urlscan.io logo urlscan.io
SecurityTrails logo

fragebogen.gutes-hoeren.de Open in urlscan Pro
34.117.143.69  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzx...
Effective URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DI...
Submission: On June 29 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 19 IPs in 3 countries across 18 domains to perform 47 HTTP transactions. The main IP is 34.117.143.69, located in Kansas City, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is fragebogen.gutes-hoeren.de.
TLS certificate: Issued by GTS CA 1D4 on May 7th 2024. Valid for: 3 months.
This is the only time fragebogen.gutes-hoeren.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

7    173.214.240.15 (United States)

ASN15317 (SERVEREL-AS, US)
PTR: 173.214.240.15.serverel.net
roselocation5.xyz
freetrckr.com
healthmeal1.xyz
1    2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    199.182.164.180 (United States)

ASN15317 (SERVEREL-AS, US)
PTR: 180.164.182.199.serverel.net
xml.pushking.net
10    104.19.130.76 (None, )

ASN13335 (CLOUDFLARENET, US)
c.mgid.com
s-img.mgid.com
clck.mgid.com
cdn.mgid.com
a.mgid.com
2    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    18.66.102.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-102-106.fra56.r.cloudfront.net
static.hotjar.com
1    52.86.19.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-19-188.compute-1.amazonaws.com
adrta.com
1    2600:1f18:26d4:7e06:11e9:bb92:d06f:e2ac (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
ipds.adrta.com
1    13.32.27.19 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-19.fra56.r.cloudfront.net
script.hotjar.com
1    18.66.112.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-110.fra56.r.cloudfront.net
vc.hotjar.io
11    34.117.143.69 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 69.143.117.34.bc.googleusercontent.com
fragebogen.gutes-hoeren.de
1    2a02:26f0:3500:889::13b8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
cdn.optimizely.com
1    2606:4700:4400::6812:29af (None, )

ASN- ()
assets.calendly.com
1    2.17.191.240 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-17-191-240.deploy.static.akamaitechnologies.com
a18736142230.cdn.optimizely.com
1    2a00:1450:4001:827::2008 (None, )

ASN- ()
www.googletagmanager.com
2    34.102.193.213 (None, )

ASN- ()
static.sonova.xyz
3    2600:9000:235a:7a00:12:94b3:c380:93a1 (None, )

ASN- ()
images.ctfassets.net
2    2603:1020:c01:4::48 (None, )

ASN- ()
sonova.piwik.pro
2    34.111.16.210 (None, )

ASN- ()
assets.sonova.xyz
1    2600:9000:2240:7800:7:4973:1b00:93a1 (None, )

ASN- ()
client.prod.mplat-ppcprotect.com
Apex Domain
Subdomains		 Transfer
11 gutes-hoeren.de
fragebogen.gutes-hoeren.de
410 KB
10 mgid.com
c.mgid.com — Cisco Umbrella Rank: 5892
s-img.mgid.com — Cisco Umbrella Rank: 8542
clck.mgid.com — Cisco Umbrella Rank: 37550
cdn.mgid.com — Cisco Umbrella Rank: 11014
a.mgid.com — Cisco Umbrella Rank: 12834
79 KB
4 sonova.xyz
static.sonova.xyz
assets.sonova.xyz
429 KB
4 healthmeal1.xyz
healthmeal1.xyz
3 KB
3 ctfassets.net
images.ctfassets.net
27 KB
2 piwik.pro
sonova.piwik.pro
24 KB
2 optimizely.com
cdn.optimizely.com — Cisco Umbrella Rank: 805
a18736142230.cdn.optimizely.com
97 KB
2 adrta.com
adrta.com — Cisco Umbrella Rank: 2280
ipds.adrta.com — Cisco Umbrella Rank: 4562
1 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 894
script.hotjar.com — Cisco Umbrella Rank: 1260
60 KB
2 gstatic.com
fonts.gstatic.com
32 KB
2 pushking.net
xml.pushking.net — Cisco Umbrella Rank: 65344
588 B
2 freetrckr.com
freetrckr.com — Cisco Umbrella Rank: 672301
623 B
1 mplat-ppcprotect.com
client.prod.mplat-ppcprotect.com
pclick.prod.mplat-ppcprotect.com Failed
28 KB
1 googletagmanager.com
www.googletagmanager.com
130 KB
1 calendly.com
assets.calendly.com
1 KB
1 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 3549
232 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
1 KB
1 roselocation5.xyz
roselocation5.xyz
120 B
47 18
Domain Requested by
11 fragebogen.gutes-hoeren.de clck.mgid.com
fragebogen.gutes-hoeren.de
4 healthmeal1.xyz 1 redirects healthmeal1.xyz
3 images.ctfassets.net fragebogen.gutes-hoeren.de
3 cdn.mgid.com clck.mgid.com
3 clck.mgid.com healthmeal1.xyz
clck.mgid.com
2 assets.sonova.xyz www.googletagmanager.com
2 sonova.piwik.pro healthmeal1.xyz
sonova.piwik.pro
2 static.sonova.xyz fragebogen.gutes-hoeren.de
2 a.mgid.com clck.mgid.com
2 fonts.gstatic.com fonts.googleapis.com
2 xml.pushking.net 2 redirects
2 freetrckr.com 2 redirects
1 client.prod.mplat-ppcprotect.com healthmeal1.xyz
1 www.googletagmanager.com fragebogen.gutes-hoeren.de
1 a18736142230.cdn.optimizely.com cdn.optimizely.com
1 assets.calendly.com fragebogen.gutes-hoeren.de
1 cdn.optimizely.com fragebogen.gutes-hoeren.de
1 vc.hotjar.io script.hotjar.com
1 script.hotjar.com static.hotjar.com
1 ipds.adrta.com clck.mgid.com
1 adrta.com 1 redirects
1 static.hotjar.com clck.mgid.com
1 s-img.mgid.com healthmeal1.xyz
1 c.mgid.com healthmeal1.xyz
1 fonts.googleapis.com healthmeal1.xyz
1 roselocation5.xyz 1 redirects
0 pclick.prod.mplat-ppcprotect.com Failed client.prod.mplat-ppcprotect.com
47 27

This site contains no links.

Subject Issuer Validity Valid
diarydiet1.xyz
R3		 2024-05-08 -
2024-08-06		 3 months crt.sh
upload.video.google.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
mgid.com
E1		 2024-05-09 -
2024-08-07		 3 months crt.sh
*.gstatic.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
*.hotjar.com
Amazon RSA 2048 M03		 2024-05-22 -
2025-06-20		 a year crt.sh
*.hotjar.io
Amazon ECDSA 256 M02		 2024-02-07 -
2025-03-08		 a year crt.sh
fragebogen.gutes-hoeren.de
GTS CA 1D4		 2024-05-07 -
2024-08-05		 3 months crt.sh
cdn.optimizely.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-09-01 -
2024-09-04		 a year crt.sh
calendly.com
E1		 2024-05-31 -
2024-08-29		 3 months crt.sh
*.cdn.optimizely.com
GeoTrust RSA CA 2018		 2024-01-25 -
2025-01-27		 a year crt.sh
*.google-analytics.com
WR2		 2024-06-13 -
2024-09-05		 3 months crt.sh
static.sonova.xyz
WR3		 2024-05-19 -
2024-08-17		 3 months crt.sh
images.ctfassets.net
Amazon RSA 2048 M02		 2023-12-19 -
2025-01-16		 a year crt.sh
*.piwik.pro
GlobeSSL DV CA		 2024-01-02 -
2025-01-28		 a year crt.sh
assets.sonova.xyz
GTS CA 1D4		 2024-06-04 -
2024-09-02		 3 months crt.sh
*.prod.mplat-ppcprotect.com
Amazon RSA 2048 M01		 2023-09-21 -
2024-10-19		 a year crt.sh

This page contains 3 frames:

Primary Page: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Frame ID: FCF9A65AB52D83D49A08ED8C9B089595
Requests: 48 HTTP requests in this frame

Frame: https://a18736142230.cdn.optimizely.com/client_storage/a18736142230.html
Frame ID: 936F8C6EB20F3D459A21F3204953D04D
Requests: 1 HTTP requests in this frame

Frame: https://images.ctfassets.net/uafdk7px88ld/1OxINumaX1rfjyczTy1qZN/01bf6724627fbd969a19e5ac52ddeff7/Geers_LF_trust_icons_opt_1.svg
Frame ID: B59C22A9B2EAE4FB0C67E34548BC5B0C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Geers Gutes Hoeren

Page URL History Show full URLs

  1. http://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymi... HTTP 307
    https://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymi... HTTP 302
    https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMj... Page URL
  2. https://xml.pushking.net/click?s=1&tid=1763&sid=5fb6e7069bcbef4e73df17440409de11&rnd=745801667 HTTP 302
    https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_a... Page URL
  3. https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/tr/pp/1/1/?h=Yw65RC5GCnTOS-q94B4YA-4X... Page URL
  4. https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campai... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+(?:https?:)?//(?:assets|downloads|images|videos)\.(?:ct?fassets\.net|contentful\.com)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • optimizely\.com.*\.js

Page Statistics

47
Requests

91 %
HTTPS

45 %
IPv6

18
Domains

27
Subdomains

19
IPs

3
Countries

1363 kB
Transfer

3738 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytogzlmtkymmy4ndcyote0zta4otexyjg1mzc1nzflngutmzk3os0wljawmti0msuymiuyqyuymjg4ni1kowe1yzbjztuwm2vkn2eyn2e5mjc2n2...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 307
    https://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytogzlmtkymmy4ndcyote0zta4otexyjg1mzc1nzflngutmzk3os0wljawmti0msuymiuyqyuymjg4ni1kowe1yzbjztuwm2vkn2eyn2e5mjc2n2...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 302
    https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
    https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D Page URL
  2. https://xml.pushking.net/click?s=1&tid=1763&sid=5fb6e7069bcbef4e73df17440409de11&rnd=745801667 HTTP 302
    https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb Page URL
  3. https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/tr/pp/1/1/?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM%2A&ph=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM%2A&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&pubsrcid=574551&tt=Direct&att=3&trt=4&k=1414833fc*f!fZBmCJAwfZBmCJA-ffMHwwf!fOJffKkfYfMjcuNTMxMjV8MTg%3Df%2C*f%2C*ffQf!faHR0cHM6Ly9jbGNrLm1naWQuY29tL2doaXRzLzE3NzY2MTcwL2kvNTc3NDY5MTIvMC9zcmMvNTc0NTUxL3BwLzEvMT9oPVl3NjV%24QzVHQ25UT1MtcTk0QjRZQ%2400WDR2X2Fa%242J%24TzBsODhWTlZaVTg4Y2NJb01oRXc4RFFIZFVhNEdiRlFEQXpGVjNlQnFGdWw0c1JyQm5mVU56NDhLWWFkRTFDQkRtdTZIb0FKMVlNKiZyaWQ9YzAxYmY2ZDUtMzY2My0xMWVmLTgxYjEtYzg0YmQ2ODM2NDI4JnR0PURpcmVjdCZhdHQ9MyZwdWJzcmNpZD01NzQ1NTEmY3BtPQ%3D%3DfaHR0cHM6Ly9oZWFsdGhtZWFsM%2454eXovfaHR0cHM6Ly9oZWFsdGhtZWFsM%2454eXovf*fMHww*DkwNnw2NzY%3Dff%2C*f!fcfMTh8Mjd8OTA1*DY3Ng%3D%3DfZAfS0f!f!fTW96aWxsY%2481LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChL%24FRNTCwgbGlrZ%24BHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2fUERGVmlld2Vy*ENocm9tZVBERlZpZXdlcnxDaHJvbWl1bVBERlZpZXdlcnxNaWNyb3NvZnRFZGdlUERGVmlld2Vy*FdlYktpdGJ1aWx0LWluUERGf!fV2luMzI%3DfMTIwfLTF8LTE%3DfMTYwMHwxMjAwfdW5rbm93bnw0Z3wwfm%24fm%24fQfUC2Grf*f*(lxSDc&grs=-5&kpgt=102 Page URL
  4. https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytogzlmtkymmy4ndcyote0zta4otexyjg1mzc1nzflngutmzk3os0wljawmti0msuymiuyqyuymjg4ni1kowe1yzbjztuwm2vkn2eyn2e5mjc2n2...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 307
  • https://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytogzlmtkymmy4ndcyote0zta4otexyjg1mzc1nzflngutmzk3os0wljawmti0msuymiuyqyuymjg4ni1kowe1yzbjztuwm2vkn2eyn2e5mjc2n2...~311~...hbgxfzgvfzgvzayuymiu3ra==&if=1 HTTP 302
  • https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1 HTTP 302
  • https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Request Chain 2
  • https://healthmeal1.xyz/event_322c2e66-8d64-e04d-d87d-ffc382b9bb82_107_3236_3005?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDVmYjZlNzA2OWJjYmVmNGU3M2RmMTc0NDA0MDlkZTExJTI2cm5kJTNENTQ2OTIzOTEz&t=1719698752939&rnd=488007500&i=1 HTTP 302
  • https://xml.pushking.net/icon?sid=5fb6e7069bcbef4e73df17440409de11&rnd=546923913 HTTP 302
  • https://c.mgid.com/c?pv=2&v=0|0|0|Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&cid=1414833&f=1&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&psid=574551
Request Chain 8
  • https://xml.pushking.net/click?s=1&tid=1763&sid=5fb6e7069bcbef4e73df17440409de11&rnd=745801667 HTTP 302
  • https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Request Chain 14
  • https://adrta.com/i?clid=mgid&paid=mgid&avid=-&caid=-&plid=17766170&publisherId=57746912&siteId=797944&kv1=492x328&kv2=https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&kv3=-&kv4=-&kv5=574551&kv6=afrd_click_Atrz&kv7=711889&kv11=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&kv12=c01bf6d5-3663-11ef-81b1-c84bd6836428&kv24=Desktop&kv27=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36 HTTP 302
  • https://ipds.adrta.com/i?__x=NFCQLCLFIK@ECJEHPJGNGPONNIHKHHMJ@HOGOKNPNJLPNF@JPHHOHNFGJIIGMIOOIECHLHQLOMLMLMOHAHHFQPEOJKGGLQLLOIKM@FOHNMQNMJJPOEBHAF@E&clid=mgid&paid=mgid&avid=-&caid=-&plid=17766170&publisherId=57746912&siteId=797944&kv1=492x328&kv2=https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&kv3=-&kv4=-&kv5=574551&kv6=afrd_click_Atrz&kv7=711889&kv11=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&kv12=c01bf6d5-3663-11ef-81b1-c84bd6836428&kv24=Desktop&kv27=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36

47 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
healthmeal1.xyz/news/10701/
Redirect Chain
  • http://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytogzlmtkymmy4ndcyote0zta4otexyj...
  • https://roselocation5.xyz/event_49a9ec5b-f11e-a350-7caa-bae86bd70859_102_0_3001?payload=jtdcjtiyacuymiuzqsuymnhtbc5wbgfuzxrwdxnolm5ldcuymiuyqyuymnulmjilm0elnuilmji4odytogzlmtkymmy4ndcyote0zta4otexy...
  • https://freetrckr.com/bid?id=3000&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://freetrckr.com/bid?id=3005&token=e807a67b57ff274565f78878190ec04e&sub_id=&rc=0&ch=1
  • https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS
173.214.240.15.serverel.net
Software
nginx /
Resource Hash
be116044395764d98debc9eda1fac8540647b8347e7b9f1855ce952a6ede626e

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Sat, 29 Jun 2024 22:05:52 GMT
server
nginx

Redirect headers

accept-ch
Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-WoW64, Sec-CH-UA-Bitness, Sec-CH-UA-Model
date
Sat, 29 Jun 2024 22:05:52 GMT
location
https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
server
nginx
css
fonts.googleapis.com/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://healthmeal1.xyz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Sat, 29 Jun 2024 22:05:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 29 Jun 2024 21:47:31 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 29 Jun 2024 22:05:53 GMT
c
c.mgid.com/
Redirect Chain
  • https://healthmeal1.xyz/event_322c2e66-8d64-e04d-d87d-ffc382b9bb82_107_3236_3005?payload=aHR0cHMlM0ElMkYlMkZ4bWwucHVzaGtpbmcubmV0JTJGaWNvbiUzRnNpZCUzRDVmYjZlNzA2OWJjYmVmNGU3M2RmMTc0NDA0MDlkZTExJTI2...
  • https://xml.pushking.net/icon?sid=5fb6e7069bcbef4e73df17440409de11&rnd=546923913
  • https://c.mgid.com/c?pv=2&v=0|0|0|Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&cid=1414833&f=1&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJ...
43 B
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.mgid.com/c?pv=2&v=0|0|0|Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&cid=1414833&f=1&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&psid=574551
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H3
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://healthmeal1.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sat, 29 Jun 2024 22:05:53 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-mg-request-uuid
b5d3f09d-79b6-4bba-96e5-6e8ebb50a9c6
server
cloudflare
content-type
image/gif
cf-ray
89b9387a5b9165de-FRA
alt-svc
h3=":443"; ma=86400
content-length
43

Redirect headers

location
https://c.mgid.com/c?pv=2&v=0|0|0|Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&cid=1414833&f=1&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&psid=574551
date
Sat, 29 Jun 2024 22:05:53 GMT
server
nginx
aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMy0xMS84MjQ0MDgvYTE1O...
s-img.mgid.com/g/17766170/492x277/-/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s-img.mgid.com/g/17766170/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMy0xMS84MjQ0MDgvYTE1ODAzODZhNTQ3ZGYzNzk3NjhlZmQ4MjI4ZjYzOTMuanBn.webp?v=1719698752-8QI9dbGfXYTwSwR76W3k_e-v4ZqqJpGCdWYU-HBt7K8
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d790fcf7971fab33bec635cc6471e185497936cb2a73e2d6b72d1ad036e32da5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://healthmeal1.xyz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:53 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
cf-cache-status
HIT
x-mg-request-uuid
56e6a725-7ae2-4cdd-9549-0b773fd62c6a
age
2294214
alt-svc
h3=":443"; ma=86400
content-length
11996
last-modified
Sat, 30 Mar 2024 09:49:40 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
cache-control
immutable, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex
cf-ray
89b938768ea365de-FRA
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://healthmeal1.xyz
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 07:43:41 GMT
x-content-type-options
nosniff
age
224532
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 07:43:41 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700,400i&subset=cyrillic
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://healthmeal1.xyz
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 27 Jun 2024 17:31:01 GMT
x-content-type-options
nosniff
age
189292
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 27 Jun 2025 17:31:01 GMT
favicon.ico
healthmeal1.xyz/ 		13 B
258 B 		Other
General
Check archive.org
Download Go to
Full URL
https://healthmeal1.xyz/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS
173.214.240.15.serverel.net
Software
nginx /
Resource Hash
7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-type
text/html; charset=UTF-8
pragma
no-cache
date
Sat, 29 Jun 2024 22:05:53 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding
gzip
server
nginx
expires
Thu, 19 Nov 1981 08:52:00 GMT
event_322c2e66-8d64-e04d-d87d-ffc382b9bb82_107_0_3005
healthmeal1.xyz/ 		118 B
209 B 		Script
General
Check archive.org
Download Go to
Full URL
https://healthmeal1.xyz/event_322c2e66-8d64-e04d-d87d-ffc382b9bb82_107_0_3005?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyMTc2My01ZmI2ZTcwNjliY2JlZjRlNzNkZjE3NDQwNDA5ZGUxMS0zMjM2LTAuMDQ0MDIyJTIyJTVEJTdE&t=1719698752939&rnd=948697097&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
173.214.240.15 , United States, ASN15317 (SERVEREL-AS, US),
Reverse DNS
173.214.240.15.serverel.net
Software
nginx /
Resource Hash
48e4f0ed3c0b81ff9b45fbd5efee71582d8602a5d4addf336a881b2c94f5d5e0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:54 GMT
content-encoding
gzip
server
nginx
content-type
application/javascript
1
clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/
Redirect Chain
  • https://xml.pushking.net/click?s=1&tid=1763&sid=5fb6e7069bcbef4e73df17440409de11&rnd=745801667
  • https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-...
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/event_322c2e66-8d64-e04d-d87d-ffc382b9bb82_107_0_3005?payload=JTdCJTIyaCUyMiUzQSUyMnhtbC5wdXNoa2luZy5uZXQlMjIlMkMlMjJ1JTIyJTNBJTVCJTIyMTc2My01ZmI2ZTcwNjliY2JlZjRlNzNkZjE3NDQwNDA5ZGUxMS0zMjM2LTAuMDQ0MDIyJTIyJTVEJTdE&t=1719698752939&rnd=948697097&js=1&io=0&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA==&if=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
717636abadd7f9d6080c74ddee55c83fd0f491b6c9ce3ffe40fac09a4e0094c5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://healthmeal1.xyz/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ch
sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-wow64,sec-ch-ua-bitness,sec-ch-ua-model
alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
89b938855ebe8ed9-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 29 Jun 2024 22:05:55 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
x-robots-tag
noindex

Redirect headers

date
Sat, 29 Jun 2024 22:05:55 GMT
location
https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
server
nginx
img.png
cdn.mgid.com/images/tranzit/ 		68 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.mgid.com/images/tranzit/img.png
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:55 GMT
x-amz-version-id
null
cf-cache-status
HIT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-request-id
KWGQGTGRX0NE1NMS
age
4098
cf-polished
status=not_needed
alt-svc
h3=":443"; ma=86400
content-length
68
x-amz-id-2
PWTjhg2TU18w5GxLKTmUvKfEOb0e0++Uz1VEWe7pGIBN63PaPqi4Ws27wxuOBcn/7gIj71e85ww=
cf-bgj
imgq:100,h2pri
last-modified
Thu, 24 Mar 2022 17:14:24 GMT
x-amz-meta-s3cmd-attrs
atime:1648142053/ctime:1648142053/gid:0/gname:root/md5:91e42db1c66c0b276abf6234dc50b2eb/mode:33206/mtime:1648142053/uid:0/uname:root
server
cloudflare
etag
"91e42db1c66c0b276abf6234dc50b2eb"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
89b938862f918ed9-FRA
expires
Sun, 30 Jun 2024 22:05:55 GMT
dojo-other.js
clck.mgid.com/build/ 		69 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://clck.mgid.com/build/dojo-other.js?t=fc89bc18d7b35d3d60eb704619c9b16d
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85a2c1e232d431bc16f02193ceb8fcd82e9f20798ab430dffb12e2da41b0ca1b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"126.0.6478.126"
sec-ch-ua-platform-version
"10.0.0"
Referer
https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-wow64
?0
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:55 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-encoding
br
cf-cache-status
HIT
age
12
alt-svc
h3=":443"; ma=86400
cf-bgj
minify
last-modified
Tue, 18 Jun 2024 09:17:10 GMT
server
cloudflare
etag
W/"66715096-112df"
vary
Accept-Encoding
access-control-allow-methods
POST, OPTIONS
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
89b938861f7b8ed9-FRA
access-control-allow-headers
*
expires
Thu, 01 Jan 1970 00:00:01 GMT
touchpoints-sensor.js
a.mgid.com/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.mgid.com/touchpoints-sensor.js
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a98c4f22c9c8dc6a974276ebf08497fdf1b5d12d581f9a29c83a22ff8801170f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:55 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
gzip
x-mg-request-uuid
5180cfd6-9f45-4391-b05f-a7e4762f7893
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cf-ray
89b938861f7c8ed9-FRA
alt-svc
h3=":443"; ma=86400
frpt.js
cdn.mgid.com/js/ 		77 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.mgid.com/js/frpt.js
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
455c0cf3199c0d5eac170509b804776e1f18fb6c131f691660bf27a3952a335f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:55 GMT
x-amz-version-id
wH0_22p7dfcIxPdSIg4.3iu9LTGYLZqF
content-encoding
br
cf-cache-status
HIT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-request-id
GZ3STDXXW57MBM6D
age
4418
x-amz-server-side-encryption
AES256
alt-svc
h3=":443"; ma=86400
x-amz-id-2
b62Bx23yfn8yh+oCgLnXuSw8XLITK3zWa7d+Qv8Z+7TV/tSSe0oEQX1ggxejI67JsunFY0azCXI=
cf-bgj
minify
last-modified
Mon, 26 Feb 2024 09:00:01 GMT
x-amz-meta-s3cmd-attrs
atime:1708937995/ctime:1708937995/gid:0/gname:root/md5:55ad86c8cb4471b5ab1c24760fe9a39b/mode:33188/mtime:1708937711/uid:0/uname:root
server
cloudflare
etag
W/"55ad86c8cb4471b5ab1c24760fe9a39b"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
cf-ray
89b938862f9b8ed9-FRA
expires
Sun, 30 Jun 2024 22:05:55 GMT
hotjar-2590724.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-2590724.js?sv=6
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-102-106.fra56.r.cloudfront.net
Software
/
Resource Hash
36022956bb18d895882e1f1734d730035bf0945801c55cb62883c9737a2811d1
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Sat, 29 Jun 2024 22:05:12 GMT
via
1.1 993c0866e705e48daa4fed5e30627712.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
age
45
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/4b8b66c71691e774633e9f041b011ccc
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
lajqgG3NvzktF-92tZ8AY7w6H6P0YnBvOTzDSk0Ly_45mkxNvGMarQ==
i
ipds.adrta.com/
Redirect Chain
  • https://adrta.com/i?clid=mgid&paid=mgid&avid=-&caid=-&plid=17766170&publisherId=57746912&siteId=797944&kv1=492x328&kv2=https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5G...
  • https://ipds.adrta.com/i?__x=NFCQLCLFIK@ECJEHPJGNGPONNIHKHHMJ@HOGOKNPNJLPNF@JPHHOHNFGJIIGMIOOIECHLHQLOMLMLMOHAHHFQPEOJKGGLQLLOIKM@FOHNMQNMJJPOEBHAF@E&clid=mgid&paid=mgid&avid=-&caid=-&plid=17766170...
43 B
183 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ipds.adrta.com/i?__x=NFCQLCLFIK@ECJEHPJGNGPONNIHKHHMJ@HOGOKNPNJLPNF@JPHHOHNFGJIIGMIOOIECHLHQLOMLMLMOHAHHFQPEOJKGGLQLLOIKM@FOHNMQNMJJPOEBHAF@E&clid=mgid&paid=mgid&avid=-&caid=-&plid=17766170&publisherId=57746912&siteId=797944&kv1=492x328&kv2=https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&kv3=-&kv4=-&kv5=574551&kv6=afrd_click_Atrz&kv7=711889&kv11=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&kv12=c01bf6d5-3663-11ef-81b1-c84bd6836428&kv24=Desktop&kv27=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H2
Server
2600:1f18:26d4:7e06:11e9:bb92:d06f:e2ac Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://clck.mgid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Sat, 29 Jun 2024 22:05:56 GMT
cache-control
no-cache
server
nginx
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://ipds.adrta.com/i?__x=NFCQLCLFIK@ECJEHPJGNGPONNIHKHHMJ@HOGOKNPNJLPNF@JPHHOHNFGJIIGMIOOIECHLHQLOMLMLMOHAHHFQPEOJKGGLQLLOIKM@FOHNMQNMJJPOEBHAF@E&clid=mgid&paid=mgid&avid=-&caid=-&plid=17766170&publisherId=57746912&siteId=797944&kv1=492x328&kv2=https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&kv3=-&kv4=-&kv5=574551&kv6=afrd_click_Atrz&kv7=711889&kv11=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&kv12=c01bf6d5-3663-11ef-81b1-c84bd6836428&kv24=Desktop&kv27=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F126.0.0.0%20Safari%2F537.36
date
Sat, 29 Jun 2024 22:05:55 GMT
server
nginx
content-length
0
pixel.gif
a.mgid.com/ 		43 B
184 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.mgid.com/pixel.gif?utm_content=&utm_term=&utm_source=&utm_campaign=&utm_medium=&frpt=7d0f59b61276d3f472308830f16aae15
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:55 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
content-type
image/gif
cf-ray
89b9388728e08ed9-FRA
alt-svc
h3=":443"; ma=86400
modules.de6b9e294c29aa146ba1.js
script.hotjar.com/ 		223 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.de6b9e294c29aa146ba1.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2590724.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-19.fra56.r.cloudfront.net
Software
/
Resource Hash
743c4b93ab02f0ece15aa8bdb1f7b5d57e1753fe5ef6d320612ee0888e1196c6
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 10:29:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 8e83c42d247a31c5b365c08a0352d8f8.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
age
473808
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
56329
last-modified
Mon, 24 Jun 2024 10:28:38 GMT
etag
"008a76cf1200a93494425164a6546e72"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
V7GOvOLeIUJHmnxT6eyiC-3-zQRsV_fHwwhDaWwfYaR10gx0KhrgwQ==
2590724
vc.hotjar.io/sessions/ 		0
232 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vc.hotjar.io/sessions/2590724?s=0.25&r=0.006091002139822166
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.de6b9e294c29aa146ba1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-110.fra56.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
date
Sat, 29 Jun 2024 22:05:55 GMT
cache-control
no-store
via
1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P5
x-amz-cf-id
LBbDnZmpTubFcgfG5EhDtAEQztABCtHBcehZf1cBbptFqI5D66UB8g==
x-cache
Miss from cloudfront
favicon.png
cdn.mgid.com/images/tranzit/goods/mgid/ 		894 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://cdn.mgid.com/images/tranzit/goods/mgid/favicon.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1432e48edcac3dab5a49bf719452648a1efadb946d861710e4a8c5d8dea5e2c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://clck.mgid.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:56 GMT
x-amz-version-id
null
cf-cache-status
HIT
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-request-id
273YZYPZQSWDD2GP
age
7067
cf-polished
status=cannot_optimize
alt-svc
h3=":443"; ma=86400
content-length
894
x-amz-id-2
JfxH8x3YO7s300YhEXHMZCpP9rheAcx3aF0erFAoWeSljhF16TIsRj0TYozJ59QjHkqI5TtrXls=
cf-bgj
imgq:100,h2pri
last-modified
Mon, 04 May 2020 12:16:56 GMT
server
cloudflare
etag
"e3e36125c6eb56853057603b3ec92c2a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
89b9388a6c338ed9-FRA
expires
Sun, 30 Jun 2024 22:05:56 GMT
/
clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/tr/pp/1/1/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/tr/pp/1/1/?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM%2A&ph=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM%2A&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&pubsrcid=574551&tt=Direct&att=3&trt=4&k=1414833fc*f!fZBmCJAwfZBmCJA-ffMHwwf!fOJffKkfYfMjcuNTMxMjV8MTg%3Df%2C*f%2C*ffQf!faHR0cHM6Ly9jbGNrLm1naWQuY29tL2doaXRzLzE3NzY2MTcwL2kvNTc3NDY5MTIvMC9zcmMvNTc0NTUxL3BwLzEvMT9oPVl3NjV%24QzVHQ25UT1MtcTk0QjRZQ%2400WDR2X2Fa%242J%24TzBsODhWTlZaVTg4Y2NJb01oRXc4RFFIZFVhNEdiRlFEQXpGVjNlQnFGdWw0c1JyQm5mVU56NDhLWWFkRTFDQkRtdTZIb0FKMVlNKiZyaWQ9YzAxYmY2ZDUtMzY2My0xMWVmLTgxYjEtYzg0YmQ2ODM2NDI4JnR0PURpcmVjdCZhdHQ9MyZwdWJzcmNpZD01NzQ1NTEmY3BtPQ%3D%3DfaHR0cHM6Ly9oZWFsdGhtZWFsM%2454eXovfaHR0cHM6Ly9oZWFsdGhtZWFsM%2454eXovf*fMHww*DkwNnw2NzY%3Dff%2C*f!fcfMTh8Mjd8OTA1*DY3Ng%3D%3DfZAfS0f!f!fTW96aWxsY%2481LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChL%24FRNTCwgbGlrZ%24BHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2fUERGVmlld2Vy*ENocm9tZVBERlZpZXdlcnxDaHJvbWl1bVBERlZpZXdlcnxNaWNyb3NvZnRFZGdlUERGVmlld2Vy*FdlYktpdGJ1aWx0LWluUERGf!fV2luMzI%3DfMTIwfLTF8LTE%3DfMTYwMHwxMjAwfdW5rbm93bnw0Z3wwfm%24fm%24fQfUC2Grf*f*(lxSDc&grs=-5&kpgt=102
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.130.76 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/pp/1/1?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM*&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&tt=Direct&att=3&pubsrcid=574551&cpm=1&ct=1&st=120&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-arch
"x86"
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version
"126.0.6478.126"
sec-ch-ua-full-version-list
"Not/A)Brand";v="8.0.0.0", "Chromium";v="126.0.6478.126", "Google Chrome";v="126.0.6478.126"
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-platform
"Win32"
sec-ch-ua-platform-version
"10.0.0"
sec-ch-ua-wow64
?0

Response headers

accept-ch
sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-wow64,sec-ch-ua-bitness,sec-ch-ua-model
alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
89b9388a8c5c8ed9-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 29 Jun 2024 22:05:56 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
x-mg-click-uuid
2442ef3d-ebf6-5be4-4b19-091f51793c30
x-robots-tag
noindex
Primary Request /
fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/ 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Requested by
Host: clck.mgid.com
URL: https://clck.mgid.com/ghits/17766170/i/57746912/0/src/574551/tr/pp/1/1/?h=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM%2A&ph=Yw65RC5GCnTOS-q94B4YA-4X4v_aZKbRO0l88VNVZU88ccIoMhEw8DQHdUa4GbFQDAzFV3eBqFul4sRrBnfUNz48KYadE1CBDmu6HoAJ1YM%2A&h2=qCPrOVMpP3p_xyzIJH89aMBE2jaiK1qq8RJq43zft0v9gi8RcDJDngL3ZfMYfvqb&rid=c01bf6d5-3663-11ef-81b1-c84bd6836428&pubsrcid=574551&tt=Direct&att=3&trt=4&k=1414833fc*f!fZBmCJAwfZBmCJA-ffMHwwf!fOJffKkfYfMjcuNTMxMjV8MTg%3Df%2C*f%2C*ffQf!faHR0cHM6Ly9jbGNrLm1naWQuY29tL2doaXRzLzE3NzY2MTcwL2kvNTc3NDY5MTIvMC9zcmMvNTc0NTUxL3BwLzEvMT9oPVl3NjV%24QzVHQ25UT1MtcTk0QjRZQ%2400WDR2X2Fa%242J%24TzBsODhWTlZaVTg4Y2NJb01oRXc4RFFIZFVhNEdiRlFEQXpGVjNlQnFGdWw0c1JyQm5mVU56NDhLWWFkRTFDQkRtdTZIb0FKMVlNKiZyaWQ9YzAxYmY2ZDUtMzY2My0xMWVmLTgxYjEtYzg0YmQ2ODM2NDI4JnR0PURpcmVjdCZhdHQ9MyZwdWJzcmNpZD01NzQ1NTEmY3BtPQ%3D%3DfaHR0cHM6Ly9oZWFsdGhtZWFsM%2454eXovfaHR0cHM6Ly9oZWFsdGhtZWFsM%2454eXovf*fMHww*DkwNnw2NzY%3Dff%2C*f!fcfMTh8Mjd8OTA1*DY3Ng%3D%3DfZAfS0f!f!fTW96aWxsY%2481LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChL%24FRNTCwgbGlrZ%24BHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2fUERGVmlld2Vy*ENocm9tZVBERlZpZXdlcnxDaHJvbWl1bVBERlZpZXdlcnxNaWNyb3NvZnRFZGdlUERGVmlld2Vy*FdlYktpdGJ1aWx0LWluUERGf!fV2luMzI%3DfMTIwfLTF8LTE%3DfMTYwMHwxMjAwfdW5rbm93bnw0Z3wwfm%24fm%24fQfUC2Grf*f*(lxSDc&grs=-5&kpgt=102
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
cc314e5f23710a7a2a54089c8af7999179537f2f01fedcbdca87244217a9fe77
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://clck.mgid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
gzip
content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval' frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
content-type
text/html; charset=utf-8
date
Sat, 29 Jun 2024 22:05:56 GMT
etag
W/"667158bd-5ea"
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
referrer-policy
no-referrer-when-downgrade
server
Google Frontend
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 google
x-content-type-options
nosniff
x-xss-protection
1; mode=block
18736142230.js
cdn.optimizely.com/js/ 		325 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.optimizely.com/js/18736142230.js
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:889::13b8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0952ca2a6fe7665867e0d39e8538469f776598e60aa332269774f1997f7abab5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-meta-pci_enabled
False
x-amz-version-id
lCZyuNz_ekuUEQ046rF3IfVB5FmFPqYE
content-encoding
gzip
date
Sat, 29 Jun 2024 22:05:56 GMT
strict-transport-security
max-age=15768000
x-amz-request-id
WTEHJ6ZVTN9DTFQK
x-amz-server-side-encryption
AES256
x-amz-meta-revision
13072
x-amz-replication-status
PENDING
server-timing
cdn-cache; desc=HIT, edge; dur=3, origin; dur=0, cdn;desc="AkamaiION";dur=0,rtt;desc="6";dur=0,cdnip;desc="2a02:26f0:3500:889::13b8";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0, ak_p; desc="1719698756413_388276626_1292204436_268_1911_6_9_219";dur=1
content-length
98705
x-amz-id-2
afSkkeDYCRnyqmsY9VadwtKOqiiroySU82GlAGXtC2gFLjNdseMjuZziSZipyGV7m8kGPQJU6vU=
last-modified
Thu, 27 Jun 2024 13:26:13 GMT
server
AmazonS3
etag
"4290a26c577c1f6455fead0ff39f0cde"
vary
Accept-Encoding
access-control-max-age
86400
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
access-control-expose-headers
x-amz-meta-revision
cache-control
max-age=120
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
*
app.css
fragebogen.gutes-hoeren.de/f/css/ 		322 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/css/app.css
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
3cb9ceab6f19b74e6604cd7c87eff516f98a26227356ea20a6a360d9dbac0680
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
etag
W/"667158bd-509c7"
vary
Accept-Encoding
content-type
text/css
via
1.1 google
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
chunk-vendors-modern.js
fragebogen.gutes-hoeren.de/f/js/ 		345 KB
115 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/js/chunk-vendors-modern.js?h=e8c2bf62cb45aea8d897
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
ab4da33cd5df5a3079bc6b587d3859b5f26b4e850767a4ad03fa4e73d2befce0
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Origin
https://fragebogen.gutes-hoeren.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
etag
W/"667158bd-564e9"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
https://fragebogen.gutes-hoeren.de
cache-control
private
app-modern.js
fragebogen.gutes-hoeren.de/f/js/ 		201 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
2e75403797abb6753cbf906f296bbbcb79e4222fc0c4abbbf5e85f9d63bc8ac1
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Origin
https://fragebogen.gutes-hoeren.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
etag
W/"667158bd-3230f"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
https://fragebogen.gutes-hoeren.de
cache-control
private
widget.css
assets.calendly.com/assets/external/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.calendly.com/assets/external/widget.css
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/css/app.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:29af -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
fcb209ef6d7ca07243d60aa46a83865255672006c403b988209cfbb6eacf88a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/f/css/app.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:56 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
55
cf-polished
origSize=3459
last-modified
Fri, 28 Jun 2024 21:50:43 GMT
cf-bgj
minify
server
cloudflare
etag
W/"4818473200224c9f9497adef8d7685bc"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=300
cf-ray
89b9388c5e129750-FRA
expires
Sun, 30 Jun 2024 22:05:56 GMT
a18736142230.html
a18736142230.cdn.optimizely.com/client_storage/ Frame 936F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://a18736142230.cdn.optimizely.com/client_storage/a18736142230.html
Requested by
Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/18736142230.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.17.191.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-17-191-240.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
cache-control
max-age=120
content-encoding
gzip
content-length
911
content-type
text/html; charset=utf-8
date
Sat, 29 Jun 2024 22:05:56 GMT
etag
"b3eb11385a0bb633445b5414aae6fb58"
last-modified
Thu, 27 Jun 2024 13:26:06 GMT
server
AmazonS3
server-timing
cdn-cache; desc=HIT edge; dur=6 origin; dur=0 cdn;desc="AkamaiION";dur=0,rtt;desc="9";dur=0,cdnip;desc="2.17.191.240";dur=0,cdnmap;desc="a4343.a.akamaiedge.net";dur=0,proto;desc="h2";dur=0 ak_p; desc="1719698756576_34901878_128725607_638_1786_9_10_255";dur=1
strict-transport-security
max-age=15768000
vary
Accept-Encoding
x-akamai-transformed
9 - 0 pmb=mRUM,2
x-amz-id-2
x1JbsrpfSUIdEEA2Ed4sLBF7SYVlSPOcOcZNI0Nge2525Qrgspp+RA27ny18XpHtBh3rPaiiYfk=
x-amz-meta-pci_enabled
False
x-amz-replication-status
PENDING
x-amz-request-id
952DAG0Q5ZFHZMXT
x-amz-server-side-encryption
AES256
x-amz-version-id
AlZ1rONp11kt8MsOQN4nHObgSMAEY4ZC
gtm.js
www.googletagmanager.com/ 		456 KB
130 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NVF5QNTR
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 -, , ASN (),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
cca1e7c024c7d72ad9b337e40d8587c6783c6952faa2e933568ee2c9c04135c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
132354
x-xss-protection
0
last-modified
Sat, 29 Jun 2024 21:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 29 Jun 2024 22:05:56 GMT
lang-de-DE-json-modern.js
fragebogen.gutes-hoeren.de/f/js/ 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/js/lang-de-DE-json-modern.js?h=4c552a50cbcc63e7a840
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
530a21659fcb8c57c2de149f2ebbc685d7423c454fe45f0d57a57af1915525f0
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
etag
W/"667158bd-6d88"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 google
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
defer-modern.js
fragebogen.gutes-hoeren.de/f/js/ 		0
120 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/js/defer-modern.js?h=01df6be25587acb64f93
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
etag
W/"667158bd-6fa0b"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 google
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
defer.css
fragebogen.gutes-hoeren.de/f/css/ 		248 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/css/defer.css
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
897cdadf59f92dc0e15955c07b02c6cbae242d2c0618a76ab75fbc3ee3290fc5
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
etag
W/"667158bd-3de47"
vary
Accept-Encoding
content-type
text/css
via
1.1 google
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
defer-modern.js
fragebogen.gutes-hoeren.de/f/js/ 		447 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/js/defer-modern.js?h=01df6be25587acb64f93
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
9a1f4aa34357719818077046372e95e118854e2c11e37564dfe6a2cf551ed576
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
date
Sat, 29 Jun 2024 22:05:56 GMT
via
1.1 google
etag
W/"667158bd-6fa0b"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
hoergeraete-testen-mvp-gh-gen
fragebogen.gutes-hoeren.de/api/v1/forms/ 		39 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/api/v1/forms/hoergeraete-testen-mvp-gh-gen?env=
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/chunk-vendors-modern.js?h=e8c2bf62cb45aea8d897
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend / Express
Resource Hash
c6fbdde8789a31141a8215679f8decdf088a9edecb977f6271ed2f04b2a5daaf

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
via
1.1 google
server
Google Frontend
x-powered-by
Express
etag
W/"9ca4-Plg+w8KABUCa3PRb4hVGpNigXXA"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
cache-control
private
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
AvenirNextLTPro-Regular.ttf
static.sonova.xyz/fonts/AvenirNextLTPro-Regular/ 		210 KB
211 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.sonova.xyz/fonts/AvenirNextLTPro-Regular/AvenirNextLTPro-Regular.ttf
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/css/app.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.193.213 -, , ASN (),
Reverse DNS
Software
UploadServer /
Resource Hash
0f10523ff88e8d1983ae4e7cf38495601b75dd43eaea22b75f56032b80aecb1d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/f/css/app.css
Origin
https://fragebogen.gutes-hoeren.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 21:24:17 GMT
age
2499
x-guploader-uploadid
ACJd0Nq3k3MhjshFP2gdY7KJlUZWDnxFqiq7R97SkAhqkFKQunZL-FcMqgzulkoQb4laKcgKbLruJ6WKZQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
214960
last-modified
Tue, 24 Oct 2023 15:36:28 GMT
server
UploadServer
etag
"c76e69282abfe8441d022e1e03c4f6d7"
x-goog-generation
1698161788253932
x-goog-hash
crc32c=JYSkWA==, md5=x25pKCq/6EQdAi4eA8T21w==
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Request-Header, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-stored-content-length
214960
accept-ranges
bytes
content-type
font/ttf
expires
Sat, 29 Jun 2024 22:24:17 GMT
de-DE
fragebogen.gutes-hoeren.de/api/v1/translations/ 		23 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/api/v1/translations/de-DE
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/chunk-vendors-modern.js?h=e8c2bf62cb45aea8d897
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend / Express
Resource Hash
78de148e23d2a619b0176665c8587bf50b7fb08580d436b1e093cc774dabcd2e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
via
1.1 google
server
Google Frontend
x-powered-by
Express
etag
W/"5b54-m+hmd/KWD3s/Bdu46PtE/CLQrHs"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
cache-control
private
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cwc-components-modern.js
fragebogen.gutes-hoeren.de/f/js/ 		105 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fragebogen.gutes-hoeren.de/f/js/cwc-components-modern.js?h=fc2e0d143c7cb2850e10
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/app-modern.js?h=bc4eb6e7c29d17319710
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.143.69 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
69.143.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
73aafa18dc0e3e55cb5c19f05e66ce951627fec228e902e36422b5880373feac
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' https://*.hotjar.com wss://*.hotjar.com http: https: data: blob: 'unsafe-inline' 'unsafe-eval', frame-ancestors 'self' *.sonova.xyz *.optimizely.com *.geers.de *.gutes-hoeren.de *.hansaton.at *.hoerberatung.at *.bootshearingcare.com *.hearingclearer.co.uk *.audionova.dk *.geers.pl *.connecthearing.com *.hearbetternow.com *.elitehearingcenters.com
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 18 Jun 2024 09:51:57 GMT
server
Google Frontend
date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
etag
W/"667158bd-1a4f8"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 google
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
AvenirNextLTPro-Demi.ttf
static.sonova.xyz/fonts/AvenirNextLTPro-Demi/ 		195 KB
195 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.sonova.xyz/fonts/AvenirNextLTPro-Demi/AvenirNextLTPro-Demi.ttf
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/css/app.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.193.213 -, , ASN (),
Reverse DNS
Software
UploadServer /
Resource Hash
eadc9c8d2c8ae76b128a731509b0e262be476b22df7490a1418cecf03ee4a3f3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/f/css/app.css
Origin
https://fragebogen.gutes-hoeren.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 21:24:35 GMT
age
2481
x-guploader-uploadid
ACJd0NoO1uppGNZigViZ6x7CQCA9d-3REbg7dWN4aJnUmQYk6luxdToAFCozhYkZl16XhkeIGSJsHn6M1w
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
199216
last-modified
Tue, 24 Oct 2023 15:37:53 GMT
server
UploadServer
etag
"6dcf237e4238695d3a33dcf2c6d480e7"
x-goog-generation
1698161873341024
x-goog-hash
crc32c=qzCh+Q==, md5=bc8jfkI4aV06M9zyxtSA5w==
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Request-Header, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-stored-content-length
199216
accept-ranges
bytes
content-type
font/ttf
expires
Sat, 29 Jun 2024 22:24:35 GMT
Geers_LF_trust_icons_opt_1.svg
images.ctfassets.net/uafdk7px88ld/1OxINumaX1rfjyczTy1qZN/01bf6724627fbd969a19e5ac52ddeff7/ 		72 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.ctfassets.net/uafdk7px88ld/1OxINumaX1rfjyczTy1qZN/01bf6724627fbd969a19e5ac52ddeff7/Geers_LF_trust_icons_opt_1.svg
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:235a:7a00:12:94b3:c380:93a1 -, , ASN (),
Reverse DNS
Software
Contentful Images API /
Resource Hash
87792cef47ba10079b1e68aff038c574eb47680d5cd895d9d2bd9cddfe3860ae

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 03:19:47 GMT
content-encoding
gzip
via
1.1 2e8126aebd83e92e3cf50c4f9c832912.cloudfront.net (CloudFront)
last-modified
Wed, 08 Nov 2023 09:10:22 GMT
server
Contentful Images API
x-amz-cf-pop
FRA60-P9
age
67570
etag
W/"e1293c0d6d6e325e26c2301f2f0a1628"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-id
ZdChdq3eVqRc2V8wfHRQNsDMjY_F8XXUE9MhCQkrJyqsr69cQ3HeoA==
big-ghMask_group.svg
images.ctfassets.net/uafdk7px88ld/46Ex36TOXZ9dOWT1N0PB8p/436ce3575acd60827f14dc1bcda35bbc/ 		11 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.ctfassets.net/uafdk7px88ld/46Ex36TOXZ9dOWT1N0PB8p/436ce3575acd60827f14dc1bcda35bbc/big-ghMask_group.svg
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:235a:7a00:12:94b3:c380:93a1 -, , ASN (),
Reverse DNS
Software
Contentful Images API /
Resource Hash
62b282377fa774dfa3ae38527b2249e67ef1601f21778ee52247042f039c9f16

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 04:50:28 GMT
content-encoding
gzip
via
1.1 2e8126aebd83e92e3cf50c4f9c832912.cloudfront.net (CloudFront)
last-modified
Thu, 16 Feb 2023 15:48:18 GMT
server
Contentful Images API
x-amz-cf-pop
FRA60-P9
age
62129
etag
W/"7fee4ac4d941b35222c48a6b1e220f48"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-id
hOdMdgVeSo5GlS9oKEOfbnC6QBkFCfcOqhNP7fuRDlV9iOK5Oeaahg==
truncated
/ 		3 KB
3 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
36c553e9c825962cae71880c744828d237223b124f7c8a04a2d056e76e4dedf3

Request headers

Referer
Origin
https://fragebogen.gutes-hoeren.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ 		4 KB
4 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3211b5cc91377a0ca8ba76f1fcd6280394c35b9f3478dcc8e451aba5a06ae9ec

Request headers

Referer
Origin
https://fragebogen.gutes-hoeren.de
Accept-Language
de-DE,de;q=0.9;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/octet-stream
ppms.js
sonova.piwik.pro/ 		60 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sonova.piwik.pro/ppms.js
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2603:1020:c01:4::48 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
d780ea58706b7a21b1db69f47c3c575c1f952291cc7963ae7ea050e78d1b1e6b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 22:05:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=15768000
last-modified
Wed, 29 May 2024 11:49:19 GMT
referrer-policy
origin
etag
W/"6657163f-efb3"
vary
Accept-Encoding
x-frame-options
sameorigin
content-type
application/javascript
cache-control
max-age=21600
expires
Sun, 30 Jun 2024 04:05:56 GMT
cookie-consent.css
assets.sonova.xyz/gutes-hoeren/ 		20 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.sonova.xyz/gutes-hoeren/cookie-consent.css
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVF5QNTR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.16.210 -, , ASN (),
Reverse DNS
Software
Google Frontend /
Resource Hash
77df352895b03acfac14cc0482c8ff90bffb851fbd2ca05989af118181bb2007

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 21:59:31 GMT
content-encoding
gzip
via
1.1 google, 1.1 google
last-modified
Tue, 25 Jun 2024 09:52:04 GMT
server
Google Frontend
age
385
vary
Accept-Encoding
content-type
text/css
x-cloud-trace-context
2135334c1872231b83bfb02f976c258d
cache-control
max-age=600,public,no-transform
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4628
cookie-consent.js
assets.sonova.xyz/gutes-hoeren/ 		71 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.sonova.xyz/gutes-hoeren/cookie-consent.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVF5QNTR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.16.210 -, , ASN (),
Reverse DNS
Software
Google Frontend /
Resource Hash
3c46dd489e3db1d51604e3ba214ae5908086740ee714295cab8806e7998d68bf

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 29 Jun 2024 21:59:31 GMT
content-encoding
gzip
via
1.1 google, 1.1 google
last-modified
Tue, 25 Jun 2024 09:52:04 GMT
server
Google Frontend
age
385
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-cloud-trace-context
0c6fe6d6cc71873486b976fe9396f0a2
cache-control
max-age=600,public,no-transform
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18557
n6EZY-9If6SP6ACdatKI6FZ0ROCdI8f7m6FpcuHg.js
client.prod.mplat-ppcprotect.com/ 		62 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://client.prod.mplat-ppcprotect.com/n6EZY-9If6SP6ACdatKI6FZ0ROCdI8f7m6FpcuHg.js
Requested by
Host: healthmeal1.xyz
URL: https://healthmeal1.xyz/news/10701/?sid=2a7bceb6063e2fe9caff09a2afe90d5b_107_0_3005&h=JTdCJTIycmMlMjIlM0EwJTJDJTIyaGlkJTIyJTNBMSUyQyUyMnNpZCUyMiUzQSUyMiUyMiU3RA%3D%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2240:7800:7:4973:1b00:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8394769d7757405df19df18df888ad1c22751044a51074cf34d2537de7a6f824
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src * data:; object-src 'none'
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-version-id
e.oT1v_e6CQ5s6BQAMsfREVIVJjEtWZg
content-encoding
gzip
via
1.1 490f651effcacfa7d80143d3047d794e.cloudfront.net (CloudFront)
date
Sat, 29 Jun 2024 10:21:51 GMT
content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src * data:; object-src 'none'
x-amz-cf-pop
FRA60-P1
age
42460
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
last-modified
Wed, 08 May 2024 14:23:56 GMT
server
AmazonS3
etag
W/"4b96b5ee8568c035a0d832f046247d5c"
vary
Accept-Encoding, Origin
x-frame-options
SAMEORIGIN
content-type
text/js
x-amz-cf-id
rQr6vMRb3B-2G56MP-KwfFz4qbQaUJTY87rtlnvwim0_e9rJSBlVCQ==
Geers_LF_trust_icons_opt_1.svg
images.ctfassets.net/uafdk7px88ld/1OxINumaX1rfjyczTy1qZN/01bf6724627fbd969a19e5ac52ddeff7/ Frame B59C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://images.ctfassets.net/uafdk7px88ld/1OxINumaX1rfjyczTy1qZN/01bf6724627fbd969a19e5ac52ddeff7/Geers_LF_trust_icons_opt_1.svg
Requested by
Host: fragebogen.gutes-hoeren.de
URL: https://fragebogen.gutes-hoeren.de/f/js/chunk-vendors-modern.js?h=e8c2bf62cb45aea8d897
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:235a:7a00:12:94b3:c380:93a1 -, , ASN (),
Reverse DNS
Software
Contentful Images API /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
age
67570
cache-control
max-age=31536000
content-encoding
gzip
content-type
image/svg+xml
date
Sat, 29 Jun 2024 03:19:47 GMT
etag
W/"e1293c0d6d6e325e26c2301f2f0a1628"
last-modified
Wed, 08 Nov 2023 09:10:22 GMT
server
Contentful Images API
vary
Accept-Encoding
via
1.1 e1af02661708034e962bd39b357a50aa.cloudfront.net (CloudFront)
x-amz-cf-id
QWgREyfWtDngDY6-hzpTD0U95VffnX0GiV8fWs8gWpqOSNosd_MLhQ==
x-amz-cf-pop
FRA60-P9
x-cache
Hit from cloudfront
truncated
/ 		35 KB
35 KB 		Other
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d588b9f638ed3982aec3e3aad666ac5714b7a2369575733aa276601013b136fb

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/octet-stream
ppms.php
sonova.piwik.pro/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://sonova.piwik.pro/ppms.php
Requested by
Host: sonova.piwik.pro
URL: https://sonova.piwik.pro/ppms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2603:1020:c01:4::48 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://fragebogen.gutes-hoeren.de/hoergeraete-testen-mvp-gh-gen/?utm_medium=cpc&utm_source=mgid.com&utm_campaign=MVP_DE_GTH_ACQ_DIS_MGI_DES_STSA01_IMG_OCT1W23&utm_term=57746912s574551&utm_content=17766170&adclid=e8ac6106f9574a7a21b9b21fb6dec3eb
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=utf-8

Response headers
recv
pclick.prod.mplat-ppcprotect.com/ 		0
0
Mask_group.svg
images.ctfassets.net/uafdk7px88ld/2qSbcdaKFgErthvaocxQFc/cac2b65a56c9497c322fe4a42c9c5075/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pclick.prod.mplat-ppcprotect.com
URL
https://pclick.prod.mplat-ppcprotect.com/recv?data=eyJjbGllbnRfZGF0YSI6eyJocmVmIjoiaHR0cHM6Ly9mcmFnZWJvZ2VuLmd1dGVzLWhvZXJlbi5kZS9ob2VyZ2VyYWV0ZS10ZXN0ZW4tbXZwLWdoLWdlbi8_dXRtX21lZGl1bT1jcGMmdXRtX3NvdXJjZT1tZ2lkLmNvbSZ1dG1fY2FtcGFpZ249TVZQX0RFX0dUSF9BQ1FfRElTX01HSV9ERVNfU1RTQTAxX0lNR19PQ1QxVzIzJnV0bV90ZXJtPTU3NzQ2OTEyczU3NDU1MSZ1dG1fY29udGVudD0xNzc2NjE3MCZhZGNsaWQ9ZThhYzYxMDZmOTU3NGE3YTIxYjliMjFmYjZkZWMzZWIiLCJ0b2tlbiI6ImV5SjBlWEFpT2lKS1YxUWlMQ0poYkdjaU9pSklVekkxTmlKOS5leUpoWTJOdmRXNTBYMmxrSWpveE5qYzFOMzAuYnoybjZFWlktOUlmNlNQNkFDZGF0S0k2RlowUk9DZEk4ZjdtNkZwY3VIZyJ9fQ
Domain
images.ctfassets.net
URL
https://images.ctfassets.net/uafdk7px88ld/2qSbcdaKFgErthvaocxQFc/cac2b65a56c9497c322fe4a42c9c5075/Mask_group.svg

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage undefined| _ object| optimizely

12 Cookies

Domain/Path Name / Value
.mgid.com/ Name: __cf_bm
Value: kL2cQKguNdCuPVHXO3NGu3OdZgKz16v7kocCizT13wI-1719698753-1.0.1.1-IIFbiQlkgqBlDTFooxaI6hd2Qcx96LXMs.cjCVvxflFQMQCqL95bOuCFDD1hl.QF0rqWwY5Foj8fWZS_fkBYrw
healthmeal1.xyz/ Name: sid
Value: qqf8tutptfb32a06quc23o9sl1
clck.mgid.com/ Name: MgidStorage
Value: %7B%220%22%3A%7B%22svspr%22%3A%22https%3A%2F%2Fhealthmeal1.xyz%2F%22%2C%22svsds%22%3A1%7D%2C%22206%22%3A%7B%7D%7D
clck.mgid.com/ Name: frpt
Value: 7d0f59b61276d3f472308830f16aae15
.mgid.com/ Name: _hjSessionUser_2590724
Value: eyJpZCI6IjJlNjNkOTI3LWE0ZDItNTk2Yi1iODg0LTgxNjFkNWE4NzVhMSIsImNyZWF0ZWQiOjE3MTk2OTg3NTU3NzYsImV4aXN0aW5nIjpmYWxzZX0=
.mgid.com/ Name: _hjSession_2590724
Value: eyJpZCI6IjdlOTkwNDJhLTQ2MWEtNGQzZi1hMTQ0LTdhYmUwYjI4ZmQwYiIsImMiOjE3MTk2OTg3NTU3NzYsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MX0=
.mgid.com/ Name: mgid
Value: 17766170
.mgid.com/ Name: mtid
Value: 57746912
.mgid.com/ Name: mtuid
Value: 57746912s574551
.mgid.com/ Name: mstatus
Value: 0
.mgid.com/ Name: mghd
Value: fragebogen.gutes-hoeren.de
.gutes-hoeren.de/ Name: optimizelyEndUserId
Value: oeu1719698756484r0.5189195156576107

1 Console Messages

Source Level URL
Text
network error URL: https://healthmeal1.xyz/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mgid.com
a18736142230.cdn.optimizely.com
adrta.com
assets.calendly.com
assets.sonova.xyz
c.mgid.com
cdn.mgid.com
cdn.optimizely.com
clck.mgid.com
client.prod.mplat-ppcprotect.com
fonts.googleapis.com
fonts.gstatic.com
fragebogen.gutes-hoeren.de
freetrckr.com
healthmeal1.xyz
images.ctfassets.net
ipds.adrta.com
pclick.prod.mplat-ppcprotect.com
roselocation5.xyz
s-img.mgid.com
script.hotjar.com
sonova.piwik.pro
static.hotjar.com
static.sonova.xyz
vc.hotjar.io
www.googletagmanager.com
xml.pushking.net
images.ctfassets.net
pclick.prod.mplat-ppcprotect.com
104.19.130.76
13.32.27.19
173.214.240.15
18.66.102.106
18.66.112.110
199.182.164.180
2.17.191.240
2600:1f18:26d4:7e06:11e9:bb92:d06f:e2ac
2600:9000:2240:7800:7:4973:1b00:93a1
2600:9000:235a:7a00:12:94b3:c380:93a1
2603:1020:c01:4::48
2606:4700:4400::6812:29af
2a00:1450:4001:802::200a
2a00:1450:4001:827::2008
2a00:1450:4001:829::2003
2a02:26f0:3500:889::13b8
34.102.193.213
34.111.16.210
34.117.143.69
52.86.19.188
0952ca2a6fe7665867e0d39e8538469f776598e60aa332269774f1997f7abab5
0f10523ff88e8d1983ae4e7cf38495601b75dd43eaea22b75f56032b80aecb1d
2e75403797abb6753cbf906f296bbbcb79e4222fc0c4abbbf5e85f9d63bc8ac1
3211b5cc91377a0ca8ba76f1fcd6280394c35b9f3478dcc8e451aba5a06ae9ec
36022956bb18d895882e1f1734d730035bf0945801c55cb62883c9737a2811d1
36c553e9c825962cae71880c744828d237223b124f7c8a04a2d056e76e4dedf3
3c46dd489e3db1d51604e3ba214ae5908086740ee714295cab8806e7998d68bf
3cb9ceab6f19b74e6604cd7c87eff516f98a26227356ea20a6a360d9dbac0680
455c0cf3199c0d5eac170509b804776e1f18fb6c131f691660bf27a3952a335f
48e4f0ed3c0b81ff9b45fbd5efee71582d8602a5d4addf336a881b2c94f5d5e0
530a21659fcb8c57c2de149f2ebbc685d7423c454fe45f0d57a57af1915525f0
62b282377fa774dfa3ae38527b2249e67ef1601f21778ee52247042f039c9f16
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
717636abadd7f9d6080c74ddee55c83fd0f491b6c9ce3ffe40fac09a4e0094c5
73aafa18dc0e3e55cb5c19f05e66ce951627fec228e902e36422b5880373feac
743c4b93ab02f0ece15aa8bdb1f7b5d57e1753fe5ef6d320612ee0888e1196c6
77df352895b03acfac14cc0482c8ff90bffb851fbd2ca05989af118181bb2007
78de148e23d2a619b0176665c8587bf50b7fb08580d436b1e093cc774dabcd2e
7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402
8394769d7757405df19df18df888ad1c22751044a51074cf34d2537de7a6f824
85a2c1e232d431bc16f02193ceb8fcd82e9f20798ab430dffb12e2da41b0ca1b
87792cef47ba10079b1e68aff038c574eb47680d5cd895d9d2bd9cddfe3860ae
897cdadf59f92dc0e15955c07b02c6cbae242d2c0618a76ab75fbc3ee3290fc5
9a1f4aa34357719818077046372e95e118854e2c11e37564dfe6a2cf551ed576
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a98c4f22c9c8dc6a974276ebf08497fdf1b5d12d581f9a29c83a22ff8801170f
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aaf2f58682f990cd6895432eeb0e77ef17a2a17c797d38838520c9d87a220b66
ab4da33cd5df5a3079bc6b587d3859b5f26b4e850767a4ad03fa4e73d2befce0
be116044395764d98debc9eda1fac8540647b8347e7b9f1855ce952a6ede626e
c1432e48edcac3dab5a49bf719452648a1efadb946d861710e4a8c5d8dea5e2c
c6fbdde8789a31141a8215679f8decdf088a9edecb977f6271ed2f04b2a5daaf
cc314e5f23710a7a2a54089c8af7999179537f2f01fedcbdca87244217a9fe77
cca1e7c024c7d72ad9b337e40d8587c6783c6952faa2e933568ee2c9c04135c3
d588b9f638ed3982aec3e3aad666ac5714b7a2369575733aa276601013b136fb
d780ea58706b7a21b1db69f47c3c575c1f952291cc7963ae7ea050e78d1b1e6b
d790fcf7971fab33bec635cc6471e185497936cb2a73e2d6b72d1ad036e32da5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eadc9c8d2c8ae76b128a731509b0e262be476b22df7490a1418cecf03ee4a3f3
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fcb209ef6d7ca07243d60aa46a83865255672006c403b988209cfbb6eacf88a6