Mrv4dnYhG29J2IKVDQj9a1E4qJI4LHVsNaLaf72sTcymgtZKhCPbc09vYYXMMcUVblV1hejY-Hi1QRHiV_WI7P5nji5CoQRZHNHzLTgNMjq1tjEAORdxJQBR9i80XAQRkrsBix72_-M9h8Pd7TuzQV8DqYLcIGcpYZBT9d30RpOdoVTNCk9aMvp_2z7Q1P49IdUYaGN99fst_pUuo2J7LaZVY7Ew1mxGZTszUDvE0CduMbqORIPXh5HW1-QQpHuknq9MtDjs_LaGNeW5zaX-4BjJjCnTfdIFEJ41ScUy-eSujE2Z8YC5omUuJ5if9_96rJTL7TKFvIRf6BNwauDHL4DCfgbF5wH_fntHagwQGJId8u9P8oo3uFmI01YPsh3A8hdGyXSPjkOPCi-jIZhCKBPmU1yXaiJDdVewCmcxIQ04JxBCTrw37aiKbeaJdlCy28mr-k59plGCDz-UoGRv6Kd4nkA3Fq3KwvN17zhTM4HyA0NkcsZo0drTTdq7TV0R823HenPKDsiB9UfxZbOs0WB18jVkEu3rv-982gQt7b211uqaTJQX3JJpLit-qBy9a7klDW6cK8govjkMrnv_42-W8EiJ_ydNWfwIzMHfQSSieDGfsDN53Iv1qcrVQgpa0qxPbSkAhZxZPvfTvNbttfeZda_aC6NlbfMNGxNwml5Jws6QMLfR9SS8hVoFvAgKNxW6slapbu2YZRLQuR5fkJRZ1fsTykuHDbDSQNpaKDadr0b6CXXKblGnOwSYSrnEB7-3f0uEm_wN6Br6rZs-y3ygTkaYmhpDB1Sqo0hXdMReyvULf1kKFK0wtmLYa2zx3TRNjFEecYZScC2dU7wB282M13TYgsJ5LQrgeX-cZqlPZAC4GdPwguodpAz6BBDpEnX65wHT1KZPnwL-sMHkFlfP_Q8R15DoX2lrazFZHvXS-AvL48AGppsQ8DLF71VbbhpKj3OfPEQlnFqK3_BZYc40I4VEINHODZLpQglIPEefJdWknvLriZIu01ROtHQpPzAvI6Y-dmQfTkFUbSDfBJkG8K4KRbPuEuv1LqsJREG2JQ6uw--RBtLAREAlVAg8JxAiXu74QXiVplEA_01u7YfYGw8VVrfO8bIg-HXfA1_5crZ1wZ-7RyHxlBGSJL4ozKzmBBJdFwVej8rJmZsgMepFdbqgvTvh1xqfMqwugQ6r8QO42V8oZ2Qoazo_V8F5hubowO_EAJDJEeuTHq4wHLmsWgNKGoUYk8XL3oEtHHjsQ-A_JWs5mTEvrbLA9CdsfIpzeQblRSURn8fCBJdKoE8GKAu6i4X3KQxH-eOm2znUGJUUipC03ctQ7y6sZmwet0M5_dueFqVbnfLlT_jKoXvso28Mqe-1co3HUMLOuGJF4fdBNUTf-odXli0pIxqnYIDNL1f5Mv33_xMuBUsNalRCo4F9PfHkJmDjqId2dgXyy-6a3QZQsQLMkynGnUlE-ku9Pe-GdWW0yN_zf4Oi_yCdTRMJSctXju4WwHuj_91vik_dHpwEmZIirunYryMTsslorLD6Duuk4Xe4D5H3wZrhPwfRLF2k1yYYE1HXgulO_QsT1j1308-T2ono8KUIS5xc7MFcce_87TqxVi-rI3k2yoXKi9KsSbnuYt_Xf96Ih9BCpUskKDyPFCNVVJ6N1SZUMFggyftapdbagWTg5uC1NBe8T-fLp_bCqllPLIqwoOZNXCtxgdPOJTLWeJN_kOrUQP4O-oG62kXytROwBU4zsV0D6y2NQ2&cid=CAASFeRonaovKtcLqlqqxZA7nQH5Wa43Ew&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2d589d28aa5ed575541d02b9516e01e525f5335490b8fcc77914851b7554a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27617
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3974 42 B
63 B 48ms
48ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B_ORHPq3Gs4VVToeelGQeTot7SZezCgQzcc1gwfwBo1ieyaGRfyuAMhT_cJ2PXD774JN8m_z6l_hmlTtNtPJfh9tvVPWC0IvQuktI96Y-lz4MuTEs

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 3974 3 KB
1 KB 7ms
7ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:52:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:52:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3974 123 KB
37 KB 27ms
26ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 3974 14 KB
6 KB 12ms
9ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:54:55 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3974 0
0 64ms
25ms Image
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTs0GVD0UwtlGNzxv5--TShckvWpLXiT76buP54RVnPEGnvATN2tqOCitRtBIYMBBiglkOPC86CKSe6U35qbUZtRfQeEA
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 2E76 35 KB
13 KB 18ms
17ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 10:15:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 10:15:46 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 897C 114 KB
39 KB 18ms
18ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Origin: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 11:05:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21069
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 11:05:48 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/ Frame 897C 8 KB
3 KB 17ms
17ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXjzL6wT50NKHrVvnVYuDTzXJgolMuCI9CLLBrUBF5BG_ERTuU&d=CnkAoCZ_4OsLLKGNyFLLZ-_3BZYA115vQjgCwodPVywx7Xu0DyxgusTNWMcyeGsWs1p-os6kPUYqGzJDVLYzfAyAC8gMBs-ech_4MAhOUy2gTq1X_woPEZ6Vs7RJddj6v26xzXpSOvmcWTSosfWt-b0Gzv_ELXMZInoCEpkSAKAmf-BcHzbgHfzupEdM3a9_KoVNsP3Zfp4glngGMWrXnZbkNePRjj_vMQFqvFgHa5b12X2wzkNTLm7U8xrckaVYL1ojXR7FRypIVReXpALagJWMx_rhdYA021UFfeRvgqBCKc9nLnmqvu5qaWaQb2zACPmb_XcBwMIKc3abRWyIBTFPnCXhY9QkzQNo6m-ajS01yH58pcppACr2Aif7oW2a-muZnGxsiAQMU-zM-NXco1ttBP77nFoF5Aq-v8KeC-GjUIol6ZVC98zIMvg-CL5juQLAEsFW8CT6lFjkhe-KDYLA51wFDOvQ_Fj4GaQZStCXouGf-YtY1wCCPsJjsNivYFWKBZwVmJ65JchvP0UiOOXB3N0ja54VyTR19DSt-ko4fY3BQBl4MxkeFfcRH6pYNvwChkc3oA8L1xWv2dXgg4-WJEr-JzuMVeOyCA3YV0_71icBdVqYT523gOYBZG3MsYHMLoDC-AQFKriNREig3YxE3wCPmQMI5Ez9SH5FhrET79oZumtmXoQSTGSxgNVjrI_R5UiwyrIb58mSXWhJvO3XEESoVO9Tw6N13my_OKqx_AdJOmDfXJ7Fqyb2wuOjO12WDxFSRg9Exuarkdv2yGfJ3V3JKo_UlwZgnDLeuq0WTdQFaRH5CW1jPdvHc2ajWp7GgyOvf0FdALQ6PKyNhmXyTtL6zijrq-fkgEp3x39R_mVnPW_GN_kqlCPpjghd0YdjvocI46W17ZJ5K_zL1SXSuXxuM3JWz9QcXMnNarPXRttJbK6_ZGVGA8Pq2eeEOZnAvnNlMRcBb-tYV2cWcqvvXFsEGPJRAevr_-smxBz6Ehh8eIZaCCv6sdUBECw1Cn_s_giidPim3aLcBXGlWwnFdAj-N6lor-5YHvRnhDIltjKFDe9y66hku-srJjiucqfKBoz4zySX0hoOKhu4zynS_8Uj-ZJln7qLpqdKhJZm5okf4EQkALg6Ykttfmc68xWhPK2JYAWcr3gMvPQS8Ws0O80JgqSAkozUZsADmtfYppSgzXBLqtuy_MkxvzKsf0khqSAdWsHOygjG8ov8-cg0lzYPR2A-I6dzK40tlbQ4-R6t1aXLoO7B56F66Uamy4aguu1Mtkgj5KnqluXka_7zapyJwJCgbs2y2R1sTnng4dwS19ApgKwmhfMiDnjUKtkx9aGG0yST93KdTcBXwHKBE45Ne7WK-umxfug7DIshsZycZZARhwFO8p5o-VsNTGSjiLzX3qpR167GAGh6gGqHafK3gqfa9b7d13Dotv38L0SGsWIOqywxt1bPW9eAeqJBVS6hdectANYSkxvv_G8wPQ9x_U4w5G6sa68mw8aKk_9uc97ZbmpVHGdcahQ61sPhPQS8HcnL9cDVypb_zJcwVC6S4uVA9q6CU0yQ-Lj4xRRjMgjhLAqun6IUx315mbJ2P9Mg7qtXeG6K-vc6TBVE2ZWH6fxHYoTDVHzt1s6AqOLqPcVapjVcagrRIXTESOWpznxIWMnrEjAZGIOmVXysJOwEpozVnLcs1gUa-FOEah4EHHU5Re8ff9RQsmkmpb6cP17Yp8Vg6ILhRYY4Z7zZd5fd8G76aJh_wpHw9V1AuxHYpiH7mj1ri1PDZEOvEaBjY7k_u8V1k2OfFySFrIwxGNwaW3yvas1QaQ0xDJO80ivJLvKBh_UU-hB_ddDRhxclLENYw2pvoWdGtElhwx7vLqYnNImTi2A2Sn4tpmkUyqp5VaOILQqg7apt3-l6vrST688oyTx8FpWRCsGIgtITKriYSHlx1ifvj0K7dH69NcbyNEnzps1nbsCpr5OycwLee1vPHpKVD44mf9wNW7QMbFGefHsgYKqzVoBoCjDOwh_xAzW_o-YaSqM4qn3z7vZ1kTJmi-HdQ8P0fD1zRZ6mDj5MPfvjAXoQxqoQu9rGDsqm_aFW-yf_XtH03fekIgN0sBgwalQNvg0XGZGZOJsJJhVmjS_SByyLlcFsKxpGgorapIzDLWqySC1SOWiOy12ZrzEsIQZg1kbm6LiFAervzeWRcO2Eb3kuzmRz0ryzLuEjHjUl0izOInpwh0HKwZ_pnaertBfPD6M7PoZRXay-g9n1361NLzDJuypyNFQwLEiq_XHEv735uLaq_z0k6zKrElakPpwvVUXxJ1564uJjntruPgjc0jpwl_3KctY-WpJCgwbd0HoC4XyVrRcswhTLQjZqDndrPSKh9rt5n_KwLNsmi2wXY3UjwN37en7taZzajuiL3Y82FnnI4su41OURcztgbylicxKB1cIvjbQ3KwAQY4UjLFjLqK9MICFiJVTyunGATebe9j66ZqawWVTkKVu-25G_H8BMnsNjsDUJYwD9nzW2cXZFTwev5jXEi_QKcc5RECnJWPGCNP3I2k2f79bu-A1Wsp4VOy3oPj7VZAR2mDeW_rTrhGMM9UR0_4qU0__bjZ06h7lI_hufj8-oV1uC931i6gG2TH5an43LtI4rvWFalFDFotrlebuT7gIjT0uf0_anHfme3enPKaC12B6-Al1fFgO9v978zmep6GuYy5gJvGDhi58i9tHzo_49PFcthSrwqhlWY_6TXRbWsisg9BWJF6tPgaEcENvE4bFGxCAfxE6xlipWMgNrQ4dTI-oqTkM0skTSWvS_lcJJIlU1r32Qgb0BiRlBV08_F_vNTaWXxUHlISpiOmJJY-kIJoHt12eqlJ-Z9oNqy333Ql47Pvp2W2_LZBCooVjlZffk3dh5GcvXazMltDNBwuXKWZDGMuPLvO8hwcE3dvXfews22ptqkUT2HfsRDuPdIyQDN-OwQ_VOCyhMUb-mICQBCMcigOn_SmWnQxYTs4nBQD6UnpHoKMao1i5oqlco2YDjlFxPtfcfsclJBH96rZzB6wV6xKhhiXtYZBFqES43NbZcJHw89g5BouNCtEMXuVc3dyDmvQyhZBtgX_gpSVxX05wHcLR_vO084M-nCck6orAqCigcuSxD88FTA-1oeo8WNkJgRzUJQ5a12mrVh_96YFFj2ADZGoNpwviZM5cIHRjQWyvENwcK9yBWOzjiMqPRG1s41Y0zIDHQokQgvSl-w-AieSsRSRjuvQCNMJ5QTGBciBoZCAASFeRouMW7hp0SNS_xXZbwgfHSuNBrb2AB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:46:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:46:29 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 897C 23 KB
9 KB 15ms
15ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

599ad71fae7cb8d014f7c2d29b8450bc7c34f8e32d49fa103716becef8ae9964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9283
x-xss-protection: 0
server: cafe
etag: 1044373809082006429
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:55:15 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0523 0
0 69ms
69ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021101201&jk=2877213304704200&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 6005 35 KB
13 KB 14ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 10:15:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 10:15:46 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 35A3 22 KB
8 KB 7ms
7ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sun, 17 Oct 2021 21:12:41 GMT
expires: Mon, 17 Oct 2022 21:12:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 157456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 be68fac4543e50759c26d7a153fea00f.js Show response
s0.2mdn.net/10772884/1634043215370/ Frame 5F08 65 KB
17 KB 8ms
7ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10772884/1634043215370/be68fac4543e50759c26d7a153fea00f.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d4b9633320f23d8ce3c4dcb514f76d27c6774115c5f699917dd94c3777a6ba7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17238
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/10772884/1634043210829/ Frame 40CF 15 KB
4 KB 8ms
7ms Document
text/html 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10772884/1634043210829/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3baa4ea40f06cf3823dbdfe30020759310a2315132ff91bef479e37a248ac86a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /10772884/1634043210829/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 3976
date: Tue, 19 Oct 2021 16:04:38 GMT
expires: Wed, 20 Oct 2021 16:04:38 GMT
last-modified: Tue, 12 Oct 2021 12:53:30 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 3139
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 897C 0
60 B 43ms
42ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDeOrJf5jpef_teYRTWM9dFt2ViPqWurUaQHhKKLDgFmC1xX7zu5tBI2H0w3ODxqXvDJ-_EehOnnquqmazqeInE-_PLm-Q6L_5eikFcS9dFAH3VjczLtYvTDleIKGW2g&sai=AMfl-YSLl1kh0m0rUc9DNwuQB0QFFk8yBpiGHR8OQUkm2NfCnJpOViocUzmKgxoROT31W0LWAXHyYfh-b-wQZiPfF3cvdQJAkpJ57JCq2Mg&sig=Cg0ArKJSzP2Jln8FY9fbEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=56&cbvp=1&cstd=55&cisv=r20211013.08396&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-35-174-146-198.compute-1.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK pixel.gif
tracker.samplicio.us/tracker/3c406903-e253-4888-8238-366019fa5088/ Frame 897C 35 B
390 B 430ms
98ms Image
image/gif 35.174.146.198
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tracker.samplicio.us/tracker/3c406903-e253-4888-8238-366019fa5088/pixel.gif?sid=2947631&pid=312970489&crid=159428002&device_id=0&cachebuster=3988990284&gdpr=&gdpr_consent=&gdpr_pd=

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.174.146.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx/1.14.1 /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: nginx/1.14.1
Connection: keep-alive
Content-Length: 35
Strict-Transport-Security: max-age=604800
Content-Type: image/gif

GET
H/1.1

200
OK

firstevent
hpe.demdex.net/ Frame 897C
Redirect Chain

https://hpe.demdex.net/event?d_event=imp&d_src=615807&d_creative=159428002&d_placement=312970489&d_campaign=25661645
https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=159428002&d_placement=312970489&d_campaign=25661645

42 B
945 B

45ms
43ms

Image
image/gif

52.51.58.216
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=159428002&d_placement=312970489&d_campaign=25661645

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.51.58.216 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-51-58-216.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v019-0143259ca.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 2UKKRqWuR5s=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v019-06bdc6eea.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: ZXAXBkOWT2M=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://hpe.demdex.net/firstevent?d_event=imp&d_src=615807&d_creative=159428002&d_placement=312970489&d_campaign=25661645
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 container.html Show response
d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 54AC 6 KB
3 KB 7ms
7ms Document
text/html 142.250.186.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021101201.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 19 Oct 2021 16:56:56 GMT
expires: Wed, 19 Oct 2022 16:56:56 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 897C 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15d1286b34f98baf8b1718625bef242be7d4f06e4fe61c44b51a8d412343ab0f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DC46
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1

43 B
894 B

17ms
17ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGLb2krIBMAE&v=APEucNXMEyHaQ1-8_oOu-27FfNj6RvCiBSLM4jqOTF3IGzbkwQ9Fhl9C9tHgu-rrZOnfD0DjzNrxdOgdbcUKt6Nv9LCv0i82MQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:57 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DC46
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YW742NdE85lWkO3vXgCJ2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1

43 B
894 B

17ms
16ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGLb2krIBMAE&v=APEucNXMEyHaQ1-8_oOu-27FfNj6RvCiBSLM4jqOTF3IGzbkwQ9Fhl9C9tHgu-rrZOnfD0DjzNrxdOgdbcUKt6Nv9LCv0i82MQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:57 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame DC46
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMX8riTyu_NvVsKI6PBnpzw&google_cver=1

43 B
1006 B

9ms
9ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMX8riTyu_NvVsKI6PBnpzw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGLb2krIBMAE&v=APEucNXMEyHaQ1-8_oOu-27FfNj6RvCiBSLM4jqOTF3IGzbkwQ9Fhl9C9tHgu-rrZOnfD0DjzNrxdOgdbcUKt6Nv9LCv0i82MQ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 262d8d0b-0539-4213-a4c4-b0d2eb9133dc
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMX8riTyu_NvVsKI6PBnpzw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DC46
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

170 B
188 B

24ms
24ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 7ab2b864-f0d3-44b0-a6ee-8e657cc03168
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/774604/57214098/ Frame 3974 229 KB
76 KB 148ms
69ms Script
application/javascript 52.50.243.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/774604/57214098/skeleton.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2DWWrp5ta-aSlZu7HP38bj5CPLaV6Tggv8BmshxFOCRd0Q-mfhE0PjYJCRE3Ucwa_pd2xpoq-87oeVqGWB0hP7D1-IB_0brGeXeDORoI71LdugexfnS1HjK9zNqfu6KFFlRA86ehcY6ZlBujWz8lUDfqtdw&dbm_d=AKAmf-CVyN9BR5uPKmPD6_e-hxhFEEFybG-poSZPUwhM7NEuWnpHXc-ukXhiaF0XW0LgNOmsrYNtwdFIj0y4-tMSaURdInfPrX-CPZ1V8XP2BeZj1MR1xN0QFZjeuQzzhxDqCtCY7E1D-vIbZcKdfgYrPbzj3bmVESn_AhLSZaebZLEh2NdhDN_PgpGSCx47xPZJ1fQdat2cxr7yLnjHWtvYpg6Lb0XpoTGK3xHhlI4GwHuhmPRNNARRlK5ONuXpXCcL6cvz-zA9RSuHBsuwmmmEpULjE6IM7xbQNfv5RJeYuVXUgkC55y902p21mlZGsyksp5IVMSmYD6wCZbsZdMyGY3YCVfJLM0QlaHRUScxvXowy3pBp5KsMigpaw1_33YxnHRNvdLzgguovPAbhYmHeEwjOCydfEKAq9hl76ZG7Ua_IZg0xiQH6Xszss7OMLAaW8yW3_bzziTN3gmwnuCkVso_gnWxNKh5STe8dRA1nnd7KLKU5vwkNgVqe826Ph7K5yaGrsXDh-_8_lEl48c8fFXyCWjHZ-Y78Tajm3YnEiWOHw7xnyu2Npq9Ysz5cvnBqw78HKr7sJU1mIyQnAS0IE_7mPHhbjmWkx3EI1D_6CZP8W3S2uyGmQeqKRBqVwXBhYlzC6ylUO1EUeUDjGvX-AwhhWVekO_f0H3qzH9sO7HU1xVjMqNtFNlqzZGto38_lC0kL7URG7EVQMhqWxfKSNR9Lq06o6OMZ_57maXvlqLUOhbeyZc47MWcGxKGfJVut2GLGJFPg0xcULLvdEm6Q8fjtWxiFv0Ut8gMDPdadSJNIgsZeHLahWVcFx0S6Ds8QV8rUCdAvFZluqcdrv8nowJWXxSWEB3QfqcpVaN_8DjzbjvxJc8W0VWUT7Vi8I6lp7-uMfXtQ492YK5tLAKQmSQydi10UIxHX4exhuwTcSBjFAPw1ltKclyup_HbM4lyUJCRc_wmikXNHBMDvBxGoCYICmB3zFowJvNSVwJtVhjI2Tw_Rye6SeWO7_9503JPw5x7SNCR0r8UPVR2qZ6fU88nd_97gQhiYHpuseUZPgdSmub68wMlZdFacl9NuP4c1M6Y4MrXWpFNibQqlbqeRp2acrJtIOXyAFyGx0nuwyqC1Wp-mUI61t2STZVE-de96haY7cIAecmyTo6AMi9P_L3lkuSmM2UQ8vUXVJuKOactTmkQKC1cSn87MLPa8vpbs8uwhlD6kf_bnH0EqfkqpfW4_7EWeAaxRWF_Cr9f7SsAIxAX0EAttjJ8V7WYMInIv53eugh5QRDRWLkf7ds9SWA6wYnKtQahl9p6lwYQ5-vmbP9V_wBvGRiAW3wwM5BcI-ChmUUN-2ZAYNPLk1NTTeBYIZvuRbob5yvGK0MXX2SpuLDhQyTlQakDmuz2W0VIst_AePjXgo7SIIaGOwyCXMId4gEZFC2b6xAVsA3Mrv4dnYhG29J2IKVDQj9a1E4qJI4LHVsNaLaf72sTcymgtZKhCPbc09vYYXMMcUVblV1hejY-Hi1QRHiV_WI7P5nji5CoQRZHNHzLTgNMjq1tjEAORdxJQBR9i80XAQRkrsBix72_-M9h8Pd7TuzQV8DqYLcIGcpYZBT9d30RpOdoVTNCk9aMvp_2z7Q1P49IdUYaGN99fst_pUuo2J7LaZVY7Ew1mxGZTszUDvE0CduMbqORIPXh5HW1-QQpHuknq9MtDjs_LaGNeW5zaX-4BjJjCnTfdIFEJ41ScUy-eSujE2Z8YC5omUuJ5if9_96rJTL7TKFvIRf6BNwauDHL4DCfgbF5wH_fntHagwQGJId8u9P8oo3uFmI01YPsh3A8hdGyXSPjkOPCi-jIZhCKBPmU1yXaiJDdVewCmcxIQ04JxBCTrw37aiKbeaJdlCy28mr-k59plGCDz-UoGRv6Kd4nkA3Fq3KwvN17zhTM4HyA0NkcsZo0drTTdq7TV0R823HenPKDsiB9UfxZbOs0WB18jVkEu3rv-982gQt7b211uqaTJQX3JJpLit-qBy9a7klDW6cK8govjkMrnv_42-W8EiJ_ydNWfwIzMHfQSSieDGfsDN53Iv1qcrVQgpa0qxPbSkAhZxZPvfTvNbttfeZda_aC6NlbfMNGxNwml5Jws6QMLfR9SS8hVoFvAgKNxW6slapbu2YZRLQuR5fkJRZ1fsTykuHDbDSQNpaKDadr0b6CXXKblGnOwSYSrnEB7-3f0uEm_wN6Br6rZs-y3ygTkaYmhpDB1Sqo0hXdMReyvULf1kKFK0wtmLYa2zx3TRNjFEecYZScC2dU7wB282M13TYgsJ5LQrgeX-cZqlPZAC4GdPwguodpAz6BBDpEnX65wHT1KZPnwL-sMHkFlfP_Q8R15DoX2lrazFZHvXS-AvL48AGppsQ8DLF71VbbhpKj3OfPEQlnFqK3_BZYc40I4VEINHODZLpQglIPEefJdWknvLriZIu01ROtHQpPzAvI6Y-dmQfTkFUbSDfBJkG8K4KRbPuEuv1LqsJREG2JQ6uw--RBtLAREAlVAg8JxAiXu74QXiVplEA_01u7YfYGw8VVrfO8bIg-HXfA1_5crZ1wZ-7RyHxlBGSJL4ozKzmBBJdFwVej8rJmZsgMepFdbqgvTvh1xqfMqwugQ6r8QO42V8oZ2Qoazo_V8F5hubowO_EAJDJEeuTHq4wHLmsWgNKGoUYk8XL3oEtHHjsQ-A_JWs5mTEvrbLA9CdsfIpzeQblRSURn8fCBJdKoE8GKAu6i4X3KQxH-eOm2znUGJUUipC03ctQ7y6sZmwet0M5_dueFqVbnfLlT_jKoXvso28Mqe-1co3HUMLOuGJF4fdBNUTf-odXli0pIxqnYIDNL1f5Mv33_xMuBUsNalRCo4F9PfHkJmDjqId2dgXyy-6a3QZQsQLMkynGnUlE-ku9Pe-GdWW0yN_zf4Oi_yCdTRMJSctXju4WwHuj_91vik_dHpwEmZIirunYryMTsslorLD6Duuk4Xe4D5H3wZrhPwfRLF2k1yYYE1HXgulO_QsT1j1308-T2ono8KUIS5xc7MFcce_87TqxVi-rI3k2yoXKi9KsSbnuYt_Xf96Ih9BCpUskKDyPFCNVVJ6N1SZUMFggyftapdbagWTg5uC1NBe8T-fLp_bCqllPLIqwoOZNXCtxgdPOJTLWeJN_kOrUQP4O-oG62kXytROwBU4zsV0D6y2NQ2&cid=CAASFeRonaovKtcLqlqqxZA7nQH5Wa43Ew&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.243.239 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-243-239.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 81a1a39673450fe16761a0e2fa8d5d8a7933bf036b22e84d34047f1612e2cdff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-server-name: app02.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 3974 23 KB
9 KB 15ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A2DWWrp5ta-aSlZu7HP38bj5CPLaV6Tggv8BmshxFOCRd0Q-mfhE0PjYJCRE3Ucwa_pd2xpoq-87oeVqGWB0hP7D1-IB_0brGeXeDORoI71LdugexfnS1HjK9zNqfu6KFFlRA86ehcY6ZlBujWz8lUDfqtdw&dbm_d=AKAmf-CVyN9BR5uPKmPD6_e-hxhFEEFybG-poSZPUwhM7NEuWnpHXc-ukXhiaF0XW0LgNOmsrYNtwdFIj0y4-tMSaURdInfPrX-CPZ1V8XP2BeZj1MR1xN0QFZjeuQzzhxDqCtCY7E1D-vIbZcKdfgYrPbzj3bmVESn_AhLSZaebZLEh2NdhDN_PgpGSCx47xPZJ1fQdat2cxr7yLnjHWtvYpg6Lb0XpoTGK3xHhlI4GwHuhmPRNNARRlK5ONuXpXCcL6cvz-zA9RSuHBsuwmmmEpULjE6IM7xbQNfv5RJeYuVXUgkC55y902p21mlZGsyksp5IVMSmYD6wCZbsZdMyGY3YCVfJLM0QlaHRUScxvXowy3pBp5KsMigpaw1_33YxnHRNvdLzgguovPAbhYmHeEwjOCydfEKAq9hl76ZG7Ua_IZg0xiQH6Xszss7OMLAaW8yW3_bzziTN3gmwnuCkVso_gnWxNKh5STe8dRA1nnd7KLKU5vwkNgVqe826Ph7K5yaGrsXDh-_8_lEl48c8fFXyCWjHZ-Y78Tajm3YnEiWOHw7xnyu2Npq9Ysz5cvnBqw78HKr7sJU1mIyQnAS0IE_7mPHhbjmWkx3EI1D_6CZP8W3S2uyGmQeqKRBqVwXBhYlzC6ylUO1EUeUDjGvX-AwhhWVekO_f0H3qzH9sO7HU1xVjMqNtFNlqzZGto38_lC0kL7URG7EVQMhqWxfKSNR9Lq06o6OMZ_57maXvlqLUOhbeyZc47MWcGxKGfJVut2GLGJFPg0xcULLvdEm6Q8fjtWxiFv0Ut8gMDPdadSJNIgsZeHLahWVcFx0S6Ds8QV8rUCdAvFZluqcdrv8nowJWXxSWEB3QfqcpVaN_8DjzbjvxJc8W0VWUT7Vi8I6lp7-uMfXtQ492YK5tLAKQmSQydi10UIxHX4exhuwTcSBjFAPw1ltKclyup_HbM4lyUJCRc_wmikXNHBMDvBxGoCYICmB3zFowJvNSVwJtVhjI2Tw_Rye6SeWO7_9503JPw5x7SNCR0r8UPVR2qZ6fU88nd_97gQhiYHpuseUZPgdSmub68wMlZdFacl9NuP4c1M6Y4MrXWpFNibQqlbqeRp2acrJtIOXyAFyGx0nuwyqC1Wp-mUI61t2STZVE-de96haY7cIAecmyTo6AMi9P_L3lkuSmM2UQ8vUXVJuKOactTmkQKC1cSn87MLPa8vpbs8uwhlD6kf_bnH0EqfkqpfW4_7EWeAaxRWF_Cr9f7SsAIxAX0EAttjJ8V7WYMInIv53eugh5QRDRWLkf7ds9SWA6wYnKtQahl9p6lwYQ5-vmbP9V_wBvGRiAW3wwM5BcI-ChmUUN-2ZAYNPLk1NTTeBYIZvuRbob5yvGK0MXX2SpuLDhQyTlQakDmuz2W0VIst_AePjXgo7SIIaGOwyCXMId4gEZFC2b6xAVsA3Mrv4dnYhG29J2IKVDQj9a1E4qJI4LHVsNaLaf72sTcymgtZKhCPbc09vYYXMMcUVblV1hejY-Hi1QRHiV_WI7P5nji5CoQRZHNHzLTgNMjq1tjEAORdxJQBR9i80XAQRkrsBix72_-M9h8Pd7TuzQV8DqYLcIGcpYZBT9d30RpOdoVTNCk9aMvp_2z7Q1P49IdUYaGN99fst_pUuo2J7LaZVY7Ew1mxGZTszUDvE0CduMbqORIPXh5HW1-QQpHuknq9MtDjs_LaGNeW5zaX-4BjJjCnTfdIFEJ41ScUy-eSujE2Z8YC5omUuJ5if9_96rJTL7TKFvIRf6BNwauDHL4DCfgbF5wH_fntHagwQGJId8u9P8oo3uFmI01YPsh3A8hdGyXSPjkOPCi-jIZhCKBPmU1yXaiJDdVewCmcxIQ04JxBCTrw37aiKbeaJdlCy28mr-k59plGCDz-UoGRv6Kd4nkA3Fq3KwvN17zhTM4HyA0NkcsZo0drTTdq7TV0R823HenPKDsiB9UfxZbOs0WB18jVkEu3rv-982gQt7b211uqaTJQX3JJpLit-qBy9a7klDW6cK8govjkMrnv_42-W8EiJ_ydNWfwIzMHfQSSieDGfsDN53Iv1qcrVQgpa0qxPbSkAhZxZPvfTvNbttfeZda_aC6NlbfMNGxNwml5Jws6QMLfR9SS8hVoFvAgKNxW6slapbu2YZRLQuR5fkJRZ1fsTykuHDbDSQNpaKDadr0b6CXXKblGnOwSYSrnEB7-3f0uEm_wN6Br6rZs-y3ygTkaYmhpDB1Sqo0hXdMReyvULf1kKFK0wtmLYa2zx3TRNjFEecYZScC2dU7wB282M13TYgsJ5LQrgeX-cZqlPZAC4GdPwguodpAz6BBDpEnX65wHT1KZPnwL-sMHkFlfP_Q8R15DoX2lrazFZHvXS-AvL48AGppsQ8DLF71VbbhpKj3OfPEQlnFqK3_BZYc40I4VEINHODZLpQglIPEefJdWknvLriZIu01ROtHQpPzAvI6Y-dmQfTkFUbSDfBJkG8K4KRbPuEuv1LqsJREG2JQ6uw--RBtLAREAlVAg8JxAiXu74QXiVplEA_01u7YfYGw8VVrfO8bIg-HXfA1_5crZ1wZ-7RyHxlBGSJL4ozKzmBBJdFwVej8rJmZsgMepFdbqgvTvh1xqfMqwugQ6r8QO42V8oZ2Qoazo_V8F5hubowO_EAJDJEeuTHq4wHLmsWgNKGoUYk8XL3oEtHHjsQ-A_JWs5mTEvrbLA9CdsfIpzeQblRSURn8fCBJdKoE8GKAu6i4X3KQxH-eOm2znUGJUUipC03ctQ7y6sZmwet0M5_dueFqVbnfLlT_jKoXvso28Mqe-1co3HUMLOuGJF4fdBNUTf-odXli0pIxqnYIDNL1f5Mv33_xMuBUsNalRCo4F9PfHkJmDjqId2dgXyy-6a3QZQsQLMkynGnUlE-ku9Pe-GdWW0yN_zf4Oi_yCdTRMJSctXju4WwHuj_91vik_dHpwEmZIirunYryMTsslorLD6Duuk4Xe4D5H3wZrhPwfRLF2k1yYYE1HXgulO_QsT1j1308-T2ono8KUIS5xc7MFcce_87TqxVi-rI3k2yoXKi9KsSbnuYt_Xf96Ih9BCpUskKDyPFCNVVJ6N1SZUMFggyftapdbagWTg5uC1NBe8T-fLp_bCqllPLIqwoOZNXCtxgdPOJTLWeJN_kOrUQP4O-oG62kXytROwBU4zsV0D6y2NQ2&cid=CAASFeRonaovKtcLqlqqxZA7nQH5Wa43Ew&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

599ad71fae7cb8d014f7c2d29b8450bc7c34f8e32d49fa103716becef8ae9964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9283
x-xss-protection: 0
server: cafe
etag: 1044373809082006429
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:55:15 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/ Frame 3974 8 KB
3 KB 15ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:46:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:46:29 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3974 0
24 B 69ms
54ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuZ_vZGZkBZ1LdmmP-rew5GYVPo4EMr2PSWr-0qKmhU4Vi5juhZp9y3XDCILzfk3ftumhU3icvRd5pTu3EW3jDmWsOEqjkM7CgaD4KBcYQs0JcFn0AIP8TcLh1VyczESomlb5BjG_ihIO4Sv9YnyZWd8VbOvjJzZfLu8b23e-h_cjqxl1OROSQaCi-5_5Pd3EJsBqYtBtd0xnZlOdnM8DQvTKNkqZ8ELPmvwj8r_sGQ_tYh19aD47i2z37v5jxU8pDdnrJKKGyQBReryqsnm3caPHpeNAdRloxjNvRqG3mOmfp7aMRDj9wVuamelZBdqTod_yoRVenROSH_wBiNfLM7bUaqs4caI8yNZfA8-Zswwu2Shd81Ss32nUj9JM-1oDEygK8lcFbVOLUhfPhp-4QHmNDxb__GL3TP2BfKKCaq0v8K4TOpHZ9spVhseWk_WddnDaQAku3Lbr6ZsMmx4sEmxz6-9V4ADqvm42P_aGf9QUwHS9UHQUBSLO2kLCy_XmS37RZsLPOs9T1ZVETYyZlwtEYjaOquDHiOduifTHA7RCXify37D7AG3FzwvREtlrBIVEq2pGiqXyQ0oe0PArtlrirKRUj9O22bn-k4xzKPDC79_KtQugHLWT8eirwp3YVp2x_iS554fLyrWS62Y2LI_Suaa0BxYJm-yj415G7CNGYF1TK0ABW5qTz6bodZplrWw8uu_K-JacgXs0uWwv_bpZH7gC_yBwmMf9B439uuzRSh5aL2ZcCIsBz-wrBKSJ6F7kDA02LX-73XdkuIg0WyMZLE0KANZ5br6IDpgKKaD888yOUo_a-bJqJVDsqBJG0Ukfya5ENq31Jj0aJydzFEkiI_M8jonQ2pW0S9y58XBAnsq3ofPtlQKD72wR3WuRzWKRn5A6f6Xl-YPleRq_0sWgWjvbVedIXy_krasS5f2i7-z_UTG_MmZYoelkCZ3Oh6GIQif0omECHECjhcmqXM6zsLWKUnGGAdXwKh3NH3Ch-kAkwcSiDIrBZIKWZpysfhfG8nWfMJc0Z6JPgVGAFgARTEPWehdycxei1d_F0cC2x7htjLcHFt5DvXxaiVIQuM90yMatLHN69dWaakgpkzp7T9V7oJZc_iM2vNhQ9X1sFKxf0FacWiLxDOQ0_vkybJv0HP54gyV5IX5NoWU-ryougXI5YfN5Bh2PnAy0EhrjL8ZoG6Vg&sai=AMfl-YRyqYkrNV3L4xDCB_uBrcq2IUWw6_Me7QW7WmdgqzjVDUDr8T7fU9iRJUa_FnpiGqQW-bjj7Rj0ol0ntFTBkv8bjxQdjsltIbVCJlPZiYv2BBN9ygc2E4waHK_jPVxGF2B3IfRL_ZxGZ8HPOQd5oJVTW2Z0AZu3nvjVt1A&sig=Cg0ArKJSzBHZLCUfv80SEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211013.21536&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 19 Oct 2021 16:56:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3974 41 KB
15 KB 7ms
6ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 21:12:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 17 Oct 2022 21:12:41 GMT

GET
H3 200 10022021-085523243-MLTI_MDR_TMSN_B_STAT_0_SUP_300x600_0_POST.jpg
s0.2mdn.net/9901250/ Frame 3974 80 KB
80 KB 8ms
8ms Image
image/jpeg 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9901250/10022021-085523243-MLTI_MDR_TMSN_B_STAT_0_SUP_300x600_0_POST.jpg

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

659ab9e82c7e8f33fe15601b3c3ffab8fac3429ab515282bd621061ea1b7ddbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 18:00:45 GMT
x-content-type-options: nosniff
age: 82572
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 82369
x-xss-protection: 0
last-modified: Sat, 02 Oct 2021 15:55:23 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Oct 2021 18:00:45 GMT

GET
H3 200 01d6a24891b17dcd25841d24d2c24889.png
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 168 KB
168 KB 11ms
10ms Image
image/png 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/01d6a24891b17dcd25841d24d2c24889.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1388d9e37742e0bff62e541f312d861c404530e5f869aa00badfcf07b3a0aa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 172467
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 40ac8abac77442f0f6dd68503f54da1a.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 4 KB
1 KB 14ms
13ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/40ac8abac77442f0f6dd68503f54da1a.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c91ee0629bbe021230d1b2a07e2d3af1af1cad62259581aee761a7d4c27c071

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1174
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 1d127134441b568dcfc541e0ff85733f.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 5 KB
2 KB 15ms
13ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/1d127134441b568dcfc541e0ff85733f.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8122f5b22bbcf569a2b09eb2e57510237cbbabf67163ce557cc7559e1cd674a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1611
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 d1f4ef92031d402819e8f551efd529be.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 3 KB
951 B 15ms
14ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/d1f4ef92031d402819e8f551efd529be.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b6e6b27180170b0aed26b2e948b9913ca683f99e2eeb9506bf7521079d9289e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 925
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 679a80f70b037d376d34b669e832576b.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 2 KB
1009 B 12ms
11ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/679a80f70b037d376d34b669e832576b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a242416dd199b930318036e36ab77dbfdff8916867e3966ad03d57b2fa52ff89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 983
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 e038514405104d95d2c1acc540ca613c.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 1 KB
676 B 13ms
12ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/e038514405104d95d2c1acc540ca613c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3f26856cef296acf59ffc2b13264608e0155d91ff4bb1d784b94ee995d3bf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 650
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 740ccd7058bd42f8a954c491bea1a88c.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 1 KB
647 B 12ms
12ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/740ccd7058bd42f8a954c491bea1a88c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d65159e23d670950b56f96df11946e075a47e129f0ab1ea71678974afbbc9fe8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 621
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg
s0.2mdn.net/10772884/1634043215370/media/ Frame 5F08 5 KB
2 KB 12ms
12ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043215370/media/4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043215370/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fc98a5f2ad3fade2176c7f4d057c02a332ee5d3e532746414eda6e88bc46ae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043215370/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 15:05:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1881
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 15:05:51 GMT

GET
H3 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 4D45 20 KB
13 KB 47ms
47ms XHR
text/xml 74.125.71.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-DXab_OgOSv89c4bg2Z6UWgaLv0lKWEb295abfQRv4gx-r--kS3thSiMyqZcucAP4wnQNkq-72LnRY_XxFK9utAeJsR-A&dbm_d=AKAmf-D-q-5uVs2XqTUBcN6Q_Xgmq-7BFCCYv_qB7wXVqnLj6OgwQgOjiKbeEQes6ge7U6MlWY3lj2kvZUFO6vHIS146sSGID8WDBuM6QQLL0DgJUZQuYNgmTC0oVGIJY5NrGT9xH3_unJij_LENeHQP57WsAcz8s919yryR0Sqa8TLtKP2CAW7v4J7qf6tMMP_Cmmd6i3yDpzJ-Arn1lLKTj-y--kwFA6Lk4qs0ax9ZZZeqG2alRrdz8ZAOzSqeQ6IJPv1jO4BX_1Yf_84XQ9I6hMzmmjzHU3B3m_gywwMLarAj0jLG3srg1enBG2KeOhsdU32w8KDVeDKRpwMmslmlRDY7pNg7xCxMt8sO6J6fQ0RJeY9RBxGv_PgOjN-a2cj6rt9zia6vb8sjwQOWGJTE2m4uXi-pNuDsWRL1yiWYSyAYbB9H1k-QItQQyoRmJ4ri5wS5RSdXoqN3jJtg3V5i0obFPHfuGkNKlqIO_Bmgu4eVimThuFKGJBt7dy3Wr6yOZ2-skPr7r3Hl1lKSAbqcoIg35ZaB4gKVw0c22B0DBpg4TjqIH8PJB_rmY_NpiGde3WDlfkaAUVsCT8LaKjHK0FcOv1-KeNvq25a0AHsp3k9frVo03vOSod4T8zzLY1S8erR4rdxyENrqrPNfmswC1Hl88TonrlthGHJFdjwfaCi1-syz5yA4Nmp2AsQT-wpykvqmtpQtdZfhLC_-6IYRNmaohIF4eki32ryikp1LMDqLa_c3WGNE7QwRUesH15RDH4XaYl_VMCH7halHUF5dxsx2MLUIxlzoFxQ5dIGBnXY3L6n0Y23f9uJ0sgkiNC4yp9qe1OD4ZqLP1H5zf-tEjgxZB67KuC9ITwvYJU3Ay4pFgldHDoFY6IbiVQ35zLwASvJRX18pwk90wtqud5ViBh04MOMf2QI5w22kXK2nMRjUPcwkcLDVh_Rzi9hcbeeSu2h1C9CIKEDz4a183gxamISxFe3PCduXAWVPxvT9NqLNTMAu1mdPIEujAJBzOJ7rGDTsGND-yjFhS5drbC79KbyhvJ1uUix8QJ1MiLSsO3LLZy90lwyLE1FesUZxWRksxRZX9iqCSHfrZp03DDC3RJZWLPY2kh5Ey9PrG4TYCBVrsAbPIEBk2GClkRR76IaQ7QY1brOQmyommQSMgtBw9vSlmBhfd6w4je4fe8Jg4AbI3G5tZ6yoV9SVQGQVEZaZToG_nslrSuW7vigm6_A9OZqnI0MHsaP2vBlmpaA29WqtrgJ4juv-pKiBKvVyK1ZRrRk8SKqKqsiaY_KY5sU6XCY3aXmkknxMZQodjUA9Lua9rQL2BsMnOT13uPlrk_DVbW-MWqlWj__PV1szKkvEUZJQjbM17RHMB8gcCYbNWMlaPKwe9JN3GdA7QSEDPB5e2GRwA5bqToe82xz-3xU3o5Wu4xmZVqoO0dPP1C9bq5BlArV9ukaSPz4bPWRjJiYvUgiGVzi448TZtHycqoeCramH-DNgwzKTzqhBnYTCcURFTVcgFDpCva1ZoYCMGCqrw6vg8-e9cAIHc8mgPcXtpURYfcnbMTGi3ywx1yIr3EN3-SH6mGeqIwf6STHb-iCTtyMgl-9IwPOIAsa6PoL8Pa8UwaNkGi8RXVqfVw-QG6K4kicALSh10nnvnjUv0X1-Zv2VOLn04gzn6BAyn7RhfjTyUg9f2CVsOmruG6nmNP6PGTzQwvDgrT2NjufqKN03R49VXFP4liGrHy82twtYtSV3Cf5epdRo4Tqean9kdHZcEaefLxXoMu0ES8JNRnmq00VBakDd23bFlKBI6x8WN-CXOir0nEi5MLgKRFwnEKxDaBDtp98lg41wrDj4Z-QOaxDp2PrwmQjhb92_gXEdLJakK7N7rT6VJ1VYbdUrDScO-Vp71NG1DgQhpIjXMRvoOQ4kmc5IuUsmYrnXboS7kIfOgcSPN2Y44QTjVxPCslP397uNLj1YlVnrOvTDoKb-Izxu9_OIstWTGUA66hICrLWfoXpK39mOgjccPE5G9gQwvs9HEssuaCBEOW_NioceuXRhFl_s6jXjRS3fpOpJUBKeMf-ZURdn6BKUeCgavd-CPS9dtra2Olb4loW5i_mLEfcj57uyvgruYxHr6dzxBqdHozTM6_vBOoZUvRNjdmLHowsQn0s2aROgC_zFf-NLEBUNy0R0TcG-hf3nPkinq9abzqMLnBLJ4WsWQsDX53WosWE-GKu9wQCWG4gMjascGPQ7HqLSIHcttfh28fXRdIdv7oJZrWKKDvjn34tIsWTjLBRFtBKKUzR4lI0Ix53d6v2yhSpl2ASx5hi5hrC7BMwfiyRoo6WRmIgFiDtgPDfa4Yf2OyWlgopz0G3Zoh6fmJO1BX4xgN3-Pm3TgZoDDFTQIKthFyH9ymJRozHbV64z9vggdxyY2imu-cy0065ukz6b8yfYJsMcbtNuKNEpzDMDt_Q_wR3bMF71KUOGKMalkqTToEUr6l3FzWbOzEKajctnkYBwZLHM6KJvVIJZXWdQf2I9cUYuZgMAr5Je3CAxSm7Q9G0jGDigXJvkxUS0EM6UHWEaVEPyUJ9TK3MUc6hNEPMMMNaj2bvjBB1EOYIol74pQfbakOaHbhy6Uvpx-VosurrBPDJnDkU7Bh_t_2_LNU5Di2aVxNjoxsQAxnwIWHj69SqSBm4VBqSlCsCzRT9EWBT-H9DBPeEVXIEolO_c2I8CA8DgFKYm2AwC13JlU0NTX6EH2An9X9ZbX-DIdXKWqns4qUrLN2eY36dpWAijsDDffy_1t5NmCWhTUfQdOWdm9zzA3lxJ0eKJHDCwAK32xwQXWPBsaRXXg8zD39tMP1qf7JGkFB0vZZF8c-ktZBrXIsC8hFMvahBf3euDExk6yxR6ft-BSl8GQJQkn52ghKdSurcDE6WGtVgypkaMswfy_Kd3dPHoixoxxagS6278O_M_&cid=CAASEuRoGLwjmBm0V50Hd8fS55_rdA&sdkv=h.3.485.1&osd=2&frm=0&vis=1&sdr=1&is_amp=0&hl=en&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=8B823963-A793-448D-9EC0-3E7186C4571A&eid=44750820&url=https%3A%2F%2Ffemme4.com%2F&dt=1634662617728&ged=ve4_td2_tt1_pd2_la2000_er279.-2164.432.-1864_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.71.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7fde79500aae9b48204cb53f49074ce03168882b18e0ce7d5679c3453039c8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12776
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 be68fac4543e50759c26d7a153fea00f.js Show response
s0.2mdn.net/10772884/1634043210829/ Frame 40CF 65 KB
17 KB 7ms
7ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10772884/1634043210829/be68fac4543e50759c26d7a153fea00f.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d4b9633320f23d8ce3c4dcb514f76d27c6774115c5f699917dd94c3777a6ba7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17238
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3974 0
23 B 45ms
45ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8BBC 624 B
297 B 19ms
19ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGMWEuq0BMAE&v=APEucNWg6g628pXsQdpeuMWgmVH3INuuhSsbnGRU64DnRZn5meJFgLrxGzLu8wI1klBxQzjJl6SQRyOvI70E8wAGPO99bds9lg

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COefRxCA_O0CGMWEuq0BMAE&v=APEucNWg6g628pXsQdpeuMWgmVH3INuuhSsbnGRU64DnRZn5meJFgLrxGzLu8wI1klBxQzjJl6SQRyOvI70E8wAGPO99bds9lg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkmVJrhd_URys5sT-ZaDsY2u3pfGNtEqWxXIPUk-hgkb-QbugcvR2wKSVjW_Jc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 19 Oct 2021 16:56:57 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 54AC 61 KB
27 KB 41ms
41ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsgtwnnehD1uSd7SE9whhEbXItiYNb32bhQLOg4oPzXUg2s1ocyS8hX2GLpartT6F1lmpk_65Icw7eNKmfND3PMJi_qKn41_0qdVGoNl_h2ia5wfOdApt5w5uIgLaop-AXCBUJ9TWJLj-e-c4_f-cyJHuNhQ&dbm_d=AKAmf-B5D37hyaurEFkVigk7AForMeIKkbFbHyrXs-kOC7m-yZ488HfPR2CkShpKe1li-gCShdhW7OBSB5DYdh6VipQac4HNaf0E5Vo3znJejvoDIzy34Js1UMwuBvm80dcZ3BXh9Jl-D4Blc1txq_6u28gau78NaqQtb_NQxRobPGkk3qlmIrwb6f69keCTFNJ5xHdRf_p5UrKXZUQzE3l8HZw7WR3Ri3YkVwiNxpxM9VVwsxYWHYrKRU1_pUvNFcpOLJk4LfHgbA838lD2bkIEZcYKKhu25A2vwcNkZ6lEC24RXWJKs758ddYj05IAekJV0TF1hbTR7b6hfJSNLI1CMclw1bWaaI_94xmzD3kD8uBaybOVPshy3Fj1S9Y32gE2wCNgFCku6I829WTEOKJFrgOf1qNbh_Y0g8Id46feUW-i2jclqHFpsNovpc5rdUJGrxTXJV0KoDNbI2GbyR7EG1q0n70p51WSGAYGAyxbuPBnI0Qmo_hBbNf-PbIPQ6Hi6SRlyFtaFph-zpr84sxTPnkz9BKZLKw-7AhOiOpWBLgo5XKNAsYHWAyNwUbOIaqUewf3iMeccopiFjC0ybDH76bYPSyByc3e193TWc0BSYWzoeh5qRw1hVLVnfu_R-0UObxNuedbHXbcXofgw_WODWFXJ8WZrljgqACztESWWtqNvlTzY3i5gR59esQpyTZFlQN-HPQVq46lcRwUpj71bsQlsDL3WgPwWGqB9_V93q1s9xPkFKEZ46T0Mx_gy-kbRTD13zXyl0PFiYzFaARiFHIHuxclHZauY974Xx_pJXAbnPh933eg5gPQfnKhHaUCUmcWy5jTPEXfSop6BCDPMZuFi01j-qhNca6Gp7eLWUOEpQqUQ6Czy8QXH45uOeLoVLIVxHg-u7CjTVGiKXoK5oLiCoBJ3wG_yEhQZK0aKjuFZNMVao2G1P1ROZzE5vXbdkp5YpIPDb7Mq67u3UzUHarjj4YvWYmmus88-uRbB4qpx2-1ppspLBqjDj6InibvJQw0n3iU70ux1Fh4K27oQSkXXeQWpLHjFoarGxkg-JeXaAYOJr_DYtU0D1LA0TfRyJE7PEPQwOK2lqU8ABF48eSfOh_jnjm95T2hE02Yvz3ErES2TUjnpWY_W9j5QJogKCietjIfOwoerLTT_PdPOa6aVIdjEcErx0v9EvdjQSaTruhChnXi12Y6WLvOBo54Ry_V8GR_UaxG0qMKZwNyXOvw4IsBin1BXrjFOI3RuqPd6ePCn_ZDKTW1lEuv33WwpP9QSuFpIzHfO334Y6ofZjuh_981A8yMUGswBkmVEukruiplxKYrc0fGK-uXnpNt6uYPU4-dOrX2xM0o9oNzkkRBQTGOYoI_XvV__5GwLJua96tngzSi5ohhOwIvCqehmVr4OqsY5NoUHpF-UAwPEXA9n8Pohxci9XLPAt6E-aoWaJ6c-l3zoLCEb5AQR5mCBeKrQ0zue01o_44zquR6jRhz_0DYJtjGPJxWtBpmfVUf08LKQOSVaxjM9YhiKjo07qIXMcL5h-EcULjHS27oNj2dBQ76TD7KMdygZEykUBIwVhtOt6BlsvwR6dLfTn8v4dJrDeU0sB6rPTx5V0SnxPHgQwsrvpgEzcWnhaTsIiToNxl4CAMNO2xhCuI_djDINQwALZSWiJ34yWDbflPGmbT_8wdsUrG6N9NdznzAKesY1wNwToLMlNy5tSSvLMq-APIzy0w6Cz2fYj2s2r84ivR9Y6t6XZ_NJyjKo2eZFQjaGOQSqcSVhVsy9VKk7xcFaBAY2inqzHGGCzezGDjVrOOZcugGT38-n_5oVh22sYeCdx2t4-DCwxXIb9M4IBIi-3RM4GPtUJyMhCVS9PtaY1izc9i9SuzMOW77MIdqIozPL3O9FWGDg7VnnHns53iqR1FmHuZS8uAPelfa7GfVvVukySpvycmeMPZgNsgCIdKsomSPuRI-26o6zjXMtqfFMFTlYwdfUCV5CO1kIvF4qhgPuQdNFTlQHJ-cOE3IGlwrodgPeVMZJl9aZpokJ4LAyoY22z6y3EaNztgdumPsI-r61qm-I5vNIyZPlvpncTO4UphEkEFBfLMl_CKWjaJBV0jbEfjZjH3LPGMRQqwEanLcFub6Bkp5mRqKl6zufHQOH9g3RvK3lh2i4zKc9kd5U4RgcKGaGlx1cdaa-ugICsLxdHQqMvvIRtg-IC62vq6fZyPPrnd7WafSkrhEgPGCnRBY38rZdTj4X4MIioJGUfu1lt6x88-htYj-ySD9kq3w2WIaazKz7ZMsTx2gVx0BX6M2Z56N5-HEpyBKgE7e7w_8KD94PNmG8Gp1mXjEsefzabvCxwTc3rC7ocIR3JStZ0VC9WyqaWpK_GOLHD_8a4_newwPa5ZDrtfC8-WebodKbLR8R7jODYxoo6MmOro0cSylV529nIE06PjxxF-Aufic2Sqzlzqet_3g3nr91vyb8gmykVlV2brfNEHjqiCB1RCm4SWDFALO6vT6Wf69ehP5NzZZydkY7hKyPQ6HNKwAch8O6D_KmXZ75QoucaiaKr2wV9bZS8bn69tLhtWSzOabOGw3glRZYP8ArTlQnglttReFouWZwmJSYMnul7EZeXJ99fZRCQuDimwZVvCeHJwmOyD6w2hooPh0aTzDWMDP_zxDAPrEnWCDHxo1L-BQ9-FvPBvy-CG4rBNKOgeuEZkq-dEHY4xSHYjRVX-5DxgHOnXNSaaq-pN7sziHMFhvBB7L-Yo0S7jmCg9CImu_QtMoYsd4q02Lwt8X59wUMO7xxp3sfHH4RsxSSKeHQok0LpxPzQPfbWX86ot3l6pSUYHjnD5PwoJnipuIJzskQJuN0uAEIEjIz3kMZdviJHHVZWVvew8w4j33gngKWaiNNe9AODAViN88pyhdWmIEStbRtKIABZG4Kf9fArvKKttPh5Ant07l15AIr-fuUMLIWCd-qEjYRcdKY5eCZ1TuguIV4JqO4g3nSLsJo0tUqRns2Y7DbY97CIFRVHJLRH7sa4aU4MLPk-7-3HEWYElfouCsNm0eTXgDrp3aRulDBxMcbeyrh2Cdf1owMCGgrBnWLDzE1rPdRw&cid=CAASEuRoAldADQ6WXNW_xADv2TlZTw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e958073c634b1d1263dfa6556c12d60a995f4be40bfb3c769206d0c86b2605e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27565
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54AC 42 B
63 B 49ms
49ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AFIImFt0fsxClFB3fTfAdR77p9i12u7gE6rHqA2V3M7hctqWqemU8uL49e7u5IGvVzUOGF7QCDzqgy1IXbgyMXStR3lFYjt7sU4OUmOUKKz89dQ8E

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 54AC 3 KB
1 KB 6ms
6ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/window_focus_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:52:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:52:23 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 54AC 123 KB
37 KB 25ms
25ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41d9de265e720a301cbd9c525fa7089a677e0b099b422579a401516212b5add3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634125446224599"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/ Frame 54AC 14 KB
6 KB 6ms
6ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211013/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4726d988effd5253298f2a2738ca92d780d4105af0ce67eb7e7d1c748fb6909

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:54:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0
server: cafe
etag: 18349783599053866072
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:54:55 GMT

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 35A3 35 KB
13 KB 15ms
15ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 10:15:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 10:15:46 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 22F8 22 KB
8 KB 7ms
6ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sun, 17 Oct 2021 21:12:41 GMT
expires: Mon, 17 Oct 2022 21:12:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 157456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3974 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 089ddf72fefa8382f3a1abe8a09c14f5ceeef76af4f6357cb4375b71762a6209

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK 57630551 Show response
unified.adsafeprotected.com/v2/774606/ Frame 4D45 22 KB
5 KB 196ms
54ms XHR
text/xml 52.18.186.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://unified.adsafeprotected.com/v2/774606/57630551?mon=57630552&omidPartner=-1&apiframeworks=2,8&bundleId=[BUNDLEID]&ias_xappb=[ctv_appid]&blockedAdTracking=https://googleads4.g.doubleclick.net/pcs/view%3Fxai%3DAKAOjsvenPfBNJOu3b1wGxUn9MW-_NTfHRQDLAbiw6dbhdfjLanKjDpBevyTjJrVstcRSeJBxAT8r3ws9j_MKl_q2714QT7bdeCTXWYG7KGcZbvVaEhnUTnhvYnfSxugE70h9Ok8nl10ftDpJiXwbw%26sai%3DAMfl-YTEsCPBprCu8y1FznRWfLqz1pxIcrmz8v2_LJ1UG6ktRZrGN7208QAGlam3Ye3Ggf78BnyI2iwgc2yCvEm1NKNoomC-a33Y-54%26sig%3DCg0ArKJSzJ0z1iuFEWxSEAE%26urlfix%3D1%26vt%3D13%26adurl%3D&redirectedRetries=0&originalVast=https://ad.doubleclick.net/ddm/pfadx/N286407.1972103DOUBLECLICKBIDMAN/B25684810.316260450%3Bsz%3D0x0%3Bord%3D%5Btimestamp%5D%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext/xml%3Bdc_sdkv%3Dh.3.485.1%3Bdc_osd%3D2%3Bdc_frm%3D0%3Bdc_adk%3D704253846%3Bdc_sdr%3D1%3Bdc_ref%3Dhttps://femme4.com/%3Bdc_vast%3D4%3Bdc_ves%3DdGltZXN0YW1wOiAxNjM0NjYyNjE3NzY1Cg%3Bdc_cid%3D159620764%3Bdc_adid%3D508779485%3Bdc_vpaid%3D0%3B
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.186.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-186-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: bcb83b1dbe2dca0b8c889c12709e64e36d433acef418aa0ac0a8d6f9108aecf3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Content-Encoding: gzip
Vary: Origin
Content-Type: text/xml; charset=UTF-8
Access-Control-Allow-Origin: https://imasdk.googleapis.com
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 4343

GET
H3 200 7b77dcb1ba552ce7a99facfd1a9090e3.png
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 410 KB
410 KB 11ms
10ms Image
image/png 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/7b77dcb1ba552ce7a99facfd1a9090e3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

807e17c9876120eae3192a036a1d509cb5c3094de970d7a30b83e9aaa0b90aed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 419488
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:31 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 e215778eb1829fe5ae0df4333ecc3af2.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 4 KB
1 KB 14ms
12ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/e215778eb1829fe5ae0df4333ecc3af2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96d9f58640c821cd2bc50aef63eb8f804d74c7fc9d38adccac99131affaa5eda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1310
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 aa7bff99dfc4debf28604cbab4feb145.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 5 KB
1 KB 11ms
9ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/aa7bff99dfc4debf28604cbab4feb145.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f68329f0d0fd84eb7dd073b8c297c1c5ecd584db4bb6e02eb50aaf7a5c440f3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1419
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 625949717608adec9ba8fc401f1dd414.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 3 KB
989 B 12ms
11ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/625949717608adec9ba8fc401f1dd414.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c1fbf6716f852b0885fd2e921f0b1e5f2c8dd57e3fde17c297ba81f0fc77427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 963
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 56032aa32d9d4ef3e010aea88f1d5baf.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 2 KB
1 KB 12ms
10ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/56032aa32d9d4ef3e010aea88f1d5baf.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a3fdb1f3bf800e3d6388a16866c63cfa164ed6f85823cfc3a726b785993e10c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1008
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 dc341e200ab7b6b5d4c61f2e1cb3d5b1.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 1 KB
611 B 12ms
11ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/dc341e200ab7b6b5d4c61f2e1cb3d5b1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29f5ffb845bd626755f475e4955800f23bc5e8a66e10a11d76d3f5b57e783197

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 585
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 58ce29676158a040ceff3399e42ae7a2.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 1 KB
606 B 14ms
13ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/58ce29676158a040ceff3399e42ae7a2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f0996ed0067396fee7b71b5b4c8b264f2c7edefa6cce07431184ae931c542e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 580
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:30 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

GET
H3 200 4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg
s0.2mdn.net/10772884/1634043210829/media/ Frame 40CF 5 KB
2 KB 15ms
14ms Image
image/svg+xml 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10772884/1634043210829/media/4e4cc93ddfd2e1b75ec0f0e9ea4f028b.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10772884/1634043210829/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9fc98a5f2ad3fade2176c7f4d057c02a332ee5d3e532746414eda6e88bc46ae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/10772884/1634043210829/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:04:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3139
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1881
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 12:53:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Oct 2021 16:04:38 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame E5ED 0
23 B 42ms
41ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJ2Nw_vbkH_SXQ-0U_gqzgavtcCEMPDXTBhVPCdqKYq7-xCIhLHLTNW-Nr2rQWHt3U1FTczhdL7QNrDiNRviAtyNzGs_dZ9OrpFZP5k_IdUkt7-DdVlfrbedLMPdUh1g&sai=AMfl-YSHdJ6u-DpfPJay0_WYQPXYSV3sDYNVqPtAplsKNcJ8sv088I2rPXR2sPl1IHtDF3IX9WUk5x7whP2b2O4eD6mgzJQ8IK1pMPteMqY&sig=Cg0ArKJSzAhPsinG-VNeEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=500&vt=11&dtpt=355&dett=3&cstd=142&cisv=r20211013.19516&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame 3974
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/774604/57214098/4.js?adContainerId=gcc_2fhuYYXZIJSU9u8P6cSlmA4&cbFunctionName=goog_wrapCb_2fhuYYXZIJSU9u8P6cSlmA4&true_pb=https%3A%2F%2Fstatic.adsafeprotected....
https://static.adsafeprotected.com/4a.js

2 KB
1 KB

7ms
7ms

Script
application/javascript

143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1dafee2da776f11c64f940dd266fe3e89f2d20b088f76727e3670b94f0278812

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 20:06:32 GMT
content-encoding: gzip
age: 75027
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 18 Oct 2021 20:06:18 GMT
server: AmazonS3
etag: W/"bd7db987881ad3f1742dc6a76ac596d8"
vary: Accept-Encoding
x-amz-version-id: 4TGFxCjbCpz5P_cG6etsvTa.ybT.v_UW
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: CNLoEBCIBeGAl63NhXqJgYiQEdD9GwEtKohKNHt1sSerqSHPk1sMcw==

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
x-server-name: app17.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 8954 80 KB
21 KB 66ms
7ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 18:55:08 GMT
content-encoding: gzip
age: 5263311
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: xbqj5UL9p6seKHsxH9pVF_ucCnLV6Lx6bfK8DVEJM6mBJ7JqNu-BrQ==

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/774604/57214036/ Frame 54AC 229 KB
76 KB 36ms
36ms Script
application/javascript 52.50.243.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/774604/57214036/skeleton.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsgtwnnehD1uSd7SE9whhEbXItiYNb32bhQLOg4oPzXUg2s1ocyS8hX2GLpartT6F1lmpk_65Icw7eNKmfND3PMJi_qKn41_0qdVGoNl_h2ia5wfOdApt5w5uIgLaop-AXCBUJ9TWJLj-e-c4_f-cyJHuNhQ&dbm_d=AKAmf-B5D37hyaurEFkVigk7AForMeIKkbFbHyrXs-kOC7m-yZ488HfPR2CkShpKe1li-gCShdhW7OBSB5DYdh6VipQac4HNaf0E5Vo3znJejvoDIzy34Js1UMwuBvm80dcZ3BXh9Jl-D4Blc1txq_6u28gau78NaqQtb_NQxRobPGkk3qlmIrwb6f69keCTFNJ5xHdRf_p5UrKXZUQzE3l8HZw7WR3Ri3YkVwiNxpxM9VVwsxYWHYrKRU1_pUvNFcpOLJk4LfHgbA838lD2bkIEZcYKKhu25A2vwcNkZ6lEC24RXWJKs758ddYj05IAekJV0TF1hbTR7b6hfJSNLI1CMclw1bWaaI_94xmzD3kD8uBaybOVPshy3Fj1S9Y32gE2wCNgFCku6I829WTEOKJFrgOf1qNbh_Y0g8Id46feUW-i2jclqHFpsNovpc5rdUJGrxTXJV0KoDNbI2GbyR7EG1q0n70p51WSGAYGAyxbuPBnI0Qmo_hBbNf-PbIPQ6Hi6SRlyFtaFph-zpr84sxTPnkz9BKZLKw-7AhOiOpWBLgo5XKNAsYHWAyNwUbOIaqUewf3iMeccopiFjC0ybDH76bYPSyByc3e193TWc0BSYWzoeh5qRw1hVLVnfu_R-0UObxNuedbHXbcXofgw_WODWFXJ8WZrljgqACztESWWtqNvlTzY3i5gR59esQpyTZFlQN-HPQVq46lcRwUpj71bsQlsDL3WgPwWGqB9_V93q1s9xPkFKEZ46T0Mx_gy-kbRTD13zXyl0PFiYzFaARiFHIHuxclHZauY974Xx_pJXAbnPh933eg5gPQfnKhHaUCUmcWy5jTPEXfSop6BCDPMZuFi01j-qhNca6Gp7eLWUOEpQqUQ6Czy8QXH45uOeLoVLIVxHg-u7CjTVGiKXoK5oLiCoBJ3wG_yEhQZK0aKjuFZNMVao2G1P1ROZzE5vXbdkp5YpIPDb7Mq67u3UzUHarjj4YvWYmmus88-uRbB4qpx2-1ppspLBqjDj6InibvJQw0n3iU70ux1Fh4K27oQSkXXeQWpLHjFoarGxkg-JeXaAYOJr_DYtU0D1LA0TfRyJE7PEPQwOK2lqU8ABF48eSfOh_jnjm95T2hE02Yvz3ErES2TUjnpWY_W9j5QJogKCietjIfOwoerLTT_PdPOa6aVIdjEcErx0v9EvdjQSaTruhChnXi12Y6WLvOBo54Ry_V8GR_UaxG0qMKZwNyXOvw4IsBin1BXrjFOI3RuqPd6ePCn_ZDKTW1lEuv33WwpP9QSuFpIzHfO334Y6ofZjuh_981A8yMUGswBkmVEukruiplxKYrc0fGK-uXnpNt6uYPU4-dOrX2xM0o9oNzkkRBQTGOYoI_XvV__5GwLJua96tngzSi5ohhOwIvCqehmVr4OqsY5NoUHpF-UAwPEXA9n8Pohxci9XLPAt6E-aoWaJ6c-l3zoLCEb5AQR5mCBeKrQ0zue01o_44zquR6jRhz_0DYJtjGPJxWtBpmfVUf08LKQOSVaxjM9YhiKjo07qIXMcL5h-EcULjHS27oNj2dBQ76TD7KMdygZEykUBIwVhtOt6BlsvwR6dLfTn8v4dJrDeU0sB6rPTx5V0SnxPHgQwsrvpgEzcWnhaTsIiToNxl4CAMNO2xhCuI_djDINQwALZSWiJ34yWDbflPGmbT_8wdsUrG6N9NdznzAKesY1wNwToLMlNy5tSSvLMq-APIzy0w6Cz2fYj2s2r84ivR9Y6t6XZ_NJyjKo2eZFQjaGOQSqcSVhVsy9VKk7xcFaBAY2inqzHGGCzezGDjVrOOZcugGT38-n_5oVh22sYeCdx2t4-DCwxXIb9M4IBIi-3RM4GPtUJyMhCVS9PtaY1izc9i9SuzMOW77MIdqIozPL3O9FWGDg7VnnHns53iqR1FmHuZS8uAPelfa7GfVvVukySpvycmeMPZgNsgCIdKsomSPuRI-26o6zjXMtqfFMFTlYwdfUCV5CO1kIvF4qhgPuQdNFTlQHJ-cOE3IGlwrodgPeVMZJl9aZpokJ4LAyoY22z6y3EaNztgdumPsI-r61qm-I5vNIyZPlvpncTO4UphEkEFBfLMl_CKWjaJBV0jbEfjZjH3LPGMRQqwEanLcFub6Bkp5mRqKl6zufHQOH9g3RvK3lh2i4zKc9kd5U4RgcKGaGlx1cdaa-ugICsLxdHQqMvvIRtg-IC62vq6fZyPPrnd7WafSkrhEgPGCnRBY38rZdTj4X4MIioJGUfu1lt6x88-htYj-ySD9kq3w2WIaazKz7ZMsTx2gVx0BX6M2Z56N5-HEpyBKgE7e7w_8KD94PNmG8Gp1mXjEsefzabvCxwTc3rC7ocIR3JStZ0VC9WyqaWpK_GOLHD_8a4_newwPa5ZDrtfC8-WebodKbLR8R7jODYxoo6MmOro0cSylV529nIE06PjxxF-Aufic2Sqzlzqet_3g3nr91vyb8gmykVlV2brfNEHjqiCB1RCm4SWDFALO6vT6Wf69ehP5NzZZydkY7hKyPQ6HNKwAch8O6D_KmXZ75QoucaiaKr2wV9bZS8bn69tLhtWSzOabOGw3glRZYP8ArTlQnglttReFouWZwmJSYMnul7EZeXJ99fZRCQuDimwZVvCeHJwmOyD6w2hooPh0aTzDWMDP_zxDAPrEnWCDHxo1L-BQ9-FvPBvy-CG4rBNKOgeuEZkq-dEHY4xSHYjRVX-5DxgHOnXNSaaq-pN7sziHMFhvBB7L-Yo0S7jmCg9CImu_QtMoYsd4q02Lwt8X59wUMO7xxp3sfHH4RsxSSKeHQok0LpxPzQPfbWX86ot3l6pSUYHjnD5PwoJnipuIJzskQJuN0uAEIEjIz3kMZdviJHHVZWVvew8w4j33gngKWaiNNe9AODAViN88pyhdWmIEStbRtKIABZG4Kf9fArvKKttPh5Ant07l15AIr-fuUMLIWCd-qEjYRcdKY5eCZ1TuguIV4JqO4g3nSLsJo0tUqRns2Y7DbY97CIFRVHJLRH7sa4aU4MLPk-7-3HEWYElfouCsNm0eTXgDrp3aRulDBxMcbeyrh2Cdf1owMCGgrBnWLDzE1rPdRw&cid=CAASEuRoAldADQ6WXNW_xADv2TlZTw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.243.239 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-243-239.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: aa66922488b952f78b102e55acd3d0b9c43187dab5972fda90d8fff969b5d4ee

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
content-encoding: gzip
x-server-name: app01.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/ Frame 54AC 23 KB
9 KB 14ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsgtwnnehD1uSd7SE9whhEbXItiYNb32bhQLOg4oPzXUg2s1ocyS8hX2GLpartT6F1lmpk_65Icw7eNKmfND3PMJi_qKn41_0qdVGoNl_h2ia5wfOdApt5w5uIgLaop-AXCBUJ9TWJLj-e-c4_f-cyJHuNhQ&dbm_d=AKAmf-B5D37hyaurEFkVigk7AForMeIKkbFbHyrXs-kOC7m-yZ488HfPR2CkShpKe1li-gCShdhW7OBSB5DYdh6VipQac4HNaf0E5Vo3znJejvoDIzy34Js1UMwuBvm80dcZ3BXh9Jl-D4Blc1txq_6u28gau78NaqQtb_NQxRobPGkk3qlmIrwb6f69keCTFNJ5xHdRf_p5UrKXZUQzE3l8HZw7WR3Ri3YkVwiNxpxM9VVwsxYWHYrKRU1_pUvNFcpOLJk4LfHgbA838lD2bkIEZcYKKhu25A2vwcNkZ6lEC24RXWJKs758ddYj05IAekJV0TF1hbTR7b6hfJSNLI1CMclw1bWaaI_94xmzD3kD8uBaybOVPshy3Fj1S9Y32gE2wCNgFCku6I829WTEOKJFrgOf1qNbh_Y0g8Id46feUW-i2jclqHFpsNovpc5rdUJGrxTXJV0KoDNbI2GbyR7EG1q0n70p51WSGAYGAyxbuPBnI0Qmo_hBbNf-PbIPQ6Hi6SRlyFtaFph-zpr84sxTPnkz9BKZLKw-7AhOiOpWBLgo5XKNAsYHWAyNwUbOIaqUewf3iMeccopiFjC0ybDH76bYPSyByc3e193TWc0BSYWzoeh5qRw1hVLVnfu_R-0UObxNuedbHXbcXofgw_WODWFXJ8WZrljgqACztESWWtqNvlTzY3i5gR59esQpyTZFlQN-HPQVq46lcRwUpj71bsQlsDL3WgPwWGqB9_V93q1s9xPkFKEZ46T0Mx_gy-kbRTD13zXyl0PFiYzFaARiFHIHuxclHZauY974Xx_pJXAbnPh933eg5gPQfnKhHaUCUmcWy5jTPEXfSop6BCDPMZuFi01j-qhNca6Gp7eLWUOEpQqUQ6Czy8QXH45uOeLoVLIVxHg-u7CjTVGiKXoK5oLiCoBJ3wG_yEhQZK0aKjuFZNMVao2G1P1ROZzE5vXbdkp5YpIPDb7Mq67u3UzUHarjj4YvWYmmus88-uRbB4qpx2-1ppspLBqjDj6InibvJQw0n3iU70ux1Fh4K27oQSkXXeQWpLHjFoarGxkg-JeXaAYOJr_DYtU0D1LA0TfRyJE7PEPQwOK2lqU8ABF48eSfOh_jnjm95T2hE02Yvz3ErES2TUjnpWY_W9j5QJogKCietjIfOwoerLTT_PdPOa6aVIdjEcErx0v9EvdjQSaTruhChnXi12Y6WLvOBo54Ry_V8GR_UaxG0qMKZwNyXOvw4IsBin1BXrjFOI3RuqPd6ePCn_ZDKTW1lEuv33WwpP9QSuFpIzHfO334Y6ofZjuh_981A8yMUGswBkmVEukruiplxKYrc0fGK-uXnpNt6uYPU4-dOrX2xM0o9oNzkkRBQTGOYoI_XvV__5GwLJua96tngzSi5ohhOwIvCqehmVr4OqsY5NoUHpF-UAwPEXA9n8Pohxci9XLPAt6E-aoWaJ6c-l3zoLCEb5AQR5mCBeKrQ0zue01o_44zquR6jRhz_0DYJtjGPJxWtBpmfVUf08LKQOSVaxjM9YhiKjo07qIXMcL5h-EcULjHS27oNj2dBQ76TD7KMdygZEykUBIwVhtOt6BlsvwR6dLfTn8v4dJrDeU0sB6rPTx5V0SnxPHgQwsrvpgEzcWnhaTsIiToNxl4CAMNO2xhCuI_djDINQwALZSWiJ34yWDbflPGmbT_8wdsUrG6N9NdznzAKesY1wNwToLMlNy5tSSvLMq-APIzy0w6Cz2fYj2s2r84ivR9Y6t6XZ_NJyjKo2eZFQjaGOQSqcSVhVsy9VKk7xcFaBAY2inqzHGGCzezGDjVrOOZcugGT38-n_5oVh22sYeCdx2t4-DCwxXIb9M4IBIi-3RM4GPtUJyMhCVS9PtaY1izc9i9SuzMOW77MIdqIozPL3O9FWGDg7VnnHns53iqR1FmHuZS8uAPelfa7GfVvVukySpvycmeMPZgNsgCIdKsomSPuRI-26o6zjXMtqfFMFTlYwdfUCV5CO1kIvF4qhgPuQdNFTlQHJ-cOE3IGlwrodgPeVMZJl9aZpokJ4LAyoY22z6y3EaNztgdumPsI-r61qm-I5vNIyZPlvpncTO4UphEkEFBfLMl_CKWjaJBV0jbEfjZjH3LPGMRQqwEanLcFub6Bkp5mRqKl6zufHQOH9g3RvK3lh2i4zKc9kd5U4RgcKGaGlx1cdaa-ugICsLxdHQqMvvIRtg-IC62vq6fZyPPrnd7WafSkrhEgPGCnRBY38rZdTj4X4MIioJGUfu1lt6x88-htYj-ySD9kq3w2WIaazKz7ZMsTx2gVx0BX6M2Z56N5-HEpyBKgE7e7w_8KD94PNmG8Gp1mXjEsefzabvCxwTc3rC7ocIR3JStZ0VC9WyqaWpK_GOLHD_8a4_newwPa5ZDrtfC8-WebodKbLR8R7jODYxoo6MmOro0cSylV529nIE06PjxxF-Aufic2Sqzlzqet_3g3nr91vyb8gmykVlV2brfNEHjqiCB1RCm4SWDFALO6vT6Wf69ehP5NzZZydkY7hKyPQ6HNKwAch8O6D_KmXZ75QoucaiaKr2wV9bZS8bn69tLhtWSzOabOGw3glRZYP8ArTlQnglttReFouWZwmJSYMnul7EZeXJ99fZRCQuDimwZVvCeHJwmOyD6w2hooPh0aTzDWMDP_zxDAPrEnWCDHxo1L-BQ9-FvPBvy-CG4rBNKOgeuEZkq-dEHY4xSHYjRVX-5DxgHOnXNSaaq-pN7sziHMFhvBB7L-Yo0S7jmCg9CImu_QtMoYsd4q02Lwt8X59wUMO7xxp3sfHH4RsxSSKeHQok0LpxPzQPfbWX86ot3l6pSUYHjnD5PwoJnipuIJzskQJuN0uAEIEjIz3kMZdviJHHVZWVvew8w4j33gngKWaiNNe9AODAViN88pyhdWmIEStbRtKIABZG4Kf9fArvKKttPh5Ant07l15AIr-fuUMLIWCd-qEjYRcdKY5eCZ1TuguIV4JqO4g3nSLsJo0tUqRns2Y7DbY97CIFRVHJLRH7sa4aU4MLPk-7-3HEWYElfouCsNm0eTXgDrp3aRulDBxMcbeyrh2Cdf1owMCGgrBnWLDzE1rPdRw&cid=CAASEuRoAldADQ6WXNW_xADv2TlZTw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

599ad71fae7cb8d014f7c2d29b8450bc7c34f8e32d49fa103716becef8ae9964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 102
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9283
x-xss-protection: 0
server: cafe
etag: 1044373809082006429
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:55:15 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/ Frame 54AC 8 KB
3 KB 15ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211013/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:46:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Nov 2021 16:46:29 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 54AC 0
24 B 51ms
51ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsthGiaUMRzcLJVUs1gire_BfLS7-K7k4m76u_PyiPIyXWabzBjf2VynLGYf4MnyKc63W5N7LPFXyfiG-HrTn3fszqVCfJEK2pccsW0s3fPutZMviaHJ3NvHbJr0whv0ws0BpzmmHCE7tUksFIrRy1UyVTa6QfNy9yEm_bCEwHQ8rF95c24KtPHnGo7rxslCwhlIIjNJ_EAyp6jVKpRwM5OhbGWr1jbOh172sr8VtIPORKBHug1RQlsmMR9J0jbpoizrFicvYLBNPYIELLrTZcIFmDe8ZUAhZVXP_zbg91g98YKxD3PQ6a1ft1rBoZZeDQNvyfVaTnPbkuDq7bY707T3fzt9wYPeqGcEZpXl8INt28v4I2kARxSkXZ6apdg1J8DK2PN7cgg5vki86NfTiLMl3gUB36HJ5nW0h9V3vxRVMi4_lIfdhgZMSL8ZVOEU5GwqWt_Cp1U6k_YsEaR81ECuPO0A7TFKY7UX5_Cs93hn9Np-1-DU8QNaI5CEsnZeNu68-nmRbAPRogUrQQ86O2u5qDgjnCG3Mes1q3kNb2cS7t8Mn3woCJLWSi7H5EpZY3LFPC39yOeQoXw8N7oXpLKJ8f5DAEiKelK8zLZCM1EHOWbyeIcm_9uYcNoGga7OfUDAR2aZuWP5Pzju0XmqFAXMitYwgudQGPEG2-a0hVqE3ZR7ijiAkNYYz-IfrwJY3JbZrzDeRzF-jcnUfIYqC-hP89FIeHXRiARqRTcBzTGJbjJPoIRODNXs0LLl1J6Ulb7kC19RIZzUSKAigBOs2Uc3v_FlG7VOpgMNyIL6DkupfrBs-ThunpSdqkoegZoyrMWeZv9440nM_QbyXpPNKF7JAm1eTsQVTqm-tx5kUNAqP5ld-U-2fNhc6uq4I8aNZJSJ9iG9Ki1WjVW7EwRjv0DKpSdCrUVpSP7BicE3WZHHg4BfOlq8oCPNTZcS-hhag4fDPnzxVELwx-VXyLL0A5uu2cmW1pZzgoncPdpFR-8dxXcVKfwbtvzJq0agiWmtHGMHLgeDFj6hWdPTyeyhVWt27eZxG4R-sbvCvumQcoDXx6lx-KOUeoIMsVRvhUAQQxrIexqtlVaU-5g_DUT4_scMWTEiTKr3PN-uDOGz8hEdzxZeh4B7bhFNl8icoD-R3UYZlDBsLmpNu0minx4ifB1SsNUngO7YurHpUt5n6gsmjXCxbARkgqnDsQ&sai=AMfl-YRMGIqflQLeCPCzuFy_lCiec8fqXIoBda5YvVopxly1wK1zqWoitObdqZKdWzI5-nvppUSlP2HMa2RFdD5T5mEUmP0mY9tlbdHHbRWcf_FPar1LSKDNMTIArXr59p7ox8BE-DkrLmlyic1f_Tjd41OGSUqeDQ&sig=Cg0ArKJSzI5MSnJ6CyhvEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211013.74753&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 19 Oct 2021 16:56:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 54AC 41 KB
15 KB 7ms
6ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 17 Oct 2021 21:12:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 157456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 17 Oct 2022 21:12:41 GMT

GET
H3 200 09302021-142031470-MLTI_FC2_LIB_B_STAT_0_SUP_970x250_SITCOMS_0.jpg
s0.2mdn.net/9901250/ Frame 54AC 269 KB
270 KB 8ms
8ms Image
image/jpeg 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9901250/09302021-142031470-MLTI_FC2_LIB_B_STAT_0_SUP_970x250_SITCOMS_0.jpg

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1178cf30304a9a218949ca7723cd2e08e8a7c54cdf100f23caac0082f809f769

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 18:04:11 GMT
x-content-type-options: nosniff
age: 82366
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 275935
x-xss-protection: 0
last-modified: Thu, 30 Sep 2021 21:20:31 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 19 Oct 2021 18:04:11 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3974 43 B
215 B 404ms
191ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=b62c9495-b440-8739-c49a-193e409833f3&tv=%7Bc:rvEYlB,pingTime:-3,time:73,type:v,im:%7BpBlk:34%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:600,t:15%7D,%7Bpiv:0,vs:o,r:l,t:72%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:73,n:72,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:15,wc:0.0.1600.1200,ac:NaN.NaN.300.600,am:sp,cc:0.0.300.600,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B68~1,0~0%5D,as:%5B68~300.600%5D%7D%7D,%7Bsl:o,t:72,wc:0.0.1600.1200,ac:NaN.NaN.300.600,am:sp,cc:0.0.300.600,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sMj3KTg+11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e*.774604-57214098%7C1e1%7C1e2%7C1f1,idMap:1e*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=c
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt30.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3974 43 B
216 B 309ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=b62c9495-b440-8739-c49a-193e409833f3&tv=%7Bc:rvEYlC,pingTime:-6,time:74,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:74,n:72,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:15,wc:0.0.1600.1200,ac:NaN.NaN.300.600,am:sp,cc:0.0.300.600,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B68~1,0~0%5D,as:%5B68~300.600%5D%7D%7D,%7Bsl:o,t:72,wc:0.0.1600.1200,ac:NaN.NaN.300.600,am:sp,cc:0.0.300.600,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B2~0%5D,as:%5B2~300.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sMj3KTg+11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e*.774604-57214098%7C1e1%7C1e2%7C1f1,idMap:1e*,rmeas:1,rend:1,renddet:IMG.qs%7D&tpiLookup=ao:femme4.com*&br=c
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt37.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8BBC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1

43 B
1014 B

20ms
19ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGMWEuq0BMAE&v=APEucNWg6g628pXsQdpeuMWgmVH3INuuhSsbnGRU64DnRZn5meJFgLrxGzLu8wI1klBxQzjJl6SQRyOvI70E8wAGPO99bds9lg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:58 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8BBC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YW742NdE85lWkO3vXgCJ2AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1

43 B
894 B

26ms
26ms

Image
image/gif

184.30.20.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGMWEuq0BMAE&v=APEucNWg6g628pXsQdpeuMWgmVH3INuuhSsbnGRU64DnRZn5meJFgLrxGzLu8wI1klBxQzjJl6SQRyOvI70E8wAGPO99bds9lg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.241 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 19 Oct 2021 16:56:58 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFsYnVRny4CVC0qRH0YWe-M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8BBC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMX8riTyu_NvVsKI6PBnpzw&google_cver=1

43 B
1006 B

7ms
7ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMX8riTyu_NvVsKI6PBnpzw&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COefRxCA_O0CGMWEuq0BMAE&v=APEucNWg6g628pXsQdpeuMWgmVH3INuuhSsbnGRU64DnRZn5meJFgLrxGzLu8wI1klBxQzjJl6SQRyOvI70E8wAGPO99bds9lg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:58 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 619acc57-b407-4ee1-9266-afafea1eb6f4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMX8riTyu_NvVsKI6PBnpzw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BBC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:57 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: faf0dc0e-9f17-43ab-b413-a9d4cd894635
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAwMDg3ODU4MTkyMzg2OTA5NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3974 43 B
215 B 273ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=b62c9495-b440-8739-c49a-193e409833f3&tv=%7Bc:rvEYme,pingTime:-2,time:113,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:254,mdZ:434,beA:510,beZ:511,mfA:512,cmA:513,inA:514,inZ:516,prA:516,prZ:522,si:527,poA:527,bl:545,poZ:545,cmZ:545,mfZ:545,loA:584,loZ:586,ltA:623,ltZ:623%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:600,t:15%7D,%7Bpiv:0,vs:o,r:l,t:72%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:113,n:72,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:15,wc:0.0.1600.1200,ac:NaN.NaN.300.600,am:sp,cc:0.0.300.600,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B68~1,0~0%5D,as:%5B68~300.600%5D%7D%7D,%7Bsl:o,t:72,wc:0.0.1600.1200,ac:NaN.NaN.300.600,am:sp,cc:0.0.300.600,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B41~0%5D,as:%5B41~300.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sMj3KTg+11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e*.774604-57214098%7C1e1%7C1e2%7C1f1,idMap:1e*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:1,renddet:IMG.qs,sinceFw:95,readyFired:true%7D&br=c
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt29.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 2501
Redirect Chain

https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true
https://pixel.advertising.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP92483f43-30fd-11ec-a3d1-06e3e5d8ffe8
https://ups.analytics.yahoo.com/ups/57304/sync?gdpr=&gdpr_consent=&_origin=0&redir=true&apid=UP92483f43-30fd-11ec-a3d1-06e3e5d8ffe8&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_hm=VVA5MjQ4M2Y0My0zMGZkLTExZWMtYTNkMS0wNmUzZTVkOGZmZTg%3D
https://pixel.advertising.com/ups/57304/sync?uid=CAESEEZR4WL6vjeQKbzde1-Rf6U&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEZR4WL6vjeQKbzde1-Rf6U&google_cver=1&apid=UP92483f43-30fd-11ec-a3d1-06e3e5d8ffe8

0
1 KB

18ms
18ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEZR4WL6vjeQKbzde1-Rf6U&google_cver=1&apid=UP92483f43-30fd-11ec-a3d1-06e3e5d8ffe8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEEZR4WL6vjeQKbzde1-Rf6U&google_cver=1&apid=UP92483f43-30fd-11ec-a3d1-06e3e5d8ffe8
date: Tue, 19 Oct 2021 16:56:58 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

sync
pixel.advertising.com/ups/55986/ Frame 2501
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=YW742gAAAd5emgAR&_origin=0&gdpr=1&gdpr_consent=&_test=YW742gAAAd5emgAR

0
124 B

9ms
8ms

Image
text/plain

18.197.99.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55986/sync?uid=YW742gAAAd5emgAR&_origin=0&gdpr=1&gdpr_consent=&_test=YW742gAAAd5emgAR

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.197.99.6 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-197-99-6.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1634662618.219851,VS0,VE0
x-served-by: cache-hhn4081-HHN
x-cache: HIT
location: https://pixel.advertising.com/ups/55986/sync?uid=YW742gAAAd5emgAR&_origin=0&gdpr=1&gdpr_consent=&_test=YW742gAAAd5emgAR
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55953/ Frame 2501
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://ups.analytics.yahoo.com/ups/55953/sync?uid=cd0bffe4-6293-49d0-abd3-03568aaf1595&_origin=1&gdpr=1&gdpr_consent=

0
234 B

11ms
10ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55953/sync?uid=cd0bffe4-6293-49d0-abd3-03568aaf1595&_origin=1&gdpr=1&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ups.analytics.yahoo.com/ups/55953/sync?uid=cd0bffe4-6293-49d0-abd3-03568aaf1595&_origin=1&gdpr=1&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 267

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 897C 0
23 B 42ms
42ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDeOrJf5jpef_teYRTWM9dFt2ViPqWurUaQHhKKLDgFmC1xX7zu5tBI2H0w3ODxqXvDJ-_EehOnnquqmazqeInE-_PLm-Q6L_5eikFcS9dFAH3VjczLtYvTDleIKGW2g&sai=AMfl-YSLl1kh0m0rUc9DNwuQB0QFFk8yBpiGHR8OQUkm2NfCnJpOViocUzmKgxoROT31W0LWAXHyYfh-b-wQZiPfF3cvdQJAkpJ57JCq2Mg&sig=Cg0ArKJSzP2Jln8FY9fbEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=533&vt=11&dtpt=477&dett=3&cstd=55&cisv=r20211013.08396&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame 54AC
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/774604/57214036/4.js?adContainerId=gcc_2fhuYajXMMPV7_UP7LifiAY&cbFunctionName=goog_wrapCb_2fhuYajXMMPV7_UP7LifiAY&true_pb=https%3A%2F%2Fstatic.adsafeprotected....
https://static.adsafeprotected.com/4a.js

2 KB
1 KB

11ms
10ms

Script
application/javascript

143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1dafee2da776f11c64f940dd266fe3e89f2d20b088f76727e3670b94f0278812

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 20:06:32 GMT
content-encoding: gzip
age: 75027
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 18 Oct 2021 20:06:18 GMT
server: AmazonS3
etag: W/"bd7db987881ad3f1742dc6a76ac596d8"
vary: Accept-Encoding
x-amz-version-id: 4TGFxCjbCpz5P_cG6etsvTa.ybT.v_UW
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: MJMhxI5tD78e_209Gy3FOjqOgPXQBE0lW9PEkNgsMhR6hIGHEHh19g==

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: app03.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 9754 80 KB
21 KB 8ms
7ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 18:55:08 GMT
content-encoding: gzip
age: 5263311
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: krPnpekkWmdjA5kMihfIRK_dfq2Yk386TfmIhX4gAz1LIRGk0ZZGLg==

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 22F8 35 KB
13 KB 17ms
17ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 10:15:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 10:15:46 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 54AC 0
23 B 44ms
44ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3974 0
23 B 43ms
42ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssPMY68SynxPxVdrsLvVQeGs4-0Nheu6lgpEDq68HsKhaYP1XvFXb_ar8Az5UP9Qb4-IujRQTxxC-WQS_JZc3Kw_jASY0f3YT6UKUDPhlPJCQLHeygRHS6BbrW2&sai=AMfl-YSM_dKTl9W0Rnx4_oqASXIddUs52-QWZKpH1PPiyBbqSSQoN8AwpaPZ8GnDNzlCAqc-4LUnv0G9kp68W9OkOKEnUUf8JG6XA1pLaA8&sig=Cg0ArKJSzGdxQldfGjUhEAE&urlfix=1&vt=13&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 54AC 43 B
215 B 138ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=9dbe9836-7703-9edf-6c91-0b0acd1f106f&tv=%7Bc:rvEYom,pingTime:-3,time:78,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:970,h:250,t:18%7D,%7Bpiv:0,vs:o,r:l,t:78%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:78,n:78,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B71~1%5D,as:%5B71~970.250%5D%7D%7D,%7Bsl:o,t:78,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sMj3KVW+11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e1%7C1e2%7C1e3%7C1f*.774604-57214036%7C1f1,idMap:1f*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=c
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt28.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 54AC 43 B
215 B 135ms
99ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=9dbe9836-7703-9edf-6c91-0b0acd1f106f&tv=%7Bc:rvEYoq,pingTime:-6,time:82,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:82,n:78,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B71~1%5D,as:%5B71~970.250%5D%7D%7D,%7Bsl:o,t:78,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B4~0%5D,as:%5B4~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sMj3KVW+11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e1%7C1e2%7C1e3%7C1f*.774604-57214036%7C1f1,idMap:1f*,rmeas:1,rend:1,renddet:IMG.qs%7D&tpiLookup=ao:femme4.com*&br=c
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt50.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 51F0 22 KB
8 KB 6ms
6ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sun, 17 Oct 2021 21:12:41 GMT
expires: Mon, 17 Oct 2022 21:12:41 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 157457
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 204 csi
csi.gstatic.com/ Frame 4D45 0
339 B 64ms
17ms Ping
image/gif 142.250.179.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kuybwzww&c=3159285448633&slotId=1579642724316.5&qqid=CNW5jOX41vMCFYPeEQgdEmYElA&gqid=2fhuYbqJFtLlgAeKionICg&fb=ima_html5-lima&sdkv=h.3.485.1&mrd=4&aab=0&itv=1&eee=missing-element&bi=missing-id&wta=1&ghmsh_eids=44750820&vmfc=19&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.179.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s41-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://imasdk.googleapis.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4D45 42 B
64 B 20ms
20ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CwV7Z2fhuYZXpF4O9x_APksyRoAntvYPUZaPSycftDvAuEAEgwKjKamDJBqABqLrFuQLIAQWoAwHIAxOYBACqBPABT9ARltsY7Aqi0M6LzT57RXNK5nbiHvEJaVGEMnag3eVIHrm1IHDUMn6HCpciuLQKY9ln-Ybg3HErW7AVZwrhjT_7ISq3SURYUdx5JwD9DDBNx0RxrLQQu-zOef7JlismADCE43Df98ccHCYe38cLgd6CLWmlO3gzn21il-cN43FUkcEIPXoLPBPChts-PD6J1PZMA8De0soRzFPxHYMpSyB1XoUnsy3yFRRnGOfQu5hu5ogRsNSt2juj3ScQNM88lmrCrv0RE7pMG2ScanXAK0egUjUvJXIuNV33zGkfbYKCpBTEEz4KLpKW7mgmP3PlwASesa-L2APgBAOQBgGgBk6AB8DFusYBqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgGEQARgdgAoDmAsByAsBgAwBsBPRxPwM0BMA2BMNiBQC2BQB0BUBgBcB&sigh=fxFcAq872M4&label=video_ad_loaded&acvw=[VIEWABILITY]&sdkv=h.3.485.1&vci=[CREATIVE_PLAYBACK]

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 54AC 43 B
215 B 192ms
191ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=9dbe9836-7703-9edf-6c91-0b0acd1f106f&tv=%7Bc:rvEYp2,pingTime:-2,time:120,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:351,mdZ:389,beA:481,beZ:483,mfA:485,cmA:486,inA:486,inZ:491,prA:491,prZ:496,si:500,poA:501,poZ:519,cmZ:519,mfZ:519,loA:563,loZ:566,ltA:600,ltZ:601%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:970.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:970,h:250,t:18%7D,%7Bpiv:0,vs:o,r:l,t:78%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:120,n:78,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B71~1%5D,as:%5B71~970.250%5D%7D%7D,%7Bsl:o,t:78,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B42~0%5D,as:%5B42~970.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sMj3KTg+11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e.774604-57214098%7C1e1%7C1e2%7C1e3%7C1f*.774604-57214036%7C1f1,idMap:1f*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:IMG.qs,sinceFw:99,readyFired:false%7D&br=c
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt38.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 29F2 1 KB
749 B 17ms
17ms Document
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 19 Oct 2021 08:58:57 GMT
expires: Wed, 20 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 28681
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 54AC 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ae4f77ad8d16c0c83dd90700b75d541fdbf5e24539be483edc9b1b22e2b68299

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 loader.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 67BD 85 KB
31 KB 9ms
9ms Script
text/javascript 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/loader.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28df5395caf34e2a61bef69022e6cc544f2b3ad8a17dd12040bad0e8dd16e7b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:42:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 898
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31222
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 16:38:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=900
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
expires: Tue, 19 Oct 2021 16:57:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 20ms
20ms Image
image/gif 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI2JaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NTpmJax9MmIlJz1mqGE9MTUlNTAjMTEzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow1zZW1gZTQhY29gJaN1YxyxPWZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ2nWRsYXRcPWyhqGVlpHJioW90ZWk0ZCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZlqz49NmtkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNDY2MwYkODI0NSZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTZyZwuxODRyNGVzJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:57 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 18ms
18ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQkJaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NTpmJax9MmIlJz1mqGE9MTUlNTAjMTEzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow1zZW1gZTQhY29gJaN1YxyxPWZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ2nWRsYXRcPWyhqGVlpHJioW90ZWk0ZCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZlqz49NmtkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNDY2MwYkODI0NSZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTZyZwuxODRyNGVzJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4D45 42 B
64 B 19ms
18ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CwV7Z2fhuYZXpF4O9x_APksyRoAntvYPUZaPSycftDvAuEAEgwKjKamDJBqABqLrFuQLIAQWoAwHIAxOYBACqBPABT9ARltsY7Aqi0M6LzT57RXNK5nbiHvEJaVGEMnag3eVIHrm1IHDUMn6HCpciuLQKY9ln-Ybg3HErW7AVZwrhjT_7ISq3SURYUdx5JwD9DDBNx0RxrLQQu-zOef7JlismADCE43Df98ccHCYe38cLgd6CLWmlO3gzn21il-cN43FUkcEIPXoLPBPChts-PD6J1PZMA8De0soRzFPxHYMpSyB1XoUnsy3yFRRnGOfQu5hu5ogRsNSt2juj3ScQNM88lmrCrv0RE7pMG2ScanXAK0egUjUvJXIuNV33zGkfbYKCpBTEEz4KLpKW7mgmP3PlwASesa-L2APgBAOQBgGgBk6AB8DFusYBqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgGEQARgdgAoDmAsByAsBgAwBsBPRxPwM0BMA2BMNiBQC2BQB0BUBgBcB&sigh=fxFcAq872M4&label=show_ad&acvw=[VIEWABILITY]&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA1OTg1NTI3NjhAtgIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDg3Nzk0ODUyCTE1OTYyMDc2NEA9Cl8IARIbdW5pZmllZC5hZHNhZmVwcm90ZWN0ZWQuY29tGgNEQ00gBCoJNTA4Nzc5NDg1MgkxNTk2MjA3NjRA5gFSHiUAAPBBKAE6CzE1OTYyMDc2NC0xQgRHRENNUABgARgB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4D45 0
0 18ms
17ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CezyZ2fhuYZXpF4O9x_APksyRoAntvYPUZaPSycftDvAuEAEgwKjKamDJBqABqLrFuQLIAQWoAwGYBACqBO0BT9ARltsY7Aqi0M6LzT57RXNK5nbiHvEJaVGEMnag3eVIHrm1IHDUMn6HCpciuLQKY9ln-Ybg3HErW7AVZwrhjT_7ISq3SURYUdx5JwD9DDBNx0RxrLQQu-zOef7JlismADCE43Df98ccHCYe38cLgd6CLWmlO3gzn21il-cN43FUkcEIPXoLPBPChts-PD6J1PZMA8De0soRzFPxHYMpSyB1XoUnsy3yFRRnGOfQu5hu5tAQAr6l8NuRT_mXt7SeFSkicJn7zay-v2xu5m_dIcOpey25yM4mx9tp2EcHiXBEwP44kyomNk4kdROEwASesa-L2APgBAOIBeekoK03kgUGCAMQBRgBkgUGCBsQARgBkgULCCIQAxgDSMz-nAGSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBk6AB8DFusYBqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAPIHCxCQpq4DGLaJ77YB0ggHCIBhEAEYHYAKA8gLAbAT0cT8DMgTyoDE3gPQEwDYEw2IFALYFAHQFQGAFwGyFx4KHAgAEhRwdWItMTMyMDc3NDY3OTkyMDg0MRit120&sigh=8DFVNAIf3xM&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&cid=CAQSOwCNIrLMtJG4OPeQHuM9dNXYOJqfWl_0iRLUoPlUtYLJbIKBKx8xJ4jVPn_L2JeMkT5aNfvbV5QlDuNm&vt=10&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA1OTg1NTI3NjhAtgIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDg3Nzk0ODUyCTE1OTYyMDc2NEA9Cl8IARIbdW5pZmllZC5hZHNhZmVwcm90ZWN0ZWQuY29tGgNEQ00gBCoJNTA4Nzc5NDg1MgkxNTk2MjA3NjRA5gFSHiUAAPBBKAE6CzE1OTYyMDc2NC0xQgRHRENNUABgARgB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2 200 passback_300x600.js Show response
static.adsafeprotected.com/ Frame 6FB7 3 KB
2 KB 9ms
9ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_300x600.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5b542fa63865c7855e651a48910a341dfdd0508ec6f293e1253537b2778e2742

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: YixHyJS__vfErISdG8zToCgOAVZW6HLe
content-encoding: gzip
etag: W/"439e58c5a30158dbdc47481bb170410a"
age: 524800
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 21 Jul 2021 22:11:44 GMT
server: AmazonS3
date: Wed, 13 Oct 2021 15:10:19 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: BwHTAAyPvuXxjJsl55x31PokOCArs3Irb-UOJ1HBIxRHI8SPzZYQTQ==

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 54AC 0
23 B 44ms
43ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssnP2dngaEFkQEBGVTbIedDjEE3kKQbHvpPdz4fi_8RssGe0cFsnGhmJAKTVP4J1NdI5DhfqX9gRTpWwGbxF0yTbc7kqw3dD2gCZmkjwmY-qf_vRNSAYH8IXJ_KkwZ9nZBW88dPCiDtHGtSaQ&sai=AMfl-YTOMb_pms-iF_wy_9A1XgYy4V5EIptbXL2bXZf9Z2fciSSmVxUgtQc7P__OvAIluYREA7CliuBnvPbYAKGKvnAlADp7QCYmY2A&sig=Cg0ArKJSzDOe0Wwtc756EAE&urlfix=1&vt=13&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1

200
OK

Cookie set csync Show response
sync.console.adtarget.com.tr/ Frame 7B76
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://creativecdn.com/cm-notify?pi=admatic&tc=1
https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=K09kIwFimh7rP3YQAu0S&pi=admatic&tc=1

0
407 B

254ms
254ms

Document
text/plain

62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=K09kIwFimh7rP3YQAu0S&pi=admatic&tc=1
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: sync.console.adtarget.com.tr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://s.console.adtarget.com.tr/
Accept-Encoding: gzip, deflate, br
Cookie: vmuid=a75ee5379a2ec6e2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

Server: VertaMedia 1.0
Date: Tue, 19 Oct 2021 16:56:58 GMT
Content-Length: 0
Etag: a75ee5379a2ec6e2
Set-Cookie: vmuid=a75ee5379a2ec6e2; expires=Mon, 20 Dec 2021 16:56:58 GMT; domain=.console.adtarget.com.tr; path=/; secure; SameSite=None a307080=K09kIwFimh7rP3YQAu0S; expires=Mon, 20 Dec 2021 16:56:58 GMT; domain=.console.adtarget.com.tr; path=/; secure; SameSite=None

Redirect headers

date: Tue, 19 Oct 2021 16:56:58 GMT Tue, 19 Oct 2021 16:56:58 GMT
location: https://sync.console.adtarget.com.tr/csync?t=a&ep=307080&extuid=K09kIwFimh7rP3YQAu0S&pi=admatic&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H2

200

/ Show response
ads.us.e-planning.net/uspd/1/ Frame A738
Redirect Chain

https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID

13 B
91 B

15ms
14ms

Document
text/html

46.249.52.249
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.249.52.249 , Netherlands, ASN50673 (SERVERIUS-AS, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Request headers

:method: GET
:authority: ads.us.e-planning.net
:scheme: https
:path: /uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s.console.adtarget.com.tr/
accept-encoding: gzip, deflate, br
cookie: CT=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: openresty
date: Tue, 19 Oct 2021 16:56:58 GMT
content-type: text/html
content-length: 13
x-sid: AMS-738

Redirect headers

server: openresty
date: Tue, 19 Oct 2021 16:56:58 GMT
content-type: text/html; charset=iso-8859-1
set-cookie: CT=1; path=/; SameSite=None; Secure
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
location: /uspd/1/?ct=1&du=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307442%26extuid%3D%24UID
x-sid: AMS-738

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4778 14 KB
5 KB 7ms
7ms Document
text/html 184.30.20.198
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.198 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-198.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/user_sync.html?gdpr=0&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307406%26extuid%3D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s.console.adtarget.com.tr/
accept-encoding: gzip, deflate, br
cookie: KCCH=YES
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=120771
expires: Thu, 21 Oct 2021 02:29:49 GMT
date: Tue, 19 Oct 2021 16:56:58 GMT
vary: Accept-Encoding

GET
H2 200 pbsync.html Show response
js.adscale.de/ Frame 3E33 3 KB
2 KB 47ms
7ms Document
text/html 143.204.98.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.48 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-48.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ecde72bc5d9fd5bc5150218535ae8f75ad9161924b91e64b7995c495fc90c246

Request headers

:method: GET
:authority: js.adscale.de
:scheme: https
:path: /pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s.console.adtarget.com.tr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

content-type: text/html
last-modified: Mon, 18 Oct 2021 01:09:10 GMT
x-amz-version-id: CTTtTZsNiFGQnX5z1v86xgJS932Hyeai
server: AmazonS3
content-encoding: gzip
date: Tue, 19 Oct 2021 15:09:11 GMT
cache-control: max-age=7200
etag: W/"5550fca00caf055568d6ced373f2721f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: SCoZp4hLLasZqmAiOjcECl1q2sV01LvISfjuRgvnixPp194K29Ar5Q==
age: 6467

GET
H2 200 cookie Show response
cm.adform.net/ Frame AF2C 43 B
106 B 66ms
18ms Document
image/gif 37.157.6.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

:method: GET
:authority: cm.adform.net
:scheme: https
:path: /cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s.console.adtarget.com.tr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

server: nginx
date: Tue, 19 Oct 2021 16:56:58 GMT
content-type: image/gif
content-length: 43

GET
H2 200 user Show response
cdn.admatic.com.tr/ Frame D318 251 B
642 B 46ms
6ms Document
text/html 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.admatic.com.tr/user
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 62b58b017cf4d54dc404dbc48e49b0429cbbb46678a868a95bf17664cc6340fd

Request headers

:method: GET
:authority: cdn.admatic.com.tr
:scheme: https
:path: /user
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://s.console.adtarget.com.tr/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
content-type: text/html
vary: Accept-Encoding
server: BunnyCDN-DE1-756
cdn-pullzone: 266102
cdn-uid: bea626e5-d007-4073-8941-73ce8dd2f81c
cdn-requestcountrycode: US
cdn-edgestorageid: 756
cdn-storageserver: DE-51
cache-control: public, max-age=3600
cdn-fileserver: 141
last-modified: Thu, 11 Feb 2021 13:30:42 GMT
cdn-cachedat: 2021-08-10 09:24:38
cdn-requestpullsuccess: True
cdn-requestpullcode: 206
cdn-requestid: d17f811d1c9401ec8d272262fca87911
cdn-status: 200
cdn-cache: HIT
content-encoding: gzip

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame 55C1 43 B
331 B 163ms
33ms Image
image/gif 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?redir=
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:57 GMT
Server: VertaMedia 1.0
Etag: a75ee5379a2ec6e2
Content-Length: 43
Content-Type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 49ms
49ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021101201&jk=2877213304704200&bg=!ra6lrurNAAao6lBpqOo7ACkAdvg8WtW7lSRjtxn6eDZ3JwEPt7Mp3_DYbIAmFT88D-JTaNuSs6POTwIAAAIoUgAAAIpoAQeZAqtX2tpYKnLaZJACdXaj4UDrfbOKCX57SgQ3OEOyrNN9SB2SSxDRrGK_md91HsaclOC_V4ETqJ3fF2TkHUacoaQ0URkoeBcGrV66-1-mG4ljVLF1aS_LcZfDry4Eh431tyZLYSfmNg_WFg9Yd9R_o_Hd7L_4gagPZKNVmuG_LgybcSr0lvYkXnnzQtHdZR1hq48MiCnDRkyJjA5ClnulseKLq2JkQMrs_v0nA0j6X2CejWZHkhse3QkTnIj2EHHG8jAdgufjQIo1VsoGtvAiF7cX4TZQmJqvFYxfwEI13tL3MhIH8-ItcIWaymYFct8CE_j-qu2uXhfNx1YjtyINpTxZoXh4FMQbUtvgYgjzpH2r15NAxyYXoEY45HoMZ2wZRZpgrcbv9xebk8_oFdjrFa67oQ554_gCsJSIgpxfo8LBAweDU9m7zKS84XZS_qoZfvzoicNyiJpcmkeo_dZql2bahIJFlpyRFDs_8RNEk7tuKBHt8OlCqzzMwpiw0CvNWwHG-fbVdfGAOTFJd1mvwF0h8WDGhHXV5eowxBY4-8gLNO6GFOyPuob9kKSbFUi2yZf24LclapxzKj4VrpV_J-ufF7OMvCJj86FyfQy5CVZ5TKFAJ04lojYQE9O2LZ-VwYxGlp0-fWOpXV5yge-0_hh_Qn35OQBAHICHk8718ENuu9m91v_SJfbSD8LJiCNqF3pq8gtl8nHlXLn6p17lnrfenp_DRDaSBseNvd4YWmfbsQgErE2yqxB-rBgcXSeMpkgAOGb5Ty38cjx39OPtRKNUf-OIvlGvS0FvIsGzxl4KkvbSNkCkrlXDMvkibccH92qeWnrdFILmRi4JmoEyWrgKlMSFcxymhjy7mrYX61cGBqct_7R4TsqnBZBe24tMG8rn0atpZSAul5SFnQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 IAS_PassbackAds_300x600.png
static.adsafeprotected.com/ Frame 6FB7 34 KB
34 KB 8ms
8ms Image
image/png 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_300x600.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8e503fe67eef6d53b7297abd5062e4db7a6b381eaa7d4ac4f8c53a9bb08e248c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: zLdjPzxOS1Uz6KM7.tjsif1.2I6Gepn.
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
etag: "26e2b461771f6fb855141aa77c859584"
age: 481181
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 34357
last-modified: Wed, 21 Jul 2021 22:11:29 GMT
server: AmazonS3
date: Thu, 14 Oct 2021 03:17:17 GMT
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: Hu5vGWNQQ0Yi93VG_helSo5-sL9m3ZT11Wkhl2MLYlK7l8PMogyuNg==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6005 0
20 B 52ms
51ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BkMK22fhuYZ7rEMPc7_UP8vmfyA4AAAAAOAHgBAI&bg=!09Cl0JTNAAao6lBpqOo7ACkAdvg8WlWX5QGKfXCJxU6GMzG86pGbrP70Gp0qf0uft82xZTvLZfHwHwIAAAInUgAAAGtoAQcKAEVSOLPe1MTrYTdj4Px5Pgqgohf0OpERpdOBlGinpHkJyDGi0ViGzziqzDHRTDq4oVrFQhNhSLkzPgzTvjwFjnG1j3Qcay2ZAwDSWcauoz8aJD_dAqk0ZhtksfhTQisIAK5Vi5VF2JZV_4Gl3KqqiZi_v0JUrdNRDYoJ3Lvu4LQkgiGt6KAh5ufZ3YSxUaRWIzLDBrRu0R_kVBL-pEUvj7y3svly_afwdJmSl2_JzGcvc5P2TzEZIMR8CgHWHTExKMBqTk3CQdgISeP7B-mx4QAgRIATTqCP7FAY7jkDB7VVLRLXsDJQxsG7U_JtjzApkfEufZsuJZ2v5HvlgDwRPfXF8dzwtga0etNCFLrDG7BCzspP7zCgFUaaFfFns8vl13f1XWT5I5WS-K50kLWixgYp_8Qrp2OcBJiW0hP_h0Iagt0YzLMOU9WLIhTrpFEQYaAguXbF4fSUMvXMPK-3hHbUmtEho5nDqRisPdnvv7K5TtisCJPjo6VMCdfO9WBW7FiFvlegEl1ojn5CqjirRdi6t_z_MYTtqkm3N55HnAbxuddWG15-8V0jsICR4Fr1oAPKyDX_gRyIPtx0iL88xK7DS1T_2SYtjczOTZbETgLbRm8OEFr-Za1yhAq1DTSdoNngLy1wQFFVG4rUC6-i6zceh_KBouY_6_53M2enbmUga1KHBdEhCuDmjFuyrgXWIabhiwj5HXNokakd0EBomDlpJEaWn5Wdxa-SK_6bW9sMjjRSDBJ_Ki21aEgmFMXKxa0iu33tqRnySCuCLdfGgv1PlV7gtbuUZQh00Uv7BD3-t6Tn38h8oGskE9e4D_1EiKH0EKBtu0Y4cVdye5nyVK_5UFbceGTcf0-PxIys2ywOOG8zycuhoOfz9Mi8ge0DhaytbNWh83R0geHCrrLxwBy16O0oIFRtTS55EsulJH4KNfSMyH6ZVmNe9kdLXY_js24IWRkq5q4xYASr0OetgmUUTMSngPxGSqYpjtjHMmGf1coBXvI-2BpJmzpZKotqg02vGl0VaociyrMXinyikTzpDgwwVCdzN3KJTcDHPuhqJ11K0MuwjJrUTscVU5grSdsfWFNE5EsmHKR4tJKuO4XekZ5A-XvSxTc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vpaid.2021.10.04-08.57-25eef18.js Show response
static.adsafeprotected.com/ias/v1/ Frame 67BD 176 KB
42 KB 8ms
8ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/ias/v1/vpaid.2021.10.04-08.57-25eef18.js
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5acfc22b6bccdd38335fb6f7c6960a79ab031522ca836c6027df46e815a50d1b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 15 Oct 2021 14:11:41 GMT
content-encoding: gzip
age: 355518
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 04 Oct 2021 15:11:56 GMT
server: AmazonS3
etag: W/"32cdd68901ce663c7a1a2ff7d1f61273"
vary: Accept-Encoding
x-amz-version-id: L1MrNY3q03zaoGVYeawTMl4auo79xDAl
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: i3_mM-Wssg6yPgxziCGtF77OzE3AUmSnQl7x2FZQecjdp98tnHhTdw==

GET
H2 200 passback_970x250.js Show response
static.adsafeprotected.com/ Frame 01C7 3 KB
2 KB 7ms
6ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/passback_970x250.js
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5d5e0d3e1cbfadb5c7a63053b5339d06457fe7a66c344a970a762a56123c5ec0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: vJWuRgcefJUeulOYifDz0vd7EIxp_vCl
content-encoding: gzip
etag: W/"094948b2d1170876fb8e76e432d87da6"
age: 525315
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 21 Jul 2021 22:11:53 GMT
server: AmazonS3
date: Wed, 13 Oct 2021 15:01:44 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: h0GRrMo-FKDC5zLue6wpCXoZcKhWUo7SeE3mTQ1UxeFBObc7w99yGQ==

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 29F2
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEO71vHxsrAtMQZXv8bZyF08&google_cver=1&google_push=AYg5qPLSqnYghyGAXLLIDsZLa7TEPId3OLgXQWDxiAL777yEtvr9cLNC1zilipIibQ65MWHYBLqVhUk24-xbRiDDEGoStzfl73He
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjk5MTYwNTk3NTY1MzA1NDgxNg==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO71vHxsrAtMQZXv8bZyF08&google_cver=1

43 B
407 B

14ms
14ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO71vHxsrAtMQZXv8bZyF08&google_cver=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEO71vHxsrAtMQZXv8bZyF08&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 29F2
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEKPxW6WlvhpCv8zQexcFtTw&google_cver=1&google_push=AYg5qPL3WEUmCd7ywxg44mi7uc5yS_nVfRFWohW7fQ8gS3AHEwNzaFvKUwfYj6ZNH4Qg8BjJo7EIgPyGRQ0zOyMXgiSxwuon-oJO
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=21057B759CA1480CB8AB85B6FA20DCE1&google_push=AYg5qPL3WEUmCd7ywxg44mi7uc5yS_nVfRFWohW7fQ8gS3AHEwNzaFvKUwfYj6ZNH4Qg8BjJo7EIgPyGRQ0zOyM...

170 B
188 B

24ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=21057B759CA1480CB8AB85B6FA20DCE1&google_push=AYg5qPL3WEUmCd7ywxg44mi7uc5yS_nVfRFWohW7fQ8gS3AHEwNzaFvKUwfYj6ZNH4Qg8BjJo7EIgPyGRQ0zOyMXgiSxwuon-oJO

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: openresty
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=21057B759CA1480CB8AB85B6FA20DCE1&google_push=AYg5qPL3WEUmCd7ywxg44mi7uc5yS_nVfRFWohW7fQ8gS3AHEwNzaFvKUwfYj6ZNH4Qg8BjJo7EIgPyGRQ0zOyMXgiSxwuon-oJO
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 18 Oct 2021 16:56:58 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 29F2 70 B
264 B 33ms
29ms Image
image/gif 13.248.242.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESELE_MpRpd8FDtTdvKoWGNow&google_cver=1&google_push=AYg5qPKSgFLJCBGYSONDVEbcN0D9--YuJAgT5T_Pyijk8XzoGMqTYP6pX6azxlv4o8YUbFihyVbqKc_EXt2vGKuBsi9gptX9M9Uu
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.242.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 29F2
Redirect Chain

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESEDE1BqCXjYj4QGWew9nmnJ4&google_cver=1&google_push=AYg5qPLWteQGa7MrsqmiQEUMekjG4BAITExh01n7qt7pUDVs-09TWsm8EbBzJOvxU-s9gzOwSR6p2GgVOW9jOlMCB9P_...
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPLWteQGa7MrsqmiQEUMekjG4BAITExh01n7qt7pUDVs-09TWsm8EbBzJOvxU-s9gzOwSR6p2GgVOW9jOlMCB9P_cgCoTWNj

170 B
188 B

25ms
24ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPLWteQGa7MrsqmiQEUMekjG4BAITExh01n7qt7pUDVs-09TWsm8EbBzJOvxU-s9gzOwSR6p2GgVOW9jOlMCB9P_cgCoTWNj

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: //cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AYg5qPLWteQGa7MrsqmiQEUMekjG4BAITExh01n7qt7pUDVs-09TWsm8EbBzJOvxU-s9gzOwSR6p2GgVOW9jOlMCB9P_cgCoTWNj
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 29F2
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEIHvJeW6tABJn9-uxCJaw5c&google_cver=1&google_push=AYg5qPKualZ_IPmrxU-RwPmPMYwh8FfGYDynSR-GycNxht2NsELz97Gz-7ltxbWVE2f8uK1XIiZ8Xph2XnpFMcm...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=K2AULzeHTExZeaukz0PYT9iDcmE&google_push=AYg5qPKualZ_IPmrxU-RwPmPMYwh8FfGYDynSR-GycNxht2NsELz97Gz-7ltxbWVE2f8uK1XIiZ8Xph2XnpFMc...

170 B
188 B

24ms
23ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=K2AULzeHTExZeaukz0PYT9iDcmE&google_push=AYg5qPKualZ_IPmrxU-RwPmPMYwh8FfGYDynSR-GycNxht2NsELz97Gz-7ltxbWVE2f8uK1XIiZ8Xph2XnpFMcmPa0IhxzDSVR4Q

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=K2AULzeHTExZeaukz0PYT9iDcmE&google_push=AYg5qPKualZ_IPmrxU-RwPmPMYwh8FfGYDynSR-GycNxht2NsELz97Gz-7ltxbWVE2f8uK1XIiZ8Xph2XnpFMcmPa0IhxzDSVR4Q
Date: Tue, 19 Oct 2021 16:56:58 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET

pixel
cm.g.doubleclick.net/ Frame 29F2
Redirect Chain

https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEEo82dtAg0fToeRS106x6do&google_cver=1&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE2ygGEdNYLjM7BPnkmVijcs-l...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNGU0ZDZlMWVlYjA3NGI3MzQxNTVlODU3YTA0MWY3YjE=&google_push=AYg5qPJgXR8lD_lOAnsAct_ENjc0n4PBKiDoJ4GOWGkACSQW1U6d1gvRZed1rE...

0
0

GET
H/1.1 200
OK sync
rtb2-useast.e-volution.ai/ Frame 29F2 42 B
233 B 280ms
90ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEHwY9mRuCStBM981AS4z9yI&google_cver=1&google_push=AYg5qPKWDeu5rCgIi2-_2DZNJURcAwo5ihEEBTnxVokLG6aff8IbVQTV6e5v-k2H5CPoYhbriJCryYusZsp_VO7t2Wi3CVTuhRu__A
Requested by: Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 Garden City, United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 29F2 0
12 B 23ms
21ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L-ZzIv4Fk6MEPgkFvTLiCjOvvQUD57IROo1a9zNx4FkEnh46F-oA3FqHLNmjBkPlDQp_TZ5A

Requested by

Host: d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com
URL: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 51F0 35 KB
13 KB 15ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 10:15:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 10:15:46 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 3974 43 B
215 B 98ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=b62c9495-b440-8739-c49a-193e409833f3&tv=%7Bc:rvEYtZ,pingTime:-10,time:593,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85My4wLjQ1NzcuNjMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1634662618499%7C%7C79cf109766d31a3426be04f0d2cab300%7C%7Cc7e7172c7781b034963ef5178f1479dd%7C%7Cf4246a66545b51a522261eade1989338%7C%7C12917c81df586a8658c4946c036f7bcc%7C%7C0ab7623e54aa6a35b3a59fb5f055cdc4%7C%7C8b3887691e0b8c46a20fa5035a7f9013%7C%7Cf20e98c58892ada07d8c0ff41e7f5974%7C%7C1629390669,im:%7Bimprf:%7Bttecl:482,ecd:7,tsecr:117%7D,pWait:50,pLoad:555%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E5ED 42 B
64 B 58ms
44ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvAGwwYvf9uM-p40QfekNfSw2YbTrTh7yzzz5hKEuR2QYKyItitikRXMe55GWGyuPDn1RGnUSTsffZE09RD_K8NiVp8nlcXETfTIZX7jJXtaxVOpd8&sai=AMfl-YSHxoQXEMA-FqWTE0O2T0GXIJ1IE2p8NmXop07aEDziiqdDj4jqUMjGf-taQWkr5zVNFV_taWJibtnI4ANcqikDvxgYvGqHW1ozgimqmHbfM08JK2Z6YLP8bRWgCK0&sig=Cg0ArKJSzFGj3IlnlmtyEAE&cid=CAASFeRoRgCHAIrZuWAsLfIPLH32iLy3Sw&id=lidar2&mcvt=1038&p=0,0,90,728&asp=1110,436,1200,1164&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&v=20211013&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3023198139&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634662617161&rpt=292&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 IAS_PassbackAds_970x250.png
static.adsafeprotected.com/ Frame 01C7 28 KB
29 KB 9ms
9ms Image
image/png 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/IAS_PassbackAds_970x250.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7be9364f21808a881f4530002ab0363deabf7de3321a1356984e88fb316ac165

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: sq9OjPzsj3OK_PWUs2DSILbYAvwOM90t
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
etag: "9d3f43da9d0d0679ec0dfea58b2f1d45"
age: 535682
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 28949
last-modified: Wed, 21 Jul 2021 22:11:35 GMT
server: AmazonS3
date: Wed, 13 Oct 2021 12:08:57 GMT
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: WL3DgRq25ZhVGya-oRaq3V3uCN82FDGFeFJi8CtNjHFbzb1k8fkYFA==

GET
H2

200

uu Show response
ih.adscale.de/ Frame 3E33
Redirect Chain

https://ih.adscale.de/uu?cbfn=receive&t=1634662618
https://ih.adscale.de/uu?cbfn=receive&t=1634662618&nut&uu=7ac47ce917ab486ba6e547ecd9565284

44 B
213 B

14ms
14ms

Script
text/javascript

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/uu?cbfn=receive&t=1634662618&nut&uu=7ac47ce917ab486ba6e547ecd9565284
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 0dc51d24b2b32db92dc2e2d137708b83d0a33d6a1f1f0933f2720b21ee3b6845

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
content-length: 44
content-type: text/javascript;charset=ISO-8859-1

Redirect headers

location: https://ih.adscale.de/uu?cbfn=receive&t=1634662618&nut&uu=7ac47ce917ab486ba6e547ecd9565284
date: Tue, 19 Oct 2021 16:56:58 GMT
content-length: 0

GET
H2 200 bundle.js Show response
cdn.admatic.com.tr/user/ Frame D318 54 KB
20 KB 53ms
53ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.admatic.com.tr/user/bundle.js
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 8b5cbe512fbb056de7aa42963d3bac7e38adb05e32fbe6f502b4fad3cabf57fc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/user
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: br
cdn-edgestorageid: 756
cdn-fileserver: 141
cdn-storageserver: DE-51
cdn-cachedat: 2021-08-12 13:48:34
cdn-pullzone: 266102
last-modified: Fri, 12 Mar 2021 04:24:48 GMT
server: BunnyCDN-DE1-756
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
cdn-uid: bea626e5-d007-4073-8941-73ce8dd2f81c
cache-control: public, max-age=3600
cdn-requestid: 44014c3c3debf7cacbbea6af6332c20a
cdn-requestcountrycode: US
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/db2/video/774606/57630551/ 40 B
380 B 126ms
51ms XHR
application/javascript 54.171.104.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/db2/video/774606/57630551/skeleton.js?videoId=774c472294b13fda59c5425932e43b7e&adsafe_url=https%3A%2F%2Ffemme4.com%2F&adsafe_type=abdq&adsafe_jsinfo=br:c
Requested by: Host: static.adsafeprotected.com
URL: https://static.adsafeprotected.com/ias/v1/vpaid.2021.10.04-08.57-25eef18.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.104.28 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-104-28.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7154008f409ce895349d780096618cb2a454f04ff325461861f28f9431182df6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: gzip
x-server-name: app15.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-expose-headers: X-Server-Name
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/fwjsvid/st/774606/57630551/ 229 KB
76 KB 50ms
36ms Script
application/javascript 52.50.243.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/fwjsvid/st/774606/57630551/skeleton.js?videoId=774c472294b13fda59c5425932e43b7e&apiframeworks=2,8&blockedAdTracking=https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvenPfBNJOu3b1wGxUn9MW-_NTfHRQDLAbiw6dbhdfjLanKjDpBevyTjJrVstcRSeJBxAT8r3ws9j_MKl_q2714QT7bdeCTXWYG7KGcZbvVaEhnUTnhvYnfSxugE70h9Ok8nl10ftDpJiXwbw&sai=AMfl-YTEsCPBprCu8y1FznRWfLqz1pxIcrmz8v2_LJ1UG6ktRZrGN7208QAGlam3Ye3Ggf78BnyI2iwgc2yCvEm1NKNoomC-a33Y-54&sig=Cg0ArKJSzJ0z1iuFEWxSEAE&urlfix=1&vt=13&adurl=&bundleId=[BUNDLEID]&ias_xappb=[ctv_appid]&mon=57630552&redirectedRetries=0&xmapp=0&xmtp=v&xsId=89fe2129-9446-4bcd-9b29-c7f8994087f9&adsafe_par=&logTestResults=false
Requested by: Host: static.adsafeprotected.com
URL: https://static.adsafeprotected.com/ias/v1/vpaid.2021.10.04-08.57-25eef18.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.243.239 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-243-239.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0182dc4e4b61bfdba792643bb4c340969b1b9854ae77d47718442edbf9367a29

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: gzip
x-server-name: app05.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 35A3 0
20 B 51ms
50ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQXhW2fhuYaOvGIeT7_UPhc6h-AoAAAAAOAHgBAI&bg=!y8ilyIzNAAao6lBpqOo7ACkAdvg8Ws_CRTibbSFfaEPenU4nwyYqVaaY-fEjoimE5Ih2uGvKp2JSXwIAAAH8UgAAAE5oAQcKAHNqsuUeDNISgxBBoVW8t04AVC4ZhG1eqJS4ngV9aLJNHKFwod9U7o9ygGXsPtW8hkV1o5Nzc0r6KDd4hxASf5lHM33yxR4mrxqiBYfxAEFa1d1q35J8EQS6HvGTCF_IsdGCfn2LWFoZjSGyI91YN5ZecDatmQL7L0FQL9biNI65G2Q_9gbBKaHxB8icfJJOsnI_l9epv8KZzbL_WF7Qg3ndKkAtH7z0Z9-wf0yqtBj6iPquyZPrORh47OP0nJFiDVLSAHxWsDuG_o24cmZyNQ1f2x-53qijRDaiX1FWvD9_PT8H-usCuULTj4dSy9F5t5puMKGkHYvhKoZ4THX6MJBaz6Y14s5kIV372M4ncIXWYVsU7gmXE8Ryu0OYtTEtLEr5IRodk5IiEOGGxCu9_vlGSP_rQWM32813DFLpjGC-PlmEjmWBmBCnG6ihAkM4g682PULJe8rDsMl-7Oq7ykQX7cztYkOdPGgvEsv4jXC9zBOD_R1_-p8NUbU3ApyHST4YNgCBtxsL_cpMLYmiPGTbHqFDatMeDctiOfZDLBb13yEjhxejzXTAoqPXSr0ysb7CKmnVXs_wg0F_z20JQIFDsYQEpw4K3qz2uFtPPPJW5uywRC3qi9O2Et8bDlJb8ThEA_is1T5oX9vK66HB__C06QOKOzf0FFrHHmxYbks0s0nocyKdujJ5T2SXWyirmZT-s_BbHgTSkFSAYuLpyOQydOkQh3C9Ibhaa_bLwMfg5rMvBb3ttomqra1EDD90OrBbl_qVd8N5vXTsR24AryoaeamgBqdl3o-Ue7eqShWWVc6e0nzNdHB7PAJ1TRq4I7-4aso9UUDBCx8VApcRdLm06wEKxkqfryqnnwGF3hVBki3MD617m10CgfxkO_Z0yxuFZfzBBsHHl2egCQX4id3f2aD6RsAoNQo71OpO1r-GsrwdzSnkcRXvwbrLSOjd9kYekeZNIfnuWhmnWYHK_QlNQ_JmrTqtYg0xYQ4oJ8CYrmclQWbSe0iNWPQWjGbIpasdXG8jKnur8AYZjLaUiqiscT5qxEUvug_RQ3_NdFVlJt84LzwJeWVv5iraLjU7mvH6fhNsX12IZMrC8IjHwQUu50mP-sZCGO3Xx-pkB_RchJWLgn0CJVZgjRANte2rYyPR1_kvWidExV9dTk8dofaTQA

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

206
Partial Content

file.mp4
r3---sn-4g5ednly.c.2mdn.net/videoplayback/id/a49eb17b0b3da4a9/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778692809/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mi...
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/a49eb17b0b3da4a9/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778692809/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sign...
https://r3---sn-4g5ednly.c.2mdn.net/videoplayback/id/a49eb17b0b3da4a9/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778692809/sparams/acao,ctier,expire,id,ip,ipbits,it...

74 KB
0

109ms
52ms

Media
video/mp4

173.194.187.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-4g5ednly.c.2mdn.net/videoplayback/id/a49eb17b0b3da4a9/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778692809/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/41A44B2A48E647F8C465EB5A0563C9CE50EC1C8C.02BB22C6FA8C425F5C72105EF3D65338B1995121/key/cms1/cms_redirect/yes/mh/oO/mip/216.131.114.97/mm/42/mn/sn-4g5ednly/ms/onc/mt/1634662137/mv/m/mvi/3/pl/24/file/file.mp4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

173.194.187.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s29-in-f8.1e100.net

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 14 Oct 2021 20:53:28 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-2290205/2290206
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2290206
Expires: Tue, 19 Oct 2021 16:56:58 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r3---sn-4g5ednly.c.2mdn.net/videoplayback/id/a49eb17b0b3da4a9/itag/18/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3778692809/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/41A44B2A48E647F8C465EB5A0563C9CE50EC1C8C.02BB22C6FA8C425F5C72105EF3D65338B1995121/key/cms1/cms_redirect/yes/mh/oO/mip/216.131.114.97/mm/42/mn/sn-4g5ednly/ms/onc/mt/1634662137/mv/m/mvi/3/pl/24/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 645
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 20ms
20ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTM2JaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA1NDY0JaN0YT0jJat9NwxjJax9MmxjJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9qW5xZWZcozVxX2ZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZaZHBlPTEzZ2RjpxNioaNyoaQ9JzymV2VQYXNmR2Rjpw0jJzNwpGE9MCZwY3BuQ29hp2VhqD0zY2J1p3Rypw0kNwM0NwYlNwE4NTp2JaVcZD1TZWgcozRiU1BfYXyypwYkNzVzOGQ4NGU0ZWYzpHVvVXJfPWu0qHBmJTNBJTJGJTJGZzVgoWU0LzNioSUlRvZzoG9uqFN0YXR1pm1zYWkmZSZynWRmpD1jpzVvnWQ=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2 200 user Show response
ads3.admatic.com.tr/ Frame D318 53 B
420 B 172ms
55ms XHR
application/json 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: ce700dde759a5c14a5dcb7c35abfaf74bf5e108163e8fefae75239602a0a2b10

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: br
server: AdMatic
x-powered-by: AdMatic
vary: Origin,Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 57

GET
H2 200 userconnect.js Show response
js.adscale.de/ Frame 3E33 14 KB
5 KB 8ms
7ms Script
application/javascript 143.204.98.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/userconnect.js
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.48 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-48.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 58ed344732766704ee535508e3dcd8d4a8ec0c9c79d16adf02293adde110926c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: VlPfclOWmRGYytUCCQruS.q4qouKdnYM
content-encoding: br
last-modified: Mon, 18 Oct 2021 01:09:10 GMT
server: AmazonS3
age: 6467
etag: W/"98f37b242862929d9aef4bde91abc8ad"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Tue, 19 Oct 2021 15:09:12 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: mEg2kulpdhNHMiyVB0R884ITs61oplakFD_X2Ob0KGIlZcoKj4wQ5Q==

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame 3E33 0
419 B 321ms
254ms Image
text/plain 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307565&extuid=7ac47ce917ab486ba6e547ecd9565284
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/pbsync.html?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307565%26extuid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: VertaMedia 1.0
Etag: a75ee5379a2ec6e2
Content-Length: 0

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/db2/video/774606/57630551/ 91 B
315 B 49ms
49ms Script
application/javascript 52.50.243.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/db2/video/774606/57630551/skeleton.js?ias_callback=__IntegralAS_3160c97778203a4df15fcb9b871ccf94_608&videoId=774c472294b13fda59c5425932e43b7e&apiframeworks=2,8&blockedAdTracking=https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvenPfBNJOu3b1wGxUn9MW-_NTfHRQDLAbiw6dbhdfjLanKjDpBevyTjJrVstcRSeJBxAT8r3ws9j_MKl_q2714QT7bdeCTXWYG7KGcZbvVaEhnUTnhvYnfSxugE70h9Ok8nl10ftDpJiXwbw&sai=AMfl-YTEsCPBprCu8y1FznRWfLqz1pxIcrmz8v2_LJ1UG6ktRZrGN7208QAGlam3Ye3Ggf78BnyI2iwgc2yCvEm1NKNoomC-a33Y-54&sig=Cg0ArKJSzJ0z1iuFEWxSEAE&urlfix=1&vt=13&adurl=&bundleId=[BUNDLEID]&ias_xappb=[ctv_appid]&mon=57630552&redirectedRetries=0&xmapp=0&xmtp=v&xsId=89fe2129-9446-4bcd-9b29-c7f8994087f9&adsafe_par=&logTestResults=false&adsafe_url=https%3A%2F%2Ffemme4.com%2F&adsafe_type=abdfq&adsafe_jsinfo=,id:3160c977-7820-3a4d-f15f-cb9b871ccf94,c:rvEYwy,sl:outOfView,em:false,fr:true,thd:1,mn:app05ie,pt:2-5-15,wc:0.0.1600.1200,ac:-2164.279.573.322,am:v,cc:-2164.279.573.322,piv:0,obst:0,th:0,reas:l.v,br:c,abv:na,an:n,oam:0,vc:jv3,nbld:0,mtim:3,fm:sMj3L57+1*.774606-57630551%7C11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C165%7C166%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b1%7C1b2%7C1b3%7C1c%7C1d1%7C1d21%7C1d3%7C1d4%7C1e1%7C1e2%7C1e31%7C1e4%7C1e5%7C1f,idMap:1*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:env,smm:ibgm,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:fwjsvid,et:17,oid:9293ee20-30fd-11ec-b783-02bf2b86cc68,v:19.8.252,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/fwjsvid/st/774606/57630551/skeleton.js?videoId=774c472294b13fda59c5425932e43b7e&apiframeworks=2,8&blockedAdTracking=https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvenPfBNJOu3b1wGxUn9MW-_NTfHRQDLAbiw6dbhdfjLanKjDpBevyTjJrVstcRSeJBxAT8r3ws9j_MKl_q2714QT7bdeCTXWYG7KGcZbvVaEhnUTnhvYnfSxugE70h9Ok8nl10ftDpJiXwbw&sai=AMfl-YTEsCPBprCu8y1FznRWfLqz1pxIcrmz8v2_LJ1UG6ktRZrGN7208QAGlam3Ye3Ggf78BnyI2iwgc2yCvEm1NKNoomC-a33Y-54&sig=Cg0ArKJSzJ0z1iuFEWxSEAE&urlfix=1&vt=13&adurl=&bundleId=[BUNDLEID]&ias_xappb=[ctv_appid]&mon=57630552&redirectedRetries=0&xmapp=0&xmtp=v&xsId=89fe2129-9446-4bcd-9b29-c7f8994087f9&adsafe_par=&logTestResults=false
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.243.239 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-243-239.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 43ec26bc6e305ed217f2cde63b4714b5455f98638de93f91b0061bf9eb502da5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: gzip
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: application/javascript;charset=utf-8
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame D4EE 80 KB
21 KB 7ms
7ms Script
application/javascript 143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 18:55:08 GMT
content-encoding: gzip
age: 5263311
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: AmohkDKkIzbFJCjyXa82OnTRY0zCi8gjcRmWlS_P8qIiPbGU2qsFqA==

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 67BD 0
23 B 43ms
42ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvenPfBNJOu3b1wGxUn9MW-_NTfHRQDLAbiw6dbhdfjLanKjDpBevyTjJrVstcRSeJBxAT8r3ws9j_MKl_q2714QT7bdeCTXWYG7KGcZbvVaEhnUTnhvYnfSxugE70h9Ok8nl10ftDpJiXwbw&sai=AMfl-YTEsCPBprCu8y1FznRWfLqz1pxIcrmz8v2_LJ1UG6ktRZrGN7208QAGlam3Ye3Ggf78BnyI2iwgc2yCvEm1NKNoomC-a33Y-54&sig=Cg0ArKJSzJ0z1iuFEWxSEAE&urlfix=1&vt=13&adurl=

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK pixel.png
unified.adsafeprotected.com/ Frame 67BD 35 B
174 B 33ms
33ms Image
image/gif 52.18.186.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unified.adsafeprotected.com/pixel.png?eyJ0eXBlIjozMDMsInNpdGVfdXVpZCI6ImFmZGRlZjVkLWMyMDQtNDBhOS1iNGZiLTk2NWExNDVkMDY5NiIsImJpZF9yZXF1ZXN0Ijp7InNpdGUiOnsicGFnZSI6Imh0dHBzOi8vZmVtbWU0LmNvbS8ifX0sImNiIjoxNjM0NjYyNjE4Njk3LCJpYXNfc2luZ2xldGFnIjp0cnVlLCJpYXNfc2luZ2xldGFnX291dGNvbWUiOjE5LCJoZWFkZXJzIjp7ImhlYWRlcjgiOiJpYXNvIn0sImN1c3RvbSI6eyJjdXN0b203IjoiNzc0NjA2IiwiY3VzdG9tOCI6IjU3NjMwNTUxIiwiY3VzdG9tMTEiOiIyMDIxLjEwLjA0LTA4LjU3LTI1ZWVmMTgiLCJ4c2lkIjoiODlmZTIxMjktOTQ0Ni00YmNkLTliMjktYzdmODk5NDA4N2Y5IiwiY3VzdG9tMTkiOiJibG9ja2VkIn19
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.186.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-186-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Connection: keep-alive
Content-Length: 35
Vary: Origin
Content-Type: image/gif

GET
H2

200

skeleton.js
static.adsafeprotected.com/
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/774606/57630551/skeleton.js?videoId=774c472294b13fda59c5425932e43b7e&apiframeworks=2,8&blockedAdTracking=https://googleads4.g.doubleclick.net/pcs/view?xai=A...
https://static.adsafeprotected.com/skeleton.js

17 B
17 B

7ms
7ms

Image
application/javascript

143.204.98.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-122.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 08:35:57 GMT
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
age: 9015662
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 8r5WoS7G0_LKG8Bie1HqEqHrpA9Jjcoa6AzW1EBY0yNNpjJNUDzJRg==

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: app14.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 54AC 43 B
215 B 98ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=9dbe9836-7703-9edf-6c91-0b0acd1f106f&tv=%7Bc:rvEYxe,time:628,type:e,im:%7Bimprf:%7Bttecl:391,ecd:11,tsecr:138%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:134,o:494,n:78,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:18,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B71~1%5D,as:%5B71~970.250%5D%7D%7D,%7Bsl:o,t:78,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B61~0%5D,as:%5B61~970.250%5D%7D%7D,%7Bsl:i,t:139,wc:0.0.1600.1200,ac:NaN.NaN.970.250,am:sp,cc:0.0.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B134~100,0~0%5D,as:%5B134~970.250,0~970.0%5D%7D%7D,%7Bsl:o,t:273,wc:0.0.1600.1200,ac:NaN.NaN.970.0,am:sp,cc:0.0.970.254,piv:0,obst:0,th:0,reas:l.h,bkn:%7Bpiv:%5B355~0%5D,as:%5B355~970.0%5D%7D%7D%5D,slEventCount:4,em:true,fr:false,e:,tt:rjss,dtt:255,fm:sMj3KTg+1.774606-57630551%7C11%7C12%7C13%7C14%7C15%7C16%7C17%7C181%7C1821%7C183%7C19%7C1a%7C1b1%7C1b21%7C1b3%7C1c1%7C1d%7C1e.774604-57214098%7C1e1%7C1e2%7C1e3%7C1f*.774604-57214036%7C1f1,idMap:1f*,rmeas:1,rend:1,renddet:IMG.qs%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 54AC 43 B
215 B 98ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774604&asId=9dbe9836-7703-9edf-6c91-0b0acd1f106f&tv=%7Bc:rvEYxh,pingTime:-10,time:631,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85My4wLjQ1NzcuNjMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1634662618499%7C%7C79cf109766d31a3426be04f0d2cab300%7C%7Cc7e7172c7781b034963ef5178f1479dd%7C%7Cf4246a66545b51a522261eade1989338%7C%7C12917c81df586a8658c4946c036f7bcc%7C%7C0ab7623e54aa6a35b3a59fb5f055cdc4%7C%7C8b3887691e0b8c46a20fa5035a7f9013%7C%7Cf20e98c58892ada07d8c0ff41e7f5974%7C%7C1629390669,sca:%7Bspg:b62c9495-b440-8739-c49a-193e409833f3%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774606&asId=3160c977-7820-3a4d-f15f-cb9b871ccf94&tv=%7Bc:rvEYxk,pingTime:-4,time:65,type:m,im:%7Bsf:0%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:l.v,w:573,h:322,t:17%7D,%7Br:l,t:61%7D%5D,ve:%7BvEventCount:2,vEvents:%5B%7Bt:57,tp:adImpression,sl:o,ad_duration:30,width:573,height:322,volume:0,integral_timeToDecision:160,integral_didBlock:true,viewMode:normal,x_vv:3.7.0,x_vanstag:fw,x_xpc:iaso%7D,%7Bt:58,tp:adError,sl:o,ad_duration:30,width:573,height:322,volume:0%7D%5D%7D,vv:3.7.0,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:65,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:-2164.279.573.322,am:v,cc:-2164.279.573.322,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B59~0%5D,as:%5B59~573.322%5D%7D%7D%5D,slEventCount:1,em:false,fr:true,e:,tt:fwjsvid,dtt:0,fm:sMj3KTg+1*.774606-57630551%7C11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C165%7C166%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b1%7C1b2%7C1b3%7C1c%7C1d1%7C1d21%7C1d3%7C1d4%7C1e.774604-57214098%7C1e1%7C1e2%7C1e31%7C1e4%7C1e5%7C1f.774604-57214036,idMap:1*,rmeas:1,rend:1,renddet:env%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt36.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
97ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774606&asId=3160c977-7820-3a4d-f15f-cb9b871ccf94&tv=%7Bc:rvEYxl,pingTime:-1,time:66,type:u,clog:%5B%7Bpiv:0,vs:o,r:l.v,w:573,h:322,t:17%7D,%7Br:l,t:61%7D%5D,ve:%7BvEventCount:2,vEvents:%5B%7Bt:57,tp:adImpression,sl:o,ad_duration:30,width:573,height:322,volume:0,integral_timeToDecision:160,integral_didBlock:true,viewMode:normal,x_vv:3.7.0,x_vanstag:fw,x_xpc:iaso%7D,%7Bt:58,tp:adError,sl:o,ad_duration:30,width:573,height:322,volume:0%7D%5D%7D,ndt:0,vv:3.7.0,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:66,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:-2164.279.573.322,am:v,cc:-2164.279.573.322,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B60~0%5D,as:%5B60~573.322%5D%7D%7D%5D,slEventCount:1,em:false,fr:true,e:,tt:fwjsvid,dtt:0,fm:sMj3KTg+1*.774606-57630551%7C11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C165%7C166%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b1%7C1b2%7C1b3%7C1c%7C1d1%7C1d21%7C1d3%7C1d4%7C1e.774604-57214098%7C1e1%7C1e2%7C1e31%7C1e4%7C1e5%7C1f.774604-57214036,idMap:1*,rmeas:1,rend:1,renddet:env,lt:3%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt32.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
98ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774606&asId=3160c977-7820-3a4d-f15f-cb9b871ccf94&tv=%7Bc:rvEYxq,pingTime:-2,time:71,type:a,im:%7Bpom:1,prf:%7BbeA:3214,beZ:3215,mfA:3217,cmA:3218,inA:3218,inZ:3222,prA:3222,prZ:3227,si:3231,poA:3232,poZ:3248,cmZ:3248,mfZ:3248,loA:3275,loZ:3275,ltA:3285,ltZ:3285%7D%7D,clog:%5B%7Bpiv:0,vs:o,r:l.v,w:573,h:322,t:17%7D,%7Br:l,t:61%7D%5D,ve:%7BvEventCount:2,vEvents:%5B%7Bt:57,tp:adImpression,sl:o,ad_duration:30,width:573,height:322,volume:0,integral_timeToDecision:160,integral_didBlock:true,viewMode:normal,x_vv:3.7.0,x_vanstag:fw,x_xpc:iaso%7D,%7Bt:58,tp:adError,sl:o,ad_duration:30,width:573,height:322,volume:0%7D%5D%7D,vv:3.7.0,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:71,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:-2164.279.573.322,am:v,cc:-2164.279.573.322,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B66~0%5D,as:%5B66~573.322%5D%7D%7D%5D,slEventCount:1,em:false,fr:true,e:,tt:fwjsvid,dtt:0,fm:sMj3KTg+1*.774606-57630551%7C11%7C12%7C13%7C14%7C15%7C161%7C162%7C163%7C164%7C165%7C166%7C17%7C181%7C182%7C183%7C19%7C1a%7C1b1%7C1b2%7C1b3%7C1c%7C1d1%7C1d21%7C1d3%7C1d4%7C1e.774604-57214098%7C1e1%7C1e2%7C1e31%7C1e4%7C1e5%7C1f.774604-57214036,idMap:1*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:1,renddet:env,slid:%5BslotContainer,adContainerDiv,Video-iFrame-SekindoSPlayer616ef8d84e4ef,Video-Div-SekindoSPlayer616ef8d84e4ef,Player-Div-SekindoSPlayer616ef8d84e4ef,primis_playerSekindoSPlayer616ef8d84e4ef,primis_container_div,primisPlayerContainerDiv,ai_widget-6,widgets_for_shortcodes%5D,sinceFw:53,readyFired:true%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-server-name: dt33.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 userconnect Show response
ih.adscale.de/ Frame 3E33 149 B
224 B 19ms
19ms Script
application/javascript 3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/userconnect?ssl=1&sid=0&cbfn=stroeerCoreConnect&ts=1634662618716&umd=false&gdpr=0&gdpr_version=2&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 3516496d97f72bf509cf5d6902b5deebf53355ccb21127dc777d265cd96ca2d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
content-length: 149
content-type: application/javascript

GET
H2 200 map Show response
ih.adscale.de/ Frame 6DC3 3 KB
3 KB 14ms
13ms Document
text/html 3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/userconnect.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 0320741db43fbaaa199efb5fe807f45f8cbff477498d3af24ba1049d9f95fe67

Request headers

:method: GET
:authority: ih.adscale.de
:scheme: https
:path: /map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://js.adscale.de/
accept-encoding: gzip, deflate, br
cookie: uu=7ac47ce917ab486ba6e547ecd9565284; cct=1634662618546
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://js.adscale.de/

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
content-type: text/html;charset=ISO-8859-1
content-length: 2702
set-cookie: tu=4#114599131#48~~454072~454072~1#101~~454072~454072~1#39~~454072~454072~1#40~~454072~454072~1#42~~454072~454072~1#75~~454072~454072~1#108~~454072~454072~1#63~~454072~454072~1; Max-Age=31336000; Domain=ih.adscale.de; Path=/; Secure; SameSite=None cct=1634662618754; Max-Age=31336000; Domain=.adscale.de; Path=/; Secure; SameSite=None

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 22F8 0
20 B 50ms
49ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BVqKa2fhuYYXZIJSU9u8P6cSlmA4AAAAAOAHgBAI&bg=!BwSlBEDNAAao6lBpqOo7ACkAdvg8Wu7B7uWPDuAErk6SdGf7o_ONq1UmSKYafh46Za_2-il_Zfns7gIAAAGeUgAAABZoAQcKAATeXNSDmQLua7wN2anoCd9NT49O4wtNkHi6XLHPqMkLKTJ9y6AiuLNgAzI4m_JMcqJs8VlKNO5xZH7g1-thPBEOC0Pw8vofxuQMXkcbXrkkgBhLBk4dIw95FuzySuBs_MvpbyDUmm6BmDAXvQL8TTvCQBM-LucUQoYBtdQp0-jJ0jTOZxVxuLvzFiRZeXpMxHmvGtWDhb4xBbFQ6kB5bEsalNJLgabKGpPOw-zlxIecfdQQbMDFUdtQnjMDYqgb8JRJ9R-dUAG-oY6rtUzuHTyqVTtuthpTZoefC7VwiY71nWLdADpqmpApBsHaucccr31lfpPTMbZskTY0etqh5XQ9W1OQO9Mrhgjj6B5vggC7a2-YMgUdSLDvf-AHQHTwnmd1VqnSDm9dKY9_jOeyO_a1VlZ6oAnnLQkvwH_rFZHFiEgsFIC605rqd7PUjRtTPjegAaLznvYG6Ubu53RBiMK4upQXJSMr8m9QuPj-BgikQ-EgEAE3Hj7NBDcy24R_WssFA6ar6bsa23xp7omU4mPb8onhF24RF2PHnnaZhPmh-HhXugxeTsRkPZQQRmiFD0mw7VnvOF2Y_fI4dAE6wX-7Y4xMLrq3UAB7WkcmQtzVhQMBRuWF9IpU2qX6g9LYR969VDW-1Gaz7oMVS2Nj6qKTJU8SZOcSgHMUYJeYnSFQgsdmaYjLun8Ak-DlO5iQzawWqsGSLqsH0QowZNiS3Xo5yJPbfgUVV65-tRtVfC0TN-VYiGdJGyHkP9rlHjpP0V8CdoJAGuW2IwFh4KS-TidhjlsZIsAxYEpkBf5NqbRiloz0jpFm8-s1c4Kh8ktlYDq5Z5gxcBv4mBer8LaGiEZlhbPr15HbodQm_QaFnlTSJl9bXCz9vIOn3TvbFQdeaOWaRlfmJwdSISu9dCw5jVpVjNXHfGyKoXAdTLy5cuf-4vyunHzvFS8peKdMxyFfwnEqy2PDeQna0hO8Bfi3fBeSx7t7aeHxGAVUmcL2zTfgTyLue2fa

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame E5ED 7 KB
3 KB 37ms
9ms Script
text/javascript 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=728&h=90&c=digitas01cont8&js=pmw1&base=te-clr1-176f544c-9de1-427d-b9c3-4760b283fe95
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont8&w=728&h=90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 85fb11c72ec9e7ffa257eff2a308859f90589b235cb279842c902332dabe2f2b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 11:16:02 GMT
content-encoding: gzip
server: nginx
age: 20456
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
content-length: 2409
x-amz-cf-id: TUvegH-IwV2KHBYV3WEjiHc6NDSjD_46SaJNk55qEGZ31csQxza6xw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame E5ED 38 KB
11 KB 36ms
8ms Script
text/javascript 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=728&h=90&c=digitas01cont8&js=pmw2
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont8&w=728&h=90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 11:14:26 GMT
content-encoding: gzip
server: nginx
age: 20552
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: TNnGPZCuIriIoeAdPY6OZGzWG1LLs82321rPmwAjQhEd-RISg9_W-A==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame E5ED 43 B
384 B 129ms
102ms Image
image/gif 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=hpeus01&pid=digitas01&cid=1&w=728&h=90&c=0273
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: LXPemuAx8FQAqOze_gjIp2aZcOSYRKWDDIr2fLILRz1YDqLG0F7JRA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 match.js Show response
js.adscale.de/ Frame 6DC3 4 KB
2 KB 7ms
7ms Script
application/javascript 143.204.98.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adscale.de/match.js
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.48 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-48.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 91b4eb09154d5ebef46352e922194ec6dbb9547b63f9776ae10133fe1ca66879

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: fasXwuyUENs3SUQSIJG2Ma.gV.jQPmgo
content-encoding: br
last-modified: Mon, 18 Oct 2021 01:09:10 GMT
server: AmazonS3
age: 6467
etag: W/"b75124846aec28a28b7a3441813682d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
cache-control: max-age=7200
date: Tue, 19 Oct 2021 15:09:12 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: iokWYba0t-vUKwZnisf9JqJPXZaEOYBegwN8Z21rahuBXuTj9d6BJQ==

OPTIONS
H2 204 user
ads3.admatic.com.tr/ Frame 0
0 161ms
54ms Preflight 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Protocol: H2
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: if-none-match
Origin: https://cdn.admatic.com.tr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache
vary: Origin
server: AdMatic
access-control-allow-origin: https://cdn.admatic.com.tr
access-control-allow-credentials: true
access-control-allow-headers: if-none-match
x-powered-by: AdMatic
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT

GET
H2 200 new Show response
ads3.admatic.com.tr/user/ Frame D318 147 B
434 B 54ms
54ms XHR
application/json 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user/new
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 9a9ac2fb2f2b8878e5555bb819fc20d68b6b07b5f5de456b538b0a7324e6e422

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: br
etag: laeTswkVHjdVAzcSaNl2zpoO3-IxUayKRVcOeM4DaFs4qplQzUGM6jUm1bnLjkUcGFxIb4avlQgl3umLtzkkDA
last-modified: Tue, 19 Oct 2021 17:56:58 GMT
server: AdMatic
x-powered-by: AdMatic
vary: Origin,Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 151

GET
H2 200 user Show response
ads3.admatic.com.tr/ Frame D318 147 B
410 B 57ms
56ms XHR
application/json 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 0d4c6bae52ae2b3c117098e25ce809dacb17356031e58fdb0123e9a00caf7d5d

Request headers

Referer: https://cdn.admatic.com.tr/
If-None-Match: undefined
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: br
etag: FtNSlhA6O8WEaZJpc9fn6K8w8oVjtwZLn1eoGyE5hgVmWUIjJhyb1TTFjmCzx95K9cqetJoPXZY3dW-V2pzieA
last-modified: Tue, 19 Oct 2021 17:56:58 GMT
server: AdMatic
x-powered-by: AdMatic
vary: Origin,Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 151

GET
H2

200

img
ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/ Frame 6DC3
Redirect Chain

https://bbnaut.ibillboard.com/match/AdScale?partneruid=7ac47ce917ab486ba6e547ecd9565284&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F71d3fc886b2041c183f4f725c08ac42d%2F1634662618753%2F0%2Fimg%3Ftpid%...
https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=101&tpuid=BBID-01-03093766188431028-16423740

49 B
463 B

9ms
9ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=101&tpuid=BBID-01-03093766188431028-16423740
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: nginx
Transfer-Encoding: chunked
p3p: CP="CUR ADM DEV OUR STP PRE DSP NOI COR NID"
Location: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=101&tpuid=BBID-01-03093766188431028-16423740
Cache-Control: private, max-age=3600
Access-Control-Allow-Credentials: true
Connection: close

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 897C 7 KB
3 KB 11ms
10ms Script
text/javascript 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=300&h=600&c=digitas01cont5&js=pmw1&base=te-clr1-a3df304d-8adf-4d78-9259-5a40acd37e0c
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont5&w=300&h=600
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: a208706f94793fe079b897d70731c590d5ac95b7c6b216ceef36f07f3077ddea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 10:55:39 GMT
content-encoding: gzip
server: nginx
age: 21679
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
content-length: 2473
x-amz-cf-id: sxEXIwbtPKLZ_jj3UDOC8s7LiNtbHmOhF2yJdC0zm3BXmvH0BiwWmw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ca Show response
choices.trustarc.com/ Frame 897C 38 KB
11 KB 11ms
11ms Script
text/javascript 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://choices.trustarc.com/ca?aid=hpeus01&pid=digitas01&cid=1&w=300&h=600&c=digitas01cont5&js=pmw2
Requested by: Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=digitas01&aid=hpeus01&js=pmw0&cid=1&c=digitas01cont5&w=300&h=600
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 10:55:07 GMT
content-encoding: gzip
server: nginx
age: 21711
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: yHTWXJwdRee9T_M_gF-81s13yXZJvFdndjlafa5meH7KSH1pibpnOA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cap
choices.trustarc.com/ Frame 897C 43 B
383 B 103ms
103ms Image
image/gif 143.204.98.28
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://choices.trustarc.com/cap?aid=hpeus01&pid=digitas01&cid=1&w=300&h=600&c=dd75
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.28 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-28.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: HiNv554pwQv06B4a7EvjKYij67joE7dg5pFFgwyzIs51dvxw8J1idw==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 51F0 0
20 B 49ms
49ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZS-j2fhuYajXMMPV7_UP7LifiAYAAAAAOAHgBAI&bg=!nZ6lntrNAAao6lBpqOo7ACkAdvg8WvrrGwpvJtGV7Y8cV5l0YhdYJWzAcXaw3emLHSOYsrfO2A2EsQIAAAEBUgAAAA5oAQeZAvfETzvA7kUUopQrBbASZuDDx9f4cZbv6-XnrEhwZ-WpI0YE4BeFWdH7fjPmSlSqhUKdrd7z0rOJDA_Ax8kT2gDscD_BBtWNpqf0N1hlC1mbeLwvADL8XI_p67wyMhZ1ovIJtpq36YZB_ngLzSdArrRIAORyDIe_aKCitIdEeCHPXA3j0L2zk-fa7rMOGkaAj7DQ68iqg1USwV2PJs0bO9UKkWCzDURZgiWmIalU9YQT0Zr3107xibQZTaakGgLw4FsSS0Iurb38_bEMEJEBH00rNszEwY4ygc8RymPg3LzaIpqAdY1dUZFCxNFV9ElNcB6lrMm1XmywrBFQ8fDlfAW_kyKveg1E4KyldONL4QfXMs9cNlBFLRXtf3WdT1xKVeeEw8WMvSFDiHxZf4z3fazxy0VaO0vtggbZ4BqpTBHVW-c-Dqp48fkgQ6krb2fTS7IiIRUvcjuHufbNFiWghpzHk-2PEX02qx7XPDiiT51yUNvPDqq9n4SycRfDT9Lq2kcP33Eh0YOfSKWTdXQAEktzkweNnwgTfxKAZdZfcGtFlvJgxoTP43Co-M06yq1tuT3t4Jyn60W0wqnb4N72n4Srsvs4albPBPowHaEY4sjQttgqieivcvyqMs2aMFBOuxS52BGUN3nghDOfOhhzE1RbrhyfyDLaE-E0vwoRRfbN16fJYLcg4R2yUblnW00Ll9Bk43uxHt5HMyQvNpPGO3EwpfIq52IE2krcDylUadQo2DoCXVKjlt2LWgNUgjFSbT6jTqfFk5BFkV0nUgrVjFM4pmSQ5LN-Mmqr_7xgDdQE4D6UGkQiBZCQ80Hr0xnR20ddkjkoVSnrfc7h-eW8_KaqccgsKVB2ICWE0ZfK9IJYdE27sBFi1OUZqP5ofX7qGJZi_3f5TZM1lzXikS0QJEl2mqy6YPW-Z8l_EaYvJ-tivG_ZYcPAnGNnKX6f7FrOPmFYrHsTNnBoZooIy0al-LHjCK5BlSeEtTEhB3XBkK2ZLjN1qx7Lt3c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 user
ads3.admatic.com.tr/ Frame 0
0 106ms
54ms Preflight 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Protocol: H2
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: if-none-match
Origin: https://cdn.admatic.com.tr
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache
vary: Origin
server: AdMatic
access-control-allow-origin: https://cdn.admatic.com.tr
access-control-allow-credentials: true
access-control-allow-headers: if-none-match
x-powered-by: AdMatic
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT

GET
H2 200 user Show response
ads3.admatic.com.tr/ Frame D318 147 B
409 B 56ms
56ms XHR
application/json 188.132.147.228
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ads3.admatic.com.tr/user
Requested by: Host: cdn.admatic.com.tr
URL: https://cdn.admatic.com.tr/user/bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 948c9765ce816e2ef164eb746e01f6e0ef64aa669147a9d1f477f797869f374c

Request headers

Referer: https://cdn.admatic.com.tr/
If-None-Match: S-l0ASPkEA1XJvs5aoReEJ0Bt6A-g1RNZ8ZYV1mVSTpfke-oc1bo_Ej4WtzfljI6KibBcI1XpXC6Czl38h3JoQ
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:58 GMT
content-encoding: br
etag: N55DaQsWuj1ikWMSTAXrRsvGa12r6tS8zD35uvnjjBzJ2pcMbgmoTvdLyyR7ia7g3RTqSCuF87-4Q0MsFnSzJQ
last-modified: Tue, 19 Oct 2021 17:56:58 GMT
server: AdMatic
x-powered-by: AdMatic
vary: Origin,Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 151

GET
H/1.1 200
OK csync
sync.console.adtarget.com.tr/ Frame D318 0
473 B 254ms
254ms Image
text/plain 62.149.0.72
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=314221&extuid=S-l0ASPkEA1XJvs5aoReEJ0Bt6A-g1RNZ8ZYV1mVSTpfke-oc1bo_Ej4WtzfljI6KibBcI1XpXC6Czl38h3JoQ
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=556966
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.0.72 , Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS: 0-72.cc86365-03-tmp.cc.colocall.com
Software: VertaMedia 1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: VertaMedia 1.0
Etag: a75ee5379a2ec6e2
Content-Length: 0

GET /
googleads.g.doubleclick.net/pagead/interaction/ Frame 4D45 0
0

GET gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D45 0
0

POST csi
csi.gstatic.com/ Frame 4D45 0
0

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 6DC3
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D108%26tpuid%3D%5BMM_UUID%5D&uid=dba730166c9f92702ed8b8c...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=108&tpuid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=

49 B
559 B

23ms
23ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=108&tpuid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:58 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Tue, 19 Oct 2021 16:56:58 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x24 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=108&tpuid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 19 Oct 2021 16:56:57 GMT

GET
H2

200

img
ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/ Frame 6DC3
Redirect Chain

https://adscale-emea.adnxs.com/getuid?https%3A%2F%2Fih.adscale.de%2Fsium%2F71d3fc886b2041c183f4f725c08ac42d%2F1634662618753%2F0%2Fimg%3Ftpid%3D75%26tpuid%3D%24UID&gdpr=0
https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=75&tpuid=8000878581923869095&gdpr=0

49 B
568 B

16ms
13ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=75&tpuid=8000878581923869095&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 822.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ac7adb60-001d-46de-a4f8-114ffcccd05d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=75&tpuid=8000878581923869095&gdpr=0
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 6DC3
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=183592&cb=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D63%26tpuid%3D__UID__&uid=99cd2337f65e77b8db7552ebd...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YW742NdE85lWkO3vXgCJ2AAA%261185

49 B
589 B

14ms
14ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YW742NdE85lWkO3vXgCJ2AAA%261185
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?gdpr=0&tpid=63&tpuid=YW742NdE85lWkO3vXgCJ2AAA%261185
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 310
Expires: Tue, 19 Oct 2021 16:56:59 GMT

GET
H2

200

img
ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/ Frame 6DC3
Redirect Chain

https://track.adform.net/serving/cookie/match/?party=9&uid=85bd898655fbbb3738ffb8ac1e9e0827d416db4c95bc63ae9d467d49c21bf1b8&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F71d3fc886b2041c183f4f7...
https://track.adform.net/serving/cookie/match/?CC=1&party=9&uid=85bd898655fbbb3738ffb8ac1e9e0827d416db4c95bc63ae9d467d49c21bf1b8&tpid=42&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F71d3fc886b2041c18...
https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=42&gdpr=0&tpuid=4739689072699432042

49 B
599 B

19ms
19ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=42&gdpr=0&tpuid=4739689072699432042
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: nginx
location: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/img?tpid=42&gdpr=0&tpuid=4739689072699432042
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 54AC 42 B
64 B 77ms
76ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvLdMa0ZpRvqjws5TwVpZwe04Ygk4jZq9IAfHGq3vwnDEuRLDiYXbusXbJ1KKMHk3Ow4E6OzGgx05iQG8X2RTUVIunBCujd_5ss-BJu91-5Bi42724&sai=AMfl-YRlo7k6_153fm544AKfI_uBmkuIRJy8SvpJFYZTy-eUY-YKO6WoB-5cuOuyW1skK0AOfI_K4RmpZ-VUR7Cc76fUglTKMKB67UNlj3lgB_usVcGiIoECWCc0H04&sig=Cg0ArKJSzBitcJWz4D5UEAE&cid=CAASEuRoAldADQ6WXNW_xADv2TlZTw&id=lidar2&mcvt=1000&p=0,0,254,970&asp=71,315,325,1285&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20211013&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=2602073323&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1634662617591&rpt=617&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 6DC3
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=17&p=32&cp=adscale&url=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D40%26tpuid%3D%40%40CRITEO_USERID%40%40&u...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=6bd760e9-406a-4e31-a07b-6e879e3beec1&gdpr=0

49 B
620 B

13ms
13ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=6bd760e9-406a-4e31-a07b-6e879e3beec1&gdpr=0
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:58 GMT
server: Kestrel
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=40&tpuid=6bd760e9-406a-4e31-a07b-6e879e3beec1&gdpr=0
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1707617
content-length: 0
expires: Tue, 19 Oct 2021 00:00:00 GMT

GET
H2

200

img
ih.adscale.de/sium/429371437437189942/1437437190794/0/ Frame 6DC3
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=26&redir=https%3A%2F%2Fih.adscale.de%2Fsium%2F429371437437189942%2F1437437190794%2F0%2Fimg%3Ftpid%3D39%26tpuid%3D%5BMM_UUID%5D&uid=b0b16913f397625345facc54...
https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=

49 B
641 B

11ms
10ms

Image
image/gif

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP=NOI PSA OUR
content-length: 49
content-type: image/gif

Redirect headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x8 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ih.adscale.de/sium/429371437437189942/1437437190794/0/img?tpid=39&tpuid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 19 Oct 2021 16:56:58 GMT

GET
H2

200

js Show response
ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/ Frame 6DC3
Redirect Chain

https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=9a2ebf4932f9278964b4e99f8afa4c5befb0bedd574a8a30103f7c87a795805a&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F71d3fc886b2041...
https://tracking.m6r.eu/sync/adscaleRedirect?gdprFallback=true&uid=9a2ebf4932f9278964b4e99f8afa4c5befb0bedd574a8a30103f7c87a795805a&tpid=48&cburl=https%3A%2F%2Fih.adscale.de%2Fsium%2F71d3fc886b2041...
https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/js?tpid=48&tpuid=92085773cbd4df5b585c40cb5df6e1f2

44 B
587 B

16ms
16ms

Script
text/javascript

3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/js?tpid=48&tpuid=92085773cbd4df5b585c40cb5df6e1f2
Requested by: Host: ih.adscale.de
URL: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 240e7a18839bcf24a089ed38adb4c985abdd41de6c16a19236cf8a378a3705b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ih.adscale.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP=NOI PSA OUR
content-length: 44
content-type: text/javascript

Redirect headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ih.adscale.de/sium/71d3fc886b2041c183f4f725c08ac42d/1634662618753/0/js?tpid=48&tpuid=92085773cbd4df5b585c40cb5df6e1f2
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 147

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 2501 0
211 B 327ms
327ms XHR
application/json 3.66.59.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=PrimisTwoHB
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.66.59.71 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-59-71.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 / Show response
adx.adform.net/adx/ Frame 2501 5 B
444 B 62ms
62ms XHR
application/json 37.157.4.25
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/?rp=4&bWlkPTEwNzQzODMmdz01NzMmaD0zMjImcHJpY2VUeXBlPW5ldCZtaW5wPTIuNDMmdHJhbnNhY3Rpb25JZD1jYjdjMzIzZC02OWU0LTQ5NWEtODQ4Mi1hZTE3Yjc3M2E1Y2Q%3D&pt=net&stid=2e7d2fae-e5e9-49f8-b6d1-f735f418a0d4&gdpr=1&gdpr_consent=&fd=1&url=https%3A%2F%2Ffemme4.com%2F

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.25 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

566f1f7d64379342927e78274c526e634c394fda54cf4145d698b815952d01f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 5
expires: -1

POST
H/1.1 204
No Content 196297 Show response
search.spotxchange.com/openrtb/2.3/dados/ Frame 2501 0
1 KB 31ms
31ms XHR
application/json 185.94.180.124
SPOTX-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://search.spotxchange.com/openrtb/2.3/dados/196297?src_sys=prebid
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 185.94.180.124 , Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
X-SpotX-Timing-Transform: 0.000561
X-SpotX-Timing-SpotMarket: 0.006647
X-SpotX-Timing-Page-Mux: 0.000353
X-SpotX-Timing-Page-Require: 0.000459
X-fe: 142
Connection: keep-alive
X-SpotX-Timing-Page-Cookie: 0.000047
X-SpotX-Timing-Page: 0.013319
Pragma: no-cache
X-SpotX-Timing-Page-Context: 0.000365
Last-Modified: Tue, 19 Oct 2021 16:56:59 GMT
Server: nginx
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
X-SpotX-Timing-SpotMarket-Primary: 0.006647
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
X-SpotX-Timing-Page-Misc: 0.004874
X-SpotX-Timing-Page-Exception: 0.000001
X-SpotX-Timing-SpotMarket-Secondary: 0.000000
X-SpotX-Timing-Page-URI: 0.000012
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 204
No Content 171621 Show response
search.spotxchange.com/openrtb/2.3/dados/ Frame 2501 0
1 KB 62ms
62ms XHR
application/json 185.94.180.124
SPOTX-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://search.spotxchange.com/openrtb/2.3/dados/171621?src_sys=prebid
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_13.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 185.94.180.124 , Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
X-SpotX-Timing-Transform: 0.000977
X-SpotX-Timing-SpotMarket: 0.039585
X-SpotX-Timing-Page-Mux: 0.000316
X-SpotX-Timing-Page-Require: 0.000392
X-fe: 069
Connection: keep-alive
X-SpotX-Timing-Page-Cookie: 0.000040
X-SpotX-Timing-Page: 0.046073
Pragma: no-cache
X-SpotX-Timing-Page-Context: 0.000358
Last-Modified: Tue, 19 Oct 2021 16:56:59 GMT
Server: nginx
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
X-SpotX-Timing-SpotMarket-Primary: 0.018018
Access-Control-Allow-Methods: POST, GET, PATCH, DELETE, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
X-SpotX-Timing-Page-Misc: 0.004388
X-SpotX-Timing-Page-Exception: 0.000001
X-SpotX-Timing-SpotMarket-Secondary: 0.021567
X-SpotX-Timing-Page-URI: 0.000016
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 sium Show response
ih.adscale.de/ Frame 6DC3 0
190 B 20ms
20ms XHR
application/json 3.126.247.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ih.adscale.de/sium
Requested by: Host: js.adscale.de
URL: https://js.adscale.de/match.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.247.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-247-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ih.adscale.de/map?format=display&ssl=1&ref=https%3A%2F%2Fs.console.adtarget.com.tr%2F&gdpr=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://ih.adscale.de
date: Tue, 19 Oct 2021 16:56:59 GMT
access-control-allow-credentials: true
access-control-allow-headers: x-openrtb-version
content-length: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json

GET
H2 200 / Show response
id.a-mx.com/sync/ 94 B
720 B 121ms
72ms XHR
application/json 172.67.154.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=https://femme4.com/&u=https://femme4.com/&v=5.15.0&vg=pwpbjs&us_privacy=null&gdpr=0&gdpr_consent=
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.154.71 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2071ccd61fbe1d082806f4f3f428a96e9ab5b84def667e61da96867cac6b5127

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kOyh7g19mh5HQGcWMKFtfjCIWXqZY9cFDQ5OnUW4tXFz%2FqUlAwgqM%2BwLXSo1Te%2B1VYCMubKj3YVfDsrLjSeMP9phwCqFYr2%2Fy%2Bu%2B6STtBFab6sw2lo51w9XTEbmSEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private,max-age=3600
access-control-allow-credentials: true
cf-ray: 6a0b8afd9a3827b8-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
647 B 30ms
30ms XHR
application/json 13.248.242.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=z9q9llu&fmt=json
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.242.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 9afbfc4c82a61a0ea83311e849d8a5b3e274210f89ee688ed85fef3edffdacb1

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Thu, 18 Nov 2021 16:56:59 GMT

GET
H3 200 bridge3.485.1_en.html Show response
imasdk.googleapis.com/js/core/ Frame 23AF 577 KB
189 KB 7ms
7ms Document
text/html 142.250.186.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95031080831fd62b0946bfb827edf9279ddf3afa0711940b8d27e627f62046ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.485.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-length: 193945
date: Mon, 18 Oct 2021 05:09:54 GMT
expires: Tue, 18 Oct 2022 05:09:54 GMT
last-modified: Mon, 11 Oct 2021 16:34:41 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 128825
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 2501 107 B
122 B 17ms
16ms Script
application/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 1E5A 52 KB
17 KB 34ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Cookie: uuid2=8000878581923869095; icu=ChgIvYN7EAoYBCAEKAQw2fG7iwY4BEAESAQQ2fG7iwYYAw..; anj=dTM7k!M41.D>6NRF']wIg2GVPsg9e`!]tbK8i_iqf!oN/@E'zz<*Z0Qm`$1:geOzvKjcTlD[/(O!5rNb[hI^u.-Zv<<QG=%9sk@3@'s>TGP:r7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Fri, 01 Oct 2021 05:08:47 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 19 Oct 2021 16:56:59 GMT
Age: 42608
X-Served-By: cache-lga21949-LGA, cache-hhn4051-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 780908
X-Timer: S1634662620.786134,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C2CD 52 KB
17 KB 33ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Cookie: uuid2=8000878581923869095; icu=ChgIvYN7EAoYBCAEKAQw2fG7iwY4BEAESAQQ2fG7iwYYAw..; anj=dTM7k!M41.D>6NRF']wIg2GVPsg9e`!]tbK8i_iqf!oN/@E'zz<*Z0Qm`$1:geOzvKjcTlD[/(O!5rNb[hI^u.-Zv<<QG=%9sk@3@'s>TGP:r7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 18 Oct 2021 05:06:48 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 19 Oct 2021 16:56:59 GMT
Age: 42609
X-Served-By: cache-lga21976-LGA, cache-fra19181-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 431742
X-Timer: S1634662620.786341,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 42D8 52 KB
17 KB 33ms
7ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Cookie: uuid2=8000878581923869095; icu=ChgIvYN7EAoYBCAEKAQw2fG7iwY4BEAESAQQ2fG7iwYYAw..; anj=dTM7k!M41.D>6NRF']wIg2GVPsg9e`!]tbK8i_iqf!oN/@E'zz<*Z0Qm`$1:geOzvKjcTlD[/(O!5rNb[hI^u.-Zv<<QG=%9sk@3@'s>TGP:r7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 18 Oct 2021 05:06:48 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 19 Oct 2021 16:56:59 GMT
Age: 42608
X-Served-By: cache-lga21976-LGA, cache-fra19122-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 423424
X-Timer: S1634662620.786327,VS0,VE0
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 936A 0
0 343ms
109ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP003 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Tue, 19 Oct 2021 16:56:59 GMT

GET
H2 200 pd Show response
eu-u.openx.net/w/1.0/ Frame F76F 668 B
723 B 25ms
17ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 51871d73d98fe62374e9fc0337cb6f6bd83e10df3c77513da864b2619c51a572

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
cookie: i=c048491c-0a70-45ae-b123-ecce8f8bf365|1634662616
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=c048491c-0a70-45ae-b123-ecce8f8bf365|1634662616; Version=1; Expires=Wed, 19-Oct-2022 16:56:59 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1634662619|gekin0vNiygu; Version=1; Expires=Wed, 03-Nov-2021 16:56:59 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.217.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 19 Oct 2021 16:56:59 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 pd Show response
eu-u.openx.net/w/1.0/ Frame A353 668 B
719 B 28ms
23ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 51871d73d98fe62374e9fc0337cb6f6bd83e10df3c77513da864b2619c51a572

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
cookie: i=c048491c-0a70-45ae-b123-ecce8f8bf365|1634662616
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=c048491c-0a70-45ae-b123-ecce8f8bf365|1634662616; Version=1; Expires=Wed, 19-Oct-2022 16:56:59 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1634662619|gekin0vNiygu; Version=1; Expires=Wed, 03-Nov-2021 16:56:59 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.217.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 19 Oct 2021 16:56:59 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6AD0 52 KB
17 KB 26ms
7ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Cookie: uuid2=8000878581923869095; icu=ChgIvYN7EAoYBCAEKAQw2fG7iwY4BEAESAQQ2fG7iwYYAw..; anj=dTM7k!M41.D>6NRF']wIg2GVPsg9e`!]tbK8i_iqf!oN/@E'zz<*Z0Qm`$1:geOzvKjcTlD[/(O!5rNb[hI^u.-Zv<<QG=%9sk@3@'s>TGP:r7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Mon, 18 Oct 2021 05:06:48 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 19 Oct 2021 16:56:59 GMT
Age: 42609
X-Served-By: cache-lga21976-LGA, cache-fra19151-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 432083
X-Timer: S1634662620.786925,VS0,VE0
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 3BE0 0
0 338ms
109ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Tue, 19 Oct 2021 16:56:59 GMT

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame EFB4 0
0 337ms
109ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP001 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP001
date: Tue, 19 Oct 2021 16:56:59 GMT

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 8C2D 0
0 1501ms
110ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Tue, 19 Oct 2021 16:57:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=dee76cbd-a4cc-41f0-8557-9b980dbdae76&gdpr_consent=null&gdpr=0

43 B
426 B

72ms
18ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=dee76cbd-a4cc-41f0-8557-9b980dbdae76&gdpr_consent=null&gdpr=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=dee76cbd-a4cc-41f0-8557-9b980dbdae76&gdpr_consent=null&gdpr=0
date: Tue, 19 Oct 2021 16:56:59 GMT
server: _
content-length: 0

GET
H2 204 /
s.ad.smaato.net/c/ 0
239 B 45ms
10ms Image
text/plain 143.204.98.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-94.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: N-y-mWLuo4nCDn8yQerNpeHzVQHy_8FyzrIsE0NwQqRlVfMAQm717g==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=

43 B
425 B

61ms
17ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x11 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=64e5616e-f8da-4500-a93c-cf71ebd07961&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 19 Oct 2021 16:56:58 GMT

GET
H/1.1 204
No Content /
b1sync.zemanta.com/usersync/smart/ 0
64 B 445ms
107ms Image
text/plain 64.74.236.127
INTERNAP-BLK5

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.74.236.127 , United States, ASN19024 (INTERNAP-BLK5, US),
Reverse DNS: chi.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Tue, 19 Oct 2021 16:57:00 GMT

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D86%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8000878581923869095&gdpr=0&gdpr_consent=

43 B
408 B

19ms
16ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8000878581923869095&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 6d944fab-879e-42bb-bd80-860e32001cda
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=86&partneruserid=8000878581923869095&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

user
ads3.admatic.com.tr/ Frame D318
Redirect Chain

https://x.bidswitch.net/sync?ssp=admatic
https://x.bidswitch.net/ul_cb/sync?ssp=admatic
https://ws.rqtrk.eu/pull?redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D193%26user_id%3D%24BROWSER_ID%26expires%3D1%26ssp%3D%24bidswitch_ssp_id&return-unstable=true&eb=&bidswitch_ssp_id=a...
https://x.bidswitch.net/sync?dsp_id=193&user_id=&expires=1&ssp=admatic
https://ads4.admatic.com.tr/showad/px/ums/sync/bsw?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=
https://ads3.admatic.com.tr/user?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=

35 B
153 B

64ms
64ms

Image
image/gif

188.132.147.228
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads3.admatic.com.tr/user?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:56:59 GMT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
server: AdMatic
x-powered-by: AdMatic
etag: h__2O6EhQXmKyi-EVEoOIgL0_TpAeSBAnWEpJ0Q-lWwx648Kcz1yoFAOhc7AOW1CaWNNMXXm1GmxiRpv1t2IEQ
content-type: image/gif
cache-control: no-cache
timing-allow-origin: *
content-length: 35

Redirect headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:56:59 GMT
location: https://ads3.admatic.com.tr/user?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=
x-powered-by: AdMatic
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 221

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 23AF 24 KB
6 KB 297ms
296ms XHR
text/xml 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?iu=%2F21734706084%2C22564129828%2Finterpromoteltd&description_url=https%3A%2F%2Ffemme4.com%2F&env=vp&correlator=1083361293107592&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=1x1&unviewed_position_start=1&cust_params=prmsig%3Dmzaqqc&sdkv=h.3.485.1&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=8B823963-A793-448D-9EC0-3E7186C4571A&eid=44750820&url=https%3A%2F%2Ffemme4.com%2F&dt=1634662619850&cookie=ID%3D717a52a41cb98136%3AT%3D1634662616%3AS%3DALNI_MY0tRloCvucTJZN_nTydIJmieYzpw&scor=2474065968838885&ged=ve4_td4_tt3_pd4_la4000_er279.-2164.432.-1864_vi0.0.1200.1600_vp0_ts2_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66b55d351a206ffd209f4f118c7e1c4340e14b504e6ceb4b251b1b97e715c2ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:57:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6483
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame F76F
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=64e5616e-f8da-4500-a93c-cf71ebd07961

43 B
122 B

16ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=64e5616e-f8da-4500-a93c-cf71ebd07961
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x28 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=64e5616e-f8da-4500-a93c-cf71ebd07961
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 19 Oct 2021 16:56:58 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F76F
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=neeC7c3u0OqGstDrz-GZ7s_g0LuG74a8nLPT65Dt

43 B
106 B

16ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=neeC7c3u0OqGstDrz-GZ7s_g0LuG74a8nLPT65Dt
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=neeC7c3u0OqGstDrz-GZ7s_g0LuG74a8nLPT65Dt
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame F76F
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4739689072699432042

43 B
106 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4739689072699432042
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4739689072699432042
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame F76F 70 B
264 B 30ms
29ms Image
image/gif 13.248.242.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=13e47645-a3f7-7a59-ebf5-2426ebacc098&gdpr=0
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.242.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame F76F 170 B
188 B 23ms
22ms Image
image/png 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=M2Y4YmE1OGYtNmE4MC0yNGZkLWZlMTUtN2U5ZjIxNGUwZWY4

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F76F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEI3HNrCFxkIc0vy2fuy3yZQ&google_cver=1

43 B
106 B

20ms
19ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEI3HNrCFxkIc0vy2fuy3yZQ&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEI3HNrCFxkIc0vy2fuy3yZQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 1E5A 0
733 B 6ms
6ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: d6dd1275-f097-42a6-be4e-f8fdc78f034c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C2CD 0
733 B 13ms
9ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b765fdcb-e328-4bc0-98e7-ebe85b280795
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6AD0 0
733 B 15ms
6ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b87471b9-a24f-4c87-acfa-38e3b0a08859
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 42D8 0
733 B 30ms
22ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:56:59 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 2fe55d25-30fd-4582-a6a7-46193ec5d959
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame A353
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=64e5616e-f8da-4500-a93c-cf71ebd07961

43 B
106 B

16ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=64e5616e-f8da-4500-a93c-cf71ebd07961
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 19 Oct 2021 16:56:59 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x25 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=64e5616e-f8da-4500-a93c-cf71ebd07961
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 19 Oct 2021 16:56:58 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A353
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=b1Mlrj9ad6l0BnevYQQ-rz1Wcv50UiHzalrjn4O9

43 B
106 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=b1Mlrj9ad6l0BnevYQQ-rz1Wcv50UiHzalrjn4O9
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=b1Mlrj9ad6l0BnevYQQ-rz1Wcv50UiHzalrjn4O9
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame A353
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4739689072699432042

43 B
106 B

15ms
15ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4739689072699432042
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=4739689072699432042
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame A353 70 B
264 B 30ms
29ms Image
image/gif 13.248.242.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=13e47645-a3f7-7a59-ebf5-2426ebacc098&gdpr=0
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.242.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame A353 170 B
188 B 24ms
23ms Image
image/png 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=M2Y4YmE1OGYtNmE4MC0yNGZkLWZlMTUtN2U5ZjIxNGUwZWY4

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A353
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEI3HNrCFxkIc0vy2fuy3yZQ&google_cver=1

43 B
106 B

17ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEI3HNrCFxkIc0vy2fuy3yZQ&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.217.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
via: 1.1 google
server: OXGW/16.217.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:56:59 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEI3HNrCFxkIc0vy2fuy3yZQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 23AF 19 KB
12 KB 50ms
50ms XHR
text/xml 74.125.71.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CcZN0W60sm-paAaXE8SoG-OxU1cGQ8Fo4V9QRTCv_nMxRoWQ7mDUxzal8yXwQzhksNyoxyXmcbruv8xQvS3RYICd8ijA&cry=1&dbm_d=AKAmf-DQ_lE7YoBnEfMpGalBVyFKOYnb3QK_7gANc4T21-lO-rW3YyrCgjvs2PMx4k7YqSGbTSfB6mvSMWYML8vz3VFjXQJUxvD560DHNBUsdhILfwf4fyBy0kBYsHcXwTMSTmuQWTvh3rQx187A6cPfNAKUuHroZE1oN2MCv68xQDFeMARRHCOS6qgW5U1rKfGiJt2vT3k9fAV9gCStXlxo9Snn2CRkSmarHlZ7Yem4Wz5jN60iL3sOqLUMF-Hy_ZToh_4BTvZyzjcDBxj1YfxxJUCQWTfvczZmcaRxH1nYT9k34rWZy3vkn2K06vXUWoEVRdojaY7izKiM-zTsGVehc30ThuifPcPQRX6mGxWwdUnBwQCRG8dPhjdsJZKI0CGXqtwfcx8HDaArcb3RE1-qzBfZcjYokXY7saMjzCzRF5sYCr5KfJKebkgVMHX2as7YObaMPI6xn7Za4O6l4wfxdcwm6ogh5CAH-N7c4qH3QsNy86twWwLRmWHOahMQWtDvdOmKs4_GCqtM5mpephY6NazVuximxQqktmaKsICajnGvF0LjepLR7MfAIdPRIKAm9Ky1efDxTWt67qEY1QBPQ5DK21BDgLNzSTF9Yo5F2iLTzF6ASRqXq2wTPTf8-oc-JYtlzbEJzYX8G47OmwpRaX-oJkXsZJXnIlUAj-8QWkHMmkpQfBjb6LeJtoIby3D7mr2m1Q4e7z_wMWqm0iGFJVysZoOEXt2dxriHS-1ntLm_e370QAXLdA_2b4O6JkzFz1S_YJw2N5xKAzl-u76nvxQPStd0q3GiV3aJVP-HRjQ6wFRnmh6DV7be3HBILC2MyQZOIA-67L-Pe_VJM3RUFgK9P7QMZ8qjOtBUh_603gaGrht0Ln--bWSjTkWES027snmq38KvwGWpVL7cciJk3IJbbvQr4TcH44JngJbu6-7JX-PYu07luZx56Tl-xZJ3sCZwm_xl2mnGzFmxV7F4n-lo3dY-t33sFMVy9BGG8Co_VOtYgANt-Q7gbvx8GH6JjYeXryvtOc47ssuYLmbK_jNh6vyeK04ta1iComaMKyR6W3sx8SzpKLd8H8ruj0bIlP3O97K4SCQ1fVHmZIj37-d7mYWq_ePc5RZflUt-xuH9LSF8ya-zspo6-367xOTn7ScmgCc21r8WtW-h_ayext5iey7GHezA0Th-KJN31e9e8yG5DJenRWyU475asP3h3JcEt3oTzdfd80d2QlK-bb7ygBEAn05dZFmRnYD9o7hIjTRFOo1fKgkxUY6OZ6KJzFWL6e2xMthalLbMZCHII_4ViKWCpaIKiclZjr3s2pbkIBi2AFvdHtOKdyko171n0F165AmJI_3LYHBhU3heX6CEa5Axg2DCBiWlFknS8yIYVhBMzEsOthtJdHtlikTG4YMyBanGRUYFUp825ul7an0ffbswSfoXjINX9YVFosiOO7hjQfm47U_ymP52aShLm5eknoEcyfJYKx1q5mgBVryVdLpJ88dl2rOOAndGLMoSOO3T3foy9RBu9p9mB1fe7LNa9dAHEhClytePNkEAqTy7flZFl_aMiJpUKvwd2qaXPBjmvbq9ISWjMw0AAXihSr1EpSTagDnO3Sxcyb9oAlrwBVHGcYMTdXVF2eJ52Pnh1MrEk6LEqyBAecxn2vnOZFijauyeHHlZ60E9x80q27v0-kJSqkEK9vJ0FJURC2zbuJWMEoIBhXtBvkOCR1y4OYsgFox4Rtxk1zRKl5wYHetbKRHfnmCW0LFk4a1P50ANYmN_qbWBrscZ6WvC_42T5kg7YlYAVPyZ9f8F8tgk1A5C8Z4OSy6igYsptZaMXIqF2VxzIcPVXroQDGEs3dzhXrwvNJO2uaQqsWq2l2E83EhmUiDI4EAn3CDA2OEUckvAyU0ssUuinRW3Qditt7K2YqEin2VfrB8iGcHpOxTw0QPWJfbFScB0jOuGhHB8NU2PVg0qBiieoLTku8yfhUmOEBzN_kwace3zXMT1RrOTzNewqtCpRZ7zpr67XZIBF0g7c-4q6d0jHy07b1lUB8xpPPQrkgK_HvGXz8Kek6f36DSPIYjxqWYGyWtO-BvPKY5X4BJixnEAHnL-UXaUL_Zy-QNSfOc5WfT74hp-5g4YJQxKdBp6gHqEzcv44QrrGqCwzu7giZBUwBDPxCDMZ7lN3DK8fZnpw-aXGWNJqee3_JcL96e7rcMU46tZ5XpEQ_KmRAcIRI9WNqalK78S9MM_HzErbUYByKPbkB0zQLqMV27-MFC3Z0U3Kgbilk_zXgnLqz9wvhOe5Zy-kzHcTmJhiy_1mko553tdF_xnY4QTZRXP-WN6azNAeL06HZ3D9sh4_DjS9uVRygO9KEy2Rgb1UzkN6uLyIUJEvP8Xik3rLGUFKIieLyVw6C4JXycVS0326J3JRpQlbztrv5hb-mrZwASVs0qmKsegcesAlBIDpZQ7KZhN_OpgtuxaWbn_FPBAMwADDrEUwItSiQj-y1jewVEx4Qlrr0wfapulKG40JKRB1qEHf7ThbrLpvDHbit0br-7g5jcpKLpGvv5kUjsAXBl6LMzeJuQhg_acaOBxYAmKoAAd35NFIuNbisDuDttbgadiwnLY9AOfUo3HZkwcp1kwCrKVtDt4hbCLhTySMcfxg6dPmq--t_bQbPPfH0s0QaEATOmdcZ40vb7FWateS_v0-Rx8hMO17GN74SZbF_1OWi04WPwvoDgg-XUtMF0OutxSyOnz_hYQ3JrZkKc14oQRNUgsj9Q1WZ5L0gEoAz6DMUVaywFdr2oXeJjbhz_JUeiYkIeEIYVeeLAY4wCDDhM75_Csz-it9I7WW83GzdZqFQcqjduX8se1_LG3iebNqZnmwTSwYAnwiLlhpo9ENaP23m-U3jDyL5rRYIMEKz-WUl6E4G9_F_1Jq9TU-G01JaxTu0R1H-CLTCOHutr8lazdl0EY&cid=CAASEuRoS0A6MGqNsFkd0Z_Ca0c5GQ&sdkv=h.3.485.1&osd=2&frm=0&vis=1&sdr=1&is_amp=0&hl=en&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&u_so=l&ctv=0&sdki=44d&adk=704253846&sdk_apis=2%2C8&sid=8B823963-A793-448D-9EC0-3E7186C4571A&eid=44750820&url=https%3A%2F%2Ffemme4.com%2F&dt=1634662620153&ged=ve4_td4_tt3_pd4_la4000_er279.-2164.432.-1864_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.71.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

efafd2128a0f3bc0ca21ae42c43803ce9c5fcc8d46dc1261cbb08c3796dcf03a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:57:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12128
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 r1.615f12dec3e862.32362202;cb=1634662619884495 Show response
rtr.innovid.com/ Frame 23AF 8 KB
8 KB 146ms
24ms XHR
text/xml 18.170.236.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtr.innovid.com/r1.615f12dec3e862.32362202;cb=1634662619884495?ivc_dbmtoken=AD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.170.236.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-170-236-166.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 8b79e881685a2e8ab0e16942fb3bf4ab9394dd39fbbe1f915e1772a0cdda9aad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
request-time: 3
content-type: text/xml
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache
access-control-allow-credentials: true
content-length: 7929
expires: -1

POST
H3 204 csi
csi.gstatic.com/ Frame 23AF 0
17 B 24ms
23ms Ping
image/gif 142.250.179.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kuybx1u6&c=3159285448633&slotId=1579642724316.5&qqid=CM_XpOb41vMCFWjhuwgdUfEHhg&gqid=2_huYZK4NOTQ7_UPusKRwAo&fb=ima_html5-lima&sdkv=h.3.485.1&mrd=4&aab=0&itv=1&eee=missing-element&bi=missing-id&wta=1&ghmsh_eids=44750820&vmfc=5&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.179.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s41-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://imasdk.googleapis.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 43 B
298 B 19ms
18ms Image
image/gif 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI2JaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NTpmJax9MmIlJz1mqGE9MTUlNTAjMTEzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow1zZW1gZTQhY29gJaN1YxyxPWZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ2nWRsYXRcPWyhqGVlpHJioW90ZWk0ZCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZlqz49NmtkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNDY2MwYlMDM2NvZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTZyZwuxODRyNGVzJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 17ms
17ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQkJaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NTpmJax9MmIlJz1mqGE9MTUlNTAjMTEzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow1zZW1gZTQhY29gJaN1YxyxPWZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ2nWRsYXRcPWyhqGVlpHJioW90ZWk0ZCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZlqz49NmtkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNDY2MwYlMDM2NvZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTZyZwuxODRyNGVzJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 23AF 42 B
64 B 20ms
19ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 23AF 0
0 19ms
19ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CB41p2_huYY_-NejC7_UP0eKfsAiP4qDOZa-XzunLDofLvfzHARABIMCoympgyQagAbHl1f0CyAEFqAMBmAQAqgTtAU_QQI7Z0vW5lxYVVYrEaKDypwBjlCgXgGp8B5K5oqKzNlzveGj42Y9ewoRlc48jx4M8J3v-Z2YanFAJBMuyaOw97h_sP6Uyqgm8lc1NPSopOwThGaJ6CqKcVelEC3DXzXHO732EjErm5_oStoQOpJkoy_Wxr4NTUy1cVds-4x2ecRJ6Ws3_331IQEgJTtG_C7tN2oUq2OeIabATSSsAF1BkeFB-ZznhNhEiZBhL-3P3tDiMJBKQG0v3R-i1hgSeL4KixzZuwD6ScfeV8dFwPdOwfUMtoJ22nAagtBLtJnZdDszZpHzhxKVcQlVAAsAEjbzDzNsD4AQDiAWAi5yxN5IFBggDEAUYHpIFBggbEAEYAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGeYAHt5qqggGoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcA8gcLEOOe4QIY5IbwtgHSCAcIgGEQARgdgAoDyAsBsBPS1e4MyBO36sLeA9ATANgTA4gUAdgUAdAVAYAXAbIXHgocCAASFHB1Yi0xMzIwNzc0Njc5OTIwODQxGK3XbQ&sigh=5wRwZN_4jNA&cmd=Ch1jYS12aWRlby1wdWItMTMyMDc3NDY3OTkyMDg0MRAAGAI&cid=CAQSOwCNIrLMvdKbrqpV_79wCJf12pZC5PI0wR5FYiXg-oV5Hw327ZS-R0e9OY8UgauMVTGgRgAmqGMNbkLj&vt=10&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA2MDQzMjQ1ODdAqwIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDkxNTU3MjgyCTE1OTI0OTIwOEA2ClcIARIPcnRyLmlubm92aWQuY29tGgtJbm5vdmlkIEFkcyACKgYxN2t1MDYyBjFoMDk2cECUAVIgCKAGEA8lAADwQSgBOgd1bmtub3duQgd1bmtub3duUAAYAQ..
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s49-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

POST
H3 204 csi
csi.gstatic.com/ Frame 2501 0
17 B 24ms
23ms Ping
image/gif 142.250.179.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~kuybwztj&c=3159285448633&slotId=1579642724316.5&eee=missing-element&bi=missing-id&irve=1&psnvoc=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.179.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s41-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content 2_source_130893_591564.mp4
s-static.innovid.com/media/encoded/07_21/442528/ 3 MB
3 MB 46ms
15ms Media
video/mp4 184.30.20.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s-static.innovid.com/media/encoded/07_21/442528/2_source_130893_591564.mp4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.20.230 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-20-230.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 77f0d130b78ed4d68ba3cf8f8a1cf999a346434024521ba301c8cf19630c01ee

Request headers

Referer: https://femme4.com/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: RAmI1dzBMAgIaRY5CPEqHmKx5EexszvE
Last-Modified: Wed, 06 Oct 2021 17:05:02 GMT
Server: AmazonS3
x-amz-request-id: TV41T73A3H5A94Q4
ETag: "284bd2402ffb3c17d12a5d54e57fa58b"
Content-Type: video/mp4
Content-Range: bytes 0-3544855/3544856
Date: Tue, 19 Oct 2021 16:57:00 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 3544856
x-amz-id-2: w26lFhenH/4Lpz8+AbMbqd60gjzhoQpNRzM2BVK3ybbwuHbn9Gmt/yUZ4qLc8/Fc4l4yecKkk5A=

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 23AF 42 B
64 B 21ms
20ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 23AF 41 KB
15 KB 11ms
10ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 441174
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 14 Oct 2022 14:24:06 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 23AF 0
20 B 52ms
51ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 23AF 0
24 B 54ms
53ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssKVuHTAxk6j4IQBGbe4rhjzG3qiW7BzPV4xwfhR0OyxeNcgdqwSMTe0-va0aKVM_VBJ5bjFKsnWTJnPZwGQVUxv0Phd_gZjRtP3HzGJcIXamHUk7cOj__EIE6w8qloa0kIt4PVZ4B3JgxWnnu-KBel-pnRyeprGYu--XzgiRtjF6wBDeHFYd09jE95MwyqS67moLLlaB73P3YJHKWTkGDvSI6g9b2nOlXFl8CZcXMrn1DkQPNh0v1Lrg7cLK6JEiQYvi0jZNwrP7WrVlgFGX769qfkaLeTJPpAGh1TwwCRDX6q6kvhPwyFLFCPx6G_AI_vRX3yIbkuN3cp92UeOp-zV5skV7fdCB8QxlVyrCZfpIOs9-LQkCGb9wnF1zbAe8D8k35Xeka90u3lFFLOOlnsAcRx3fPFwgwd0T1PIVve1fABTpZSxQi8psyKDQRTBUe-Wsx3mDhoD97Xixi_Ens762Sy4F-ei1lgepwhAm9hCNlqSHTTZCSIMksTl00xTb8ZvuyhayFgYjGzslMAzTzmhORG7MTIg-OJ__3sLZcdm3N12Xs42gptB22POgaEfAoc5ezU-aW-cKGj5dBDaH7CbHL8cS39PaHc7qSPMwK6WFqolt24MAIEaiyVS_gfIGEoMdtPVvW8F3LDn4kRwwsQRHPvqpldMeGqqzVMSHaaqDDGf0feAg4DVbJJlDHicw6i31sZw-ob7GtSIRBUMmzTeYxFeo8ZM-WIAiiYkV57sjbDhZddkjxLbRWB1dOsqRC0S2R6tjWqWUXTsbqesyMzK-xkLPunxzIDe_pJSykLhaLgazrDaJfQKO8iUxnq7Gr7-CRkIBGV0Dwi_J3j-kMvSgOXSfjxFXq0gRHSygRGYl8k1CgxddDYZ4ZFhcbNM_H9k29buQBNV6ddbhRNP_2oGJ733HjTKUZmfffw_6FzmWi4okqyKZLm-qfoBHu8ihnwTxfyWkGrmyJ5wkq2Ymi0lJN8PTIisP3dYIiYYcRhA1gVn2nCs8Uz10fSLtMWjZgQ9ixXc49yScXHdear6LIrXxKATyuVvrNqSJOSjdCbVRqLJ6uKxAKwPHXrt1Ekt9b2vMWRwE1_M6nXfKyCk5M05vAIMtrp8HWf1GNxmJnblHr1n7LdvGjf-31bvz5aMg&sai=AMfl-YTxJIRF9xFJ0dlncJcLdIupMURdZnAgUnopSOtnNgXFdPsxCXNTkB57JkOdhMPZdts8UH1_3C1Lmpe68_DLcgJyrW1s4OSfy_f2QciVe42pUSrBoGako6b52-2Ha4Jyxa_d70onRAs1lenkAjmSFC9ThmO2Qg&sig=Cg0ArKJSzHyw7eNYhbqWEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&sdkv=h.3.485.1&adurl=

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 19 Oct 2021 16:57:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame 23AF 0
0 19ms
18ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJaQJxCs2akBGOSG8LYBIAEwAQ&v=APEucNXjxze4PmbmxxHbtp2fHXWl5FP_OwwUJ-m_uQgUV9HPSUGHw4aNPt9ts4-lZ-IKTC67SoV8c9P91RV66sMOvFNl3iQBWg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H2

200

1x1.gif
ag.innovid.com/ Frame 23AF
Redirect Chain

https://s.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action...
https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&actio...

43 B
295 B

108ms
20ms

Image
image/gif

18.168.50.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action=init&ivc_exdata=ivc_dbmtoken%3DAD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU%26iv_geo_dma%3D%26iv_geo_country%3DDE%26iv_geo_city%3DFrankfurt+am+Main%26iv_geo_state%3DHE%26iv_geo_zip%3D60313%26iv_geo_lat%3D50.1188%26iv_geo_lon%3D8.6843
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.50.255 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-50-255.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
server: nginx
content-type: text/plain
location: https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action=init&ivc_exdata=ivc_dbmtoken%3DAD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU%26iv_geo_dma%3D%26iv_geo_country%3DDE%26iv_geo_city%3DFrankfurt+am+Main%26iv_geo_state%3DHE%26iv_geo_zip%3D60313%26iv_geo_lat%3D50.1188%26iv_geo_lon%3D8.6843
cache-control: no-cache
content-length: 0
expires: -1

GET
H/1.1 200
OK uuid
dts.innovid.com/placement/17ku06/ Frame 23AF 0
354 B 210ms
22ms Image
text/plain 18.169.148.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dts.innovid.com/placement/17ku06/uuid?cb=04531df5-8bd2-f928-d6fe-b747452d4ee4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.169.148.221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-169-148-221.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:57:00 GMT
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Request-Time: 0
Expires: -1

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 23AF 42 B
64 B 23ms
19ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CwpWd2_huYY_-NejC7_UP0eKfsAiP4qDOZa-XzunLDofLvfzHARABIMCoympgyQagAbHl1f0CyAEFqAMByAMTmAQAqgTwAU_QQI7Z0vW5lxYVVYrEaKDypwBjlCgXgGp8B5K5oqKzNlzveGj42Y9ewoRlc48jx4M8J3v-Z2YanFAJBMuyaOw97h_sP6Uyqgm8lc1NPSopOwThGaJ6CqKcVelEC3DXzXHO732EjErm5_oStoQOpJkoy_Wxr4NTUy1cVds-4x2ecRJ6Ws3_331IQEgJTtG_C7tN2oUq2OeIabATSSsAF1BkeFB-ZznhNhEiZBhL-3P3tDjUJaD6E2EXdXoQcKiF-C7uXqsTV6Pb7FfcbFl5INk0dGo1ZB8O1ZsiOQbDPobSi7FOG_H16L37geFb1ZVy0MAEjbzDzNsD4AQDkAYBoAZ5gAe3mqqCAagH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYHYAKA8gLAeALAYAMAbAT0tXuDNATANgTA4gUAdgUAdAVAYAXAQ&sigh=njEwdoLi3Js&label=vast_creativeview&ad_mt=0&acvw=sv%3D903%26cb%3Dima%26e%3D19%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26is%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620440%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1634662620367&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA2MDQzMjQ1ODdAqwIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDkxNTU3MjgyCTE1OTI0OTIwOEA2ClkIARIPcnRyLmlubm92aWQuY29tGgtJbm5vdmlkIEFkcyACKgYxN2t1MDYyBjFoMDk2cECUAVIiCKAGEA8lAADwQSgBOgd1bmtub3duQgd1bmtub3duSEFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0...
ade.googlesyndication.com/ddm/activity/ Frame 23AF 42 B
107 B 191ms
43ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620442%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1634662620367;ecn1=1;etm1=0;eid1=200101;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 23AF 42 B
64 B 62ms
58ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvoXhcOz9uOyWOe9pYdIfam-nKZN2e3990tAB_Q2Vk8D4oOGEscmZzwU_3ihO90hm85yYfhIt4HCmFWvRXof2xVLL07AZD35KVf1HPaW60v4y1i3E8&sai=AMfl-YT0dQBAXNF0eO6MFMRTYnKNpj0QAzT-jlQ2H9ZFBzC24gz1BC8gBqeUmrckNI4-Kc95ic8ck_qAwt-8I1cTtd8z7iuWO5CwvjEHXIhXUUP6I9KiTS-v-IK4zlE&sig=Cg0ArKJSzCnm53eqmdasEAE&cid=CAASEuRoS0A6MGqNsFkd0Z_Ca0c5GQ&id=lidarv&acvw=sv%3D903%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620442%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1634662620367&avm=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

1x1.gif
ag.innovid.com/ Frame 23AF
Redirect Chain

https://s.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action...
https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&actio...

43 B
296 B

107ms
19ms

Image
image/gif

18.168.50.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action=play&ivc_exdata=ivc_dbmtoken%3DAD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU%26iv_geo_dma%3D%26iv_geo_country%3DDE%26iv_geo_city%3DFrankfurt+am+Main%26iv_geo_state%3DHE%26iv_geo_zip%3D60313%26iv_geo_lat%3D50.1188%26iv_geo_lon%3D8.6843
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.50.255 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-50-255.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
server: nginx
content-type: text/plain
location: https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action=play&ivc_exdata=ivc_dbmtoken%3DAD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU%26iv_geo_dma%3D%26iv_geo_country%3DDE%26iv_geo_city%3DFrankfurt+am+Main%26iv_geo_state%3DHE%26iv_geo_zip%3D60313%26iv_geo_lat%3D50.1188%26iv_geo_lon%3D8.6843
cache-control: no-cache
content-length: 0
expires: -1

GET
H2 200 pixel.gif
track.activemetering.com/pixel/v1/all/ Frame 23AF 43 B
312 B 191ms
44ms Image
image/gif 143.204.98.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.activemetering.com/pixel/v1/all/pixel.gif?cid=515e502c-adea-4ea9-b969-14461138fdf6&creativeId=791134&deviceId={ivc_deviceid_raw}&placementId=2535528&siteId=1968&campaignId=130893&adId=17ku06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.55 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-55.fra50.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:57:00 GMT
via: 1.1 632ee301c4920b52f2463aa9e978c57f.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA50-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
cache-control: no-store
content-length: 43
x-amz-cf-id: MbgCrcOVMZFxvscaZTMxmnbMzfEn3UVOE5YKun9v3nXqoVgaYSXlaw==

GET
H/1.1

200
OK

sync
t.myvisualiq.net/ Frame 23AF
Redirect Chain

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_7de63dbe-57ac-4ca8-9d7e-152f62d70fdd

43 B
296 B

15ms
8ms

Image
image/gif

3.125.90.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_7de63dbe-57ac-4ca8-9d7e-152f62d70fdd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.90.12 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-90-12.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 19 Oct 2021 16:57:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_7de63dbe-57ac-4ca8-9d7e-152f62d70fdd
date: Tue, 19 Oct 2021 16:57:00 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

impression_pixel
t.myvisualiq.net/ul_cb/ Frame 23AF
Redirect Chain

https://t.myvisualiq.net/impression_pixel?r=1634662620346&et=i&ago=212&ao=546&aca=26637798&si=7193369&ci=-7&pi=315661886&ad=-7&advt=4470645&chnl=-7&vndr=115&sz=6696&u=[Custom_Data]&pt=i
https://t.myvisualiq.net/ul_cb/impression_pixel?r=1634662620346&et=i&ago=212&ao=546&aca=26637798&si=7193369&ci=-7&pi=315661886&ad=-7&advt=4470645&chnl=-7&vndr=115&sz=6696&u=[Custom_Data]&pt=i

43 B
573 B

15ms
7ms

Image
image/gif

3.125.90.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/ul_cb/impression_pixel?r=1634662620346&et=i&ago=212&ao=546&aca=26637798&si=7193369&ci=-7&pi=315661886&ad=-7&advt=4470645&chnl=-7&vndr=115&sz=6696&u=[Custom_Data]&pt=i
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.125.90.12 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-125-90-12.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 19 Oct 2021 16:57:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://t.myvisualiq.net/ul_cb/impression_pixel?r=1634662620346&et=i&ago=212&ao=546&aca=26637798&si=7193369&ci=-7&pi=315661886&ad=-7&advt=4470645&chnl=-7&vndr=115&sz=6696&u=[Custom_Data]&pt=i
Date: Tue, 19 Oct 2021 16:57:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3

200

B26637798.315661886;dc_pre=CLvSyOb41vMCFX-K_Qcdr0oNdQ;dc_trk_aid=508830459;dc_trk_cid=159010118;ord=1634662620346;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=
ad.doubleclick.net/ddm/trackimp/N51901.2403912GOOGLEDBM19/ Frame 23AF
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N51901.2403912GOOGLEDBM19/B26637798.315661886;dc_trk_aid=508830459;dc_trk_cid=159010118;ord=1634662620346;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;...
https://ad.doubleclick.net/ddm/trackimp/N51901.2403912GOOGLEDBM19/B26637798.315661886;dc_pre=CLvSyOb41vMCFX-K_Qcdr0oNdQ;dc_trk_aid=508830459;dc_trk_cid=159010118;ord=1634662620346;dc_lat=;dc_rdid=;...

42 B
63 B

38ms
38ms

Image
image/gif

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N51901.2403912GOOGLEDBM19/B26637798.315661886;dc_pre=CLvSyOb41vMCFX-K_Qcdr0oNdQ;dc_trk_aid=508830459;dc_trk_cid=159010118;ord=1634662620346;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N51901.2403912GOOGLEDBM19/B26637798.315661886;dc_pre=CLvSyOb41vMCFX-K_Qcdr0oNdQ;dc_trk_aid=508830459;dc_trk_cid=159010118;ord=1634662620346;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=?
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%...
ade.googlesyndication.com/ddm/activity/ Frame 23AF 42 B
515 B 188ms
42ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620444%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1634662620367;dc_rfl=1,https%253A%252F%252Ffemme4.com%252F%240;ecn1=1;etm1=0;eid1=11;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 23AF 42 B
64 B 23ms
21ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CwpWd2_huYY_-NejC7_UP0eKfsAiP4qDOZa-XzunLDofLvfzHARABIMCoympgyQagAbHl1f0CyAEFqAMByAMTmAQAqgTwAU_QQI7Z0vW5lxYVVYrEaKDypwBjlCgXgGp8B5K5oqKzNlzveGj42Y9ewoRlc48jx4M8J3v-Z2YanFAJBMuyaOw97h_sP6Uyqgm8lc1NPSopOwThGaJ6CqKcVelEC3DXzXHO732EjErm5_oStoQOpJkoy_Wxr4NTUy1cVds-4x2ecRJ6Ws3_331IQEgJTtG_C7tN2oUq2OeIabATSSsAF1BkeFB-ZznhNhEiZBhL-3P3tDjUJaD6E2EXdXoQcKiF-C7uXqsTV6Pb7FfcbFl5INk0dGo1ZB8O1ZsiOQbDPobSi7FOG_H16L37geFb1ZVy0MAEjbzDzNsD4AQDkAYBoAZ5gAe3mqqCAagH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYHYAKA8gLAeALAYAMAbAT0tXuDNATANgTA4gUAdgUAdAVAYAXAQ&sigh=njEwdoLi3Js&label=part2viewed&ad_mt=0&acvw=sv%3D903%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620444%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1634662620367&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA2MDQzMjQ1ODdAqwIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDkxNTU3MjgyCTE1OTI0OTIwOEA2ClkIARIPcnRyLmlubm92aWQuY29tGgtJbm5vdmlkIEFkcyACKgYxN2t1MDYyBjFoMDk2cECUAVIiCKAGEA8lAADwQSgBOgd1bmtub3duQgd1bmtub3duSEFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0...
ade.googlesyndication.com/ddm/activity/ Frame 23AF 42 B
107 B 189ms
44ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D11%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D11%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D11%26is%3D18%26i0%3D18%26ic%3D4096%26cs%3D4114%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620447%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1634662620367;ecn1=1;etm1=0;eid1=16;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 23AF 42 B
64 B 21ms
19ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CwpWd2_huYY_-NejC7_UP0eKfsAiP4qDOZa-XzunLDofLvfzHARABIMCoympgyQagAbHl1f0CyAEFqAMByAMTmAQAqgTwAU_QQI7Z0vW5lxYVVYrEaKDypwBjlCgXgGp8B5K5oqKzNlzveGj42Y9ewoRlc48jx4M8J3v-Z2YanFAJBMuyaOw97h_sP6Uyqgm8lc1NPSopOwThGaJ6CqKcVelEC3DXzXHO732EjErm5_oStoQOpJkoy_Wxr4NTUy1cVds-4x2ecRJ6Ws3_331IQEgJTtG_C7tN2oUq2OeIabATSSsAF1BkeFB-ZznhNhEiZBhL-3P3tDjUJaD6E2EXdXoQcKiF-C7uXqsTV6Pb7FfcbFl5INk0dGo1ZB8O1ZsiOQbDPobSi7FOG_H16L37geFb1ZVy0MAEjbzDzNsD4AQDkAYBoAZ5gAe3mqqCAagH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYHYAKA8gLAeALAYAMAbAT0tXuDNATANgTA4gUAdgUAdAVAYAXAQ&sigh=njEwdoLi3Js&label=admute&ad_mt=0&acvw=sv%3D903%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D279,-2164,601,-1591%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D11%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D11%26pst%3D-1%26dur%3D30059%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D11%26is%3D18%26i0%3D18%26ic%3D4096%26cs%3D4114%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D1%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D1634662620447%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1634662620367&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA2MDQzMjQ1ODdAqwIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDkxNTU3MjgyCTE1OTI0OTIwOEA2ClkIARIPcnRyLmlubm92aWQuY29tGgtJbm5vdmlkIEFkcyACKgYxN2t1MDYyBjFoMDk2cECUAVIiCKAGEA8lAADwQSgBOgd1bmtub3duQgd1bmtub3duSEFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 23ms
23ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTAzp2VlqzVlVGygZT0kNwM0NwYlNwE2JaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY2MDMkMwYzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaZcZF9uqGx9nW50ZXJjpz9go3RyoHRxJaJcPTZDNwx3NwY1NTM3NDYkNmQ3MmqDNmM2QwMkN0I1NDMjN0Q3QwY0MmImMDMlMmElRDMkMmAlRDMkMmx1RwMkMmx3RDqCNmMmMTM1MmImNTMjMmAmMTMkN0Q3QwQmMmUmNmqEN0I1MmY0NTpmNTZCNUE1NmVBNmA2MwZENTY2QwU4MmI1QTZDNwI1NmMkNxM0RTQmMmU2QTYlMmImMDNEN0Q3QwYlNwM2ODplNxY2RDY1N0Q3QwpkNwQ2NTpmNxI3NDZGNmA3RDqCNxY3NmY5NxU2NDZGNmp3MmqEN0I1ODM2MmxmMDqEN0I1OTMmMmxmMDqEN0I2NwMkN0Q3QwRDMmEmMDM3MmQmOTqERxVGRSZxnWFcZD0zqXNypxyjQWRxpw0lMTYhMTMkLwEkNC45NlZ1p2VlVUE9TW96nWkfYSUlRwUhMCUlMCUlOFqcozRiq3MyMwBOVCUlMDEjLwAyM0IyMwBXnW42NCUmQvUlMHt2NCUlOSUlMEFjpGkyV2VvS2y0JTJGNTM3LwM2JTIjJTI4S0uUTUjyMxMyMwBfnWgyJTIjR2Vwn28yMwxyMwBDnHJioWUyMxY5Ml4jLwQ1NmphNwMyMwBTYWZupzxyMxY1MmphMmYzY3N1qWyxPTYkNzVzOGQ4MmFvODtzpaZhPTp4MTAzY29hqGVhqEZcoGVJZD0kOTAlMmt4Jz1yZGyuUGkurUkcp3RJZD0kMDI4MlZgZWRcYUkcp3RJZD0lNDxmNSZcp0V4Y2k1ZGVGpz9gT3B0PTAznXNDYWNbZWRCnWQ9MCZwo250ZW50TWF0Y2uUrXByPSZmp3BsYWRioT0zZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNDY2MwYlMDQ1NCZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTZyZwuxODRyNGVzJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 20ms
20ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTpzp2VlqzVlVGygZT0kNwM0NwYlNwE2JaZcZF9joGF5ZXJWZXI9Ml4kLwAzpm01ODA1NlZmqGE9MTY2MDMkMwYzrD01NmMzrT0mMwIzoXN0YT0kNTI1MDAkMSZ2nWRsqzFmqFR5pGU9MlZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9ZzVgoWU0LzNioSZxZWJ1Z0yhZz9loWF0nW9hPSZcp0FjpD0jJaZcZF9uqGx9nW50ZXJjpz9go3RyoHRxJaVmZXJJpEFxZHI9MwE2LwEmMS4kMTQhOTpzqXNypyVBPU1irzyfoGEyMxY1LwAyMwAyMwuXnW5xo3qmJTIjTyQyMwAkMC4jJTNCJTIjV2yhNwQyM0IyMwB4NwQyMwxyMwBBpHBfZVqyYxgcqCUlRwUmNl4mNvUlMCUlOEgIVE1MJTJDJTIjoGyeZSUlMEqyY2giJTI5JTIjQ2ulo21yJTJGOTMhMC40NTp3LwYmJTIjU2FzYXJcJTJGNTM3LwM2JzNmqXVcZD02MTZyZwuxODMkYwt4JaJ2ow03ODEjJzNioaRyoaRGnWkySWQ9MCZgZWRcYVBfYXyMnXN0SWQ9MCZgZWRcYUkcp3RJZD0jJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmQ2NwI2MwA0NTxzqWyxPVNyn2yhZG9TUGkurWVlNwE2ZWY4ZDt0ZTRyZvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 8C20 23 KB
9 KB 11ms
10ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://imasdk.googleapis.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Thu, 14 Oct 2021 14:24:07 GMT
expires: Fri, 14 Oct 2022 14:24:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 441173
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js Show response
pagead2.googlesyndication.com/bg/ Frame 8C20 35 KB
13 KB 15ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBeW4A8KRQKaUXRhZhiUEBaonRmLgznW2QKT5Kp-z2M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

601796e00f0a45029a5174616618941016a89d198b8339d6d90293e4aa7ecf63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 10:15:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24074
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13430
x-xss-protection: 0
last-modified: Mon, 11 Oct 2021 11:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 19 Oct 2022 10:15:46 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 34.239.221.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=774606&asId=3160c977-7820-3a4d-f15f-cb9b871ccf94&tv=%7Bc:rvEZ42,pingTime:-10,time:2093,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85My4wLjQ1NzcuNjMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1634662618499%7C%7C79cf109766d31a3426be04f0d2cab300%7C%7Cc7e7172c7781b034963ef5178f1479dd%7C%7Cf4246a66545b51a522261eade1989338%7C%7C12917c81df586a8658c4946c036f7bcc%7C%7C0ab7623e54aa6a35b3a59fb5f055cdc4%7C%7C8b3887691e0b8c46a20fa5035a7f9013%7C%7Cf20e98c58892ada07d8c0ff41e7f5974%7C%7C1629390669,sca:%7Bspg:b62c9495-b440-8739-c49a-193e409833f3%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.221.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-221-169.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-server-name: dt45.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8C20 0
20 B 50ms
49ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.3.485.1&bgai=B9nFX3PhuYZ70CoXfnsEPg82CEAAAAAA4AeAEAg&bg=!paalpuLNAAao6lBpqOo7ACkAdvg8WiKbwtQJ-SUa9Bid2Hl-yOUnyRMs-PPByvqnCPhtQ224AAKU0wIAAACFUgAAAA1oAQcKAIrjNSnHZb91iIuwTg5w-VA9TQ38-AyiajAA7-HPGZ7jwUuqoQ2fhKpr0ZWXP6I6sHeCzsyBnQJqiPXyN9LNmfLZhaMWJ3f0xg1wP04R1Xf6OQ7AOTF4ON-j7mvjudAwsYq-8FCEW81xukEO75Rj6oP-fAavxCku_ZKFeVtm5rs5qv6Hd8p9hw81y1yZAss8IPCBoNP8zEsU3sz7IQZN6Jp_5GRu7HhDVr6xVNtPkt9RcbAoUjPuwq2uMmWXpSFqBD6LJfSW2wyCBAa25Tve29mhI-MuHkueDVL6ZNVWeGvMRwzFvkEXv-AZ9Rn6ZRAbQejFBWVpWTkkoU0E_1OzhYVdo3wsMUQtCONlMw4sLlafEMK_IeBqCLERaDq59uN16LeAqWUY-g9YkqeCPrLVBo7akljepmfx9tdanIVSm2oBvfjZjgkWm0hmUMVg_9rpG3Cevz3Lnz8wnkRfwLMeK66TBf3smbfjmrylaX529krFFCLhMAuXOC70Jk9DCw7VyaZ9JqoSC-6GfvUA7YPUivkjehQzxB1k03jDHektU-LFq-QHpNi7LBcDVUn40Ok8gzSoiRjoN97OrCE0XTjnwA3LNLrqqtL4LMZP2xbKl0Gm9HzFt0KswkMaHDfOd0IYvxO2ZIE7kg0cGGIZe1ISYHpe6tQi01DT8pDC2QSDKhXcTSRW64AfrZYZZ56HuRwcoYgW6nJJi_D40nPboeGEht17Xd7lwN2eSh69ZFUyanEwabBHfsiu7bu_ZNn9J8kV2urzZm-Cd6T8o90y--iA-MO2qrBdm155kKvWYjsBwH2aYzGUBmUv0yyecg3KbT0D37FWyqKUZWUwAeKdhTLTtMg-KEnfFF0fJWVQWPVXg3Niw58H2YXWmS5kQq8y_EBA57AQhJy6hdcKsIcy_wRSwPxr1--AIBt4XohCjfQJE6hHIEc5USEjwUd1tnq1d-IciyED7tTJHpMrInCzpQcO9hg2xIM6LLwKbfvocD5ePzmINhe94WvTXYJYc9osxaoJ7oW6VvulgaRbIPVrCGW0MI6Bq-SpWIgRua_XuGR-u2Up0aWUUbPXUCcCYRbAGKaQ31Uc7vkYYf4sQFXprbzZPLsWtARUojF4z6g6fArwxTxzrJf3Z9tlgspU

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 1E5A 0
733 B 9ms
9ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:57:00 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 6829183f-45d3-41f8-8724-529d5caac170
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C2CD 0
733 B 22ms
22ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:57:00 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: a95a7dea-bbdb-48fe-a9d9-1ff3355ce416
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6AD0 0
733 B 7ms
7ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:57:00 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: c8ede68d-3d3c-4f9a-9f36-ba08e438b530
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 42D8 0
733 B 18ms
18ms Script
text/html 37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.250 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 19 Oct 2021 16:57:00 GMT
X-Proxy-Origin: 216.131.114.97; 216.131.114.97; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 5b9f3282-def2-410f-9fdf-7c256d1dee73
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 23AF 0
17 B 23ms
23ms Ping
image/gif 142.250.179.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~kuybx2a3&c=3159285448633&slotId=1579642724316.5&qqid=CM_XpOb41vMCFWjhuwgdUfEHhg&gqid=2_huYZK4NOTQ7_UPusKRwAo&fb=ima_html5-lima&sdkv=h.3.485.1&mrd=4&aab=0&itv=1&gpm_i=5&gpm_c=5&gpm_a=5&smb=1000&br=800&mt=video%2Fmp4&vs=640x360&webm=1&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fwebm%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=0&met.4=ff.kuybx2ce
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.485.1_en.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.179.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s41-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://imasdk.googleapis.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:00 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 23ms
23ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTEmJaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9NTtjNTpzp3RuPTE2NwAmMTI2Jat9NTpmJax9MmIlJz1mqGE9MTUlNTAjMTEzqzyxX3Zup3RUrXByPTMzqzyxX3ZcZXquYzyfnXR5U3RuqGU9MSZ2nWRspGFmp0RioWFcow1zZW1gZTQhY29gJaN1YxyxPWZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ2nWRsYXRcPWyhqGVlpHJioW90ZWk0ZCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZlqz49NmtkMCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZmp3BsYWRioT0zZ2Rjpw0kJzqxpHJDo25mZW50PSZcp1qyUGFmp0qxpHI9MCZwY3BuPTAzY2NjYUNioaNyoaQ9JzNvqXN0ZXI9MTYmNDY2MwYlMwQ1NvZ1nWQ9U2VenW5xo1NQoGF5ZXI2MTZyZwuxODRyNGVzJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzZzkiYXRTqGF0qXM9ZzFfp2UzZWyxp3A9pHJyYzyx
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:02 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H3 200 dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D440,836,762,1409%26tos%3D2010,0,0,0,0%26mtos%3D2010,2010,...
ade.googlesyndication.com/ddm/activity/ Frame 23AF 42 B
63 B 77ms
54ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D440,836,762,1409%26tos%3D2010,0,0,0,0%26mtos%3D2010,2010,2010,2010,2010%26amtos%3D0,0,0,0,0%26mcvt%3D2010%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2224%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D615%26pst%3D414%26dur%3D30059%26vmtime%3D1948%26dtos%3D2010%26dtoss%3D1%26dvs%3D2010%26dfvs%3D2010%26dvpt%3D2213%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D12%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483645%26psv%3D3%26psfv%3D3%26psa%3D0%26ptlt%3D1634662622661%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2010;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.09%26t%3D1634662620367;ecn1=1;etm1=0;eid1=200000;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 23AF 42 B
64 B 84ms
84ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvoXhcOz9uOyWOe9pYdIfam-nKZN2e3990tAB_Q2Vk8D4oOGEscmZzwU_3ihO90hm85yYfhIt4HCmFWvRXof2xVLL07AZD35KVf1HPaW60v4y1i3E8&sai=AMfl-YT0dQBAXNF0eO6MFMRTYnKNpj0QAzT-jlQ2H9ZFBzC24gz1BC8gBqeUmrckNI4-Kc95ic8ck_qAwt-8I1cTtd8z7iuWO5CwvjEHXIhXUUP6I9KiTS-v-IK4zlE&sig=Cg0ArKJSzCnm53eqmdasEAE&cid=CAASEuRoS0A6MGqNsFkd0Z_Ca0c5GQ&id=lidarv&acvw=sv%3D903%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D440,836,762,1409%26tos%3D2010,0,0,0,0%26mtos%3D2010,2010,2010,2010,2010%26amtos%3D0,0,0,0,0%26mcvt%3D2010%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2224%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D615%26pst%3D414%26dur%3D30059%26vmtime%3D1948%26dtos%3D2010%26dtoss%3D1%26dvs%3D2010%26dfvs%3D2010%26dvpt%3D2213%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D12%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483645%26psv%3D3%26psfv%3D3%26psa%3D0%26ptlt%3D1634662622661%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2010&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.09%26t%3D1634662620367

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 21ms
21ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTI1JaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA1NDY0JaN0YT0jJat9NwxjJax9MmxjJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9qW5xZWZcozVxX2ZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODAjJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmQ2NwI2MwQ0NwAzqWyxPVNyn2yhZG9TUGkurWVlNwE2ZWY4ZDt0ZTRyZvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:04 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2 200 liveView.php
live.primis.tech/live/ 0
226 B 19ms
19ms Image
text/html 63.250.56.23
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.primis.tech/live/liveView.php?hash=ozcmPTEznXRiPTEzqzyxX2V2ZW50PTQlJaNypaZypyRcoWU9MTYmNDY2MwYkNvZ2nWRspGkurWVlVzVlPTMhMS4jJaM9MTA1NDY0JaN0YT0jJat9NwxjJax9MmxjJaZcZF9jYXNmRG9gYWyhPWZyoW1yNC5wo20zp3VvSWQ9qW5xZWZcozVxX2ZyoW1yNC5wo20zZGVvqWqJozZipz1uqGyiow0znXNBpHA9MCZ1p2VlSXBBZGRlPTIkNv4kMmEhMTE0Lwx3JaVmZXJVQT1No3ccoGkuJTJGNS4jJTIjJTI4V2yhZG93plUlME5UJTIjMTAhMCUmQvUlMFqcowY0JTNCJTIjrDY0JTI5JTIjQXBjoGVXZWJLnXQyMxY1MmphMmYyMwAyMwuLSFRNTCUlQlUlMGkcn2UyMwBHZWNeolUlOSUlMENbpz9gZSUlRwxmLwAhNDU3Nl42MlUlMFNuZzFlnSUlRwUmNl4mNvZwp3V1nWQ9NwE2ZWY4ZDtmMWI4OCZwo250ZW50RzyfZUyxPTAzoWVxnWFQoGF5TGymqEyxPTAzoWVxnWFMnXN0SWQ9MCZxqXI9ODAjJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTAzY2NjYT0jJzNwpGFDo25mZW50PSZwYaVmqGVlPTE2MmQ2NwI2MwQ1MmIzqWyxPVNyn2yhZG9TUGkurWVlNwE2ZWY4ZDt0ZTRyZvZjqWJVpzj9nHR0pHMyM0EyMxYyMxZzZW1gZTQhY29gJTJGJzZfo2F0U3RuqHVmPWZuoHNyJzVcZHNjPXBlZWJcZA==
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 63.250.56.23 , United States, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:04 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2

200

user
ads3.admatic.com.tr/ Frame D318
Redirect Chain

https://x.bidswitch.net/sync?ssp=admatic
https://green.erne.co/bidswitch/cm?bidswitch_ssp_id=admatic&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=270&expires=10&user_id=AeSGavg6AEZtEzFsrupaXrIZ&ssp=admatic
https://ads4.admatic.com.tr/showad/px/ums/sync/bsw?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=
https://ads3.admatic.com.tr/user?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=

35 B
142 B

52ms
52ms

Image
image/gif

188.132.147.228
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads3.admatic.com.tr/user?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.132.147.228 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS: static-228-147-132-188.sadecehosting.net
Software: AdMatic / AdMatic
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn.admatic.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 19 Oct 2021 16:57:04 GMT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
server: AdMatic
x-powered-by: AdMatic
etag: H7Wx6dEYEkOJmG81KifwkFt_F_REnMJzrm7v1B9ZB2kmdlpn8b4_2Ox6SABJ04CmH784ZTwl70YBsz0xUmejcw
content-type: image/gif
cache-control: no-cache
timing-allow-origin: *
content-length: 35

Redirect headers

timing-allow-origin: *
date: Tue, 19 Oct 2021 16:57:04 GMT
location: https://ads3.admatic.com.tr/user?bsw_uuid=cd68b76e-94d4-44de-b69e-f70d3cf183aa&dsp_uuid=&dsp_id=
x-powered-by: AdMatic
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://cdn.admatic.com.tr
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html; charset=utf-8
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
content-length: 221

GET
H3 200 dc_oe=ChMIk6iH5fjW8wIViBwGAB0_Rwt6EAAYACCH7YBMQhMI7Z_n5PjW8wIVxat3Ch2ypQsL;met=1;&timestamp=1634662628009;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame E5ED 42 B
63 B 51ms
51ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIk6iH5fjW8wIViBwGAB0_Rwt6EAAYACCH7YBMQhMI7Z_n5PjW8wIVxat3Ch2ypQsL;met=1;&timestamp=1634662628009;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMIgJeO5fjW8wIVJoAnAh2UnQ5BEAAYACCi24JMQhMItPXx5PjW8wIVFrh3Ch1Lkgop;met=1;&timestamp=1634662628066;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 897C 42 B
63 B 53ms
52ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIgJeO5fjW8wIVJoAnAh2UnQ5BEAAYACCi24JMQhMItPXx5PjW8wIVFrh3Ch1Lkgop;met=1;&timestamp=1634662628066;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://d88accd2ad039d497c7d9c3fca912d8a.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

1x1.gif
ag.innovid.com/ Frame 23AF
Redirect Chain

https://s.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action...
https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&actio...

43 B
296 B

19ms
19ms

Image
image/gif

18.168.50.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action=vpoint&event_id=percent&event_value=25&ivc_exdata=ivc_dbmtoken%3DAD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU%26iv_geo_dma%3D%26iv_geo_country%3DDE%26iv_geo_city%3DFrankfurt+am+Main%26iv_geo_state%3DHE%26iv_geo_zip%3D60313%26iv_geo_lat%3D50.1188%26iv_geo_lon%3D8.6843
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.50.255 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-50-255.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:08 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:08 GMT
server: nginx
content-type: text/plain
location: https://ag.innovid.com/1x1.gif?project_hash=1gorhd&client_id=1545&video_id=791134&channel_id=2523574&publisher_id=1968&placement_tag_id=0&project_state=2&r=1634662620346&placement_hash=17ku06&action=vpoint&event_id=percent&event_value=25&ivc_exdata=ivc_dbmtoken%3DAD1EzRQAAABnCl8KDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhIIgIucsTeoAqzZqQGwAt7ltwtAAdICKhgAIhMIz9ek5vjW8wIVaOG7CB1R8QeGKAEwATivl87pyw5AAkgBWJiEIBDkhvC2AVOlL1XTsFf6AzzvPupqPTU%26iv_geo_dma%3D%26iv_geo_country%3DDE%26iv_geo_city%3DFrankfurt+am+Main%26iv_geo_state%3DHE%26iv_geo_zip%3D60313%26iv_geo_lat%3D50.1188%26iv_geo_lon%3D8.6843
cache-control: no-cache
content-length: 0
expires: -1

GET
H3 200 dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D440,836,762,1409%26tos%3D7533,0,0,0,0%26mtos%3D7533,7533,...
ade.googlesyndication.com/ddm/activity/ Frame 23AF 42 B
63 B 55ms
55ms Image
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIntK25vjW8wIVha8nAh2DpgACEAAYACC45vdLQhMIz9ek5vjW8wIVaOG7CB1R8QeG;met=1;acvw=sv%3D903%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D440,836,762,1409%26tos%3D7533,0,0,0,0%26mtos%3D7533,7533,7533,7533,7533%26amtos%3D0,0,0,0,0%26mcvt%3D7533%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D7747%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1617%26pst%3D414%26dur%3D30059%26vmtime%3D7698%26dtos%3D5523%26dtoss%3D2%26dvs%3D5523%26dfvs%3D5523%26dvpt%3D5523%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7533,7533,7533,7533,7533%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D39%26emuc%3D0%26emb%3D38,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483393%26psv%3D255%26psfv%3D255%26psa%3D0%26ptlt%3D1634662628184%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,7533;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.09%26t%3D1634662620367;ecn1=1;etm1=0;eid1=960584;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Oct 2021 16:57:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 23AF 42 B
64 B 19ms
18ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CwpWd2_huYY_-NejC7_UP0eKfsAiP4qDOZa-XzunLDofLvfzHARABIMCoympgyQagAbHl1f0CyAEFqAMByAMTmAQAqgTwAU_QQI7Z0vW5lxYVVYrEaKDypwBjlCgXgGp8B5K5oqKzNlzveGj42Y9ewoRlc48jx4M8J3v-Z2YanFAJBMuyaOw97h_sP6Uyqgm8lc1NPSopOwThGaJ6CqKcVelEC3DXzXHO732EjErm5_oStoQOpJkoy_Wxr4NTUy1cVds-4x2ecRJ6Ws3_331IQEgJTtG_C7tN2oUq2OeIabATSSsAF1BkeFB-ZznhNhEiZBhL-3P3tDjUJaD6E2EXdXoQcKiF-C7uXqsTV6Pb7FfcbFl5INk0dGo1ZB8O1ZsiOQbDPobSi7FOG_H16L37geFb1ZVy0MAEjbzDzNsD4AQDkAYBoAZ5gAe3mqqCAagH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIBhEAEYHYAKA8gLAeALAYAMAbAT0tXuDNATANgTA4gUAdgUAdAVAYAXAQ&sigh=njEwdoLi3Js&label=videoplaytime25&ad_mt=7699&acvw=sv%3D903%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D440,836,762,1409%26tos%3D7533,0,0,0,0%26mtos%3D7533,7533,7533,7533,7533%26amtos%3D0,0,0,0,0%26mcvt%3D7533%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D7747%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1617%26pst%3D414%26dur%3D30059%26vmtime%3D7698%26dtos%3D5523%26dtoss%3D2%26dvs%3D5523%26dfvs%3D5523%26dvpt%3D5523%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D7533,7533,7533,7533,7533%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D579%26femvt%3D0%26emc%3D39%26emuc%3D0%26emb%3D38,0,0,0,0%26avms%3Dexc%26qi%3D234299952%26psm%3D-2147483393%26psv%3D255%26psfv%3D255%26psa%3D0%26ptlt%3D1634662628184%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,7533&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.09%26t%3D1634662620367&sdkv=h.3.485.1&vci=CkIIAhIec2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1NTA2MDQzMjQ1ODdAqwIKOAgCEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MDkxNTU3MjgyCTE1OTI0OTIwOEA2ClkIARIPcnRyLmlubm92aWQuY29tGgtJbm5vdmlkIEFkcyACKgYxN2t1MDYyBjFoMDk2cECUAVIiCKAGEA8lAADwQSgBOgd1bmtub3duQgd1bmtub3duSEFQABgB

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS