mestreemfinancas.com Open in urlscan Pro
108.179.193.123 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://supertrabalhocom.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZsaW5rLm1lc3RyZWVtZmluYW5jYXMuY29tJTJGbCUyRjQ0OT...
Effective URL:
https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Submission: On March 22 via manual (March 22nd 2023, 8:13:42 pm UTC) from BR — Scanned from DE

Summary HTTP 219 Redirects Behaviour Indicators

Summary

This website contacted 45 IPs in 7 countries across 40 domains to perform 219 HTTP transactions. The main IP is 108.179.193.123, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is mestreemfinancas.com.
TLS certificate: Issued by R3 on March 8th 2023. Valid for: 3 months.

This is the only time mestreemfinancas.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.205.51.31 54.205.51.31	14618 (AMAZON-AES) (AMAZON-AES)
1 1	137.184.92.206 137.184.92.206	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
30	108.179.193.123 108.179.193.123	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
5	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
2	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1 6	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
4 19	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
3 8	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
30	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700:10:... 2606:4700:10::ac43:266a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:9000:225... 2600:9000:2250:2c00:a:e047:752:b361	16509 (AMAZON-02) (AMAZON-02)
1	2600:1901:0:7... 2600:1901:0:76b9::	15169 (GOOGLE) (GOOGLE)
8	2606:4700:20:... 2606:4700:20::681a:bd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
19	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1 2	34.120.135.53 34.120.135.53	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	162.19.138.119 162.19.138.119	16276 (OVH) (OVH)
1	2620:116:800d... 2620:116:800d:21:de2e:c7b3:55c0:d5a0	16509 (AMAZON-02) (AMAZON-02)
1 1	185.29.134.244 185.29.134.244	30419 (MEDIAMATH...) (MEDIAMATH-INC)
3 3	18.194.91.195 18.194.91.195	16509 (AMAZON-02) (AMAZON-02)
3 5	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
3 3	76.223.111.18 76.223.111.18	16509 (AMAZON-02) (AMAZON-02)
2	185.86.138.151 185.86.138.151	201081 (SMARTADSE...) (SMARTADSERVER)
3 3	3.75.62.37 3.75.62.37	16509 (AMAZON-02) (AMAZON-02)
1 2	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2606:4700:20:... 2606:4700:20::ac43:4a81	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	178.250.1.11 178.250.1.11	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 4	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
1	18.132.110.241 18.132.110.241	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:80b::2006	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
1 1	35.204.158.49 35.204.158.49	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	213.155.156.164 213.155.156.164	1299 (TWELVE99 ...) (TWELVE99 Arelion)
1 2	23.213.169.115 23.213.169.115	16625 (AKAMAI-AS) (AKAMAI-AS)
6	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	13.32.145.6 13.32.145.6	16509 (AMAZON-02) (AMAZON-02)
1	18.64.141.41 18.64.141.41	16509 (AMAZON-02) (AMAZON-02)
2	13.40.90.84 13.40.90.84	16509 (AMAZON-02) (AMAZON-02)
219	45

1 54.205.51.31 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-51-31.compute-1.amazonaws.com

supertrabalhocom.lt.acemlnb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 137.184.92.206 (Santa Clara, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: quiz.dmcleads.com

link.mestreemfinancas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 108.179.193.123 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 108-179-193-123.unifiedlayer.com

mestreemfinancas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

script.joinads.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.250.185.66 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:2c00:a:e047:752:b361 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:76b9:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

prod-rtb.ad4mat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:20::681a:bd1 (United States)

ASN13335 (CLOUDFLARENET, US)

as.ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.135.53 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.119 (France)

ASN16276 (OVH, FR)
PTR: ns31533570.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:de2e:c7b3:55c0:d5a0 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.134.244 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.194.91.195 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-91-195.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.80.39.216 (Canada) 3 redirects

ASN27381 (CASALE-MEDIA, CA)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.223.111.18 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.86.138.151 (France)

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.75.62.37 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::ac43:4a81 (United States)

ASN13335 (CLOUDFLARENET, US)

ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.1.11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.89.210.46 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.132.110.241 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-132-110-241.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80b::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.158.49 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.158.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.164 (Sweden) 2 redirects

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)
PTR: 213-155-156-164.teliacarrier-cust.com

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.213.169.115 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-213-169-115.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.145.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-145-6.cdg50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.64.141.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-64-141-41.mct50.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.40.90.84 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-40-90-84.eu-west-2.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
38	googlesyndication.com 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 135 pagead2.googlesyndication.com — Cisco Umbrella Rank: 108	193 KB
33	doubleclick.net 5 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 190 googleads.g.doubleclick.net — Cisco Umbrella Rank: 29 cm.g.doubleclick.net — Cisco Umbrella Rank: 206	267 KB
31	mestreemfinancas.com 1 redirects link.mestreemfinancas.com mestreemfinancas.com	549 KB
30	facebook.com www.facebook.com — Cisco Umbrella Rank: 109	950 B
12	facebook.net connect.facebook.net — Cisco Umbrella Rank: 147	1 MB
10	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 396	218 KB
10	ad4m.at as.ad4m.at — Cisco Umbrella Rank: 27355 ad4m.at — Cisco Umbrella Rank: 9742 assets.ad4m.at — Cisco Umbrella Rank: 36404	160 KB
9	google.com 3 redirects adservice.google.com — Cisco Umbrella Rank: 68 www.google.com — Cisco Umbrella Rank: 2	2 KB
9	gstatic.com fonts.gstatic.com www.gstatic.com	355 KB
5	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 283	124 KB
5	casalemedia.com 3 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 431 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 535	4 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	5 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	4 KB
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 17650 api.webgains.io — Cisco Umbrella Rank: 49415	32 KB
3	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 392 mug.criteo.com — Cisco Umbrella Rank: 2797	7 KB
3	yahoo.com 3 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 277	1 KB
3	3lift.com 3 redirects eb2.3lift.com — Cisco Umbrella Rank: 352	1 KB
3	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 297	1 KB
3	openx.net 1 redirects oajs.openx.net — Cisco Umbrella Rank: 2722 google-bidout-d.openx.net — Cisco Umbrella Rank: 2668	749 B
3	google.de adservice.google.de — Cisco Umbrella Rank: 8820 www.google.de — Cisco Umbrella Rank: 6058	1 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	174 KB
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1227	458 B
2	de17a.com 2 redirects d5p.de17a.com — Cisco Umbrella Rank: 4619	647 B
2	smartadserver.com ssbsync.smartadserver.com — Cisco Umbrella Rank: 732	150 B
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 187	97 KB
2	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 924 id5-sync.com — Cisco Umbrella Rank: 414	17 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 25	20 KB
2	joinads.me script.joinads.me	2 KB
1	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 44928	15 KB
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 740	710 B
1	webgains.com track.webgains.com — Cisco Umbrella Rank: 37605	2 KB
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 470	873 B
1	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 660	464 B
1	ad4mat.net prod-rtb.ad4mat.net — Cisco Umbrella Rank: 104152
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 3187	2 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 642	13 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2922	8 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 334	1 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 168	2 KB
1	acemlnb.com 1 redirects supertrabalhocom.lt.acemlnb.com	205 B
219	40

	Domain	Requested by
30	www.facebook.com	mestreemfinancas.com
30	mestreemfinancas.com	mestreemfinancas.com
19	pagead2.googlesyndication.com	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com mestreemfinancas.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net securepubads.g.doubleclick.net
17	cm.g.doubleclick.net	4 redirects mestreemfinancas.com 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com googleads.g.doubleclick.net
16	tpc.googlesyndication.com	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com mestreemfinancas.com tpc.googlesyndication.com securepubads.g.doubleclick.net s0.2mdn.net
12	connect.facebook.net	mestreemfinancas.com connect.facebook.net
10	cdn.ampproject.org	securepubads.g.doubleclick.net
10	securepubads.g.doubleclick.net	mestreemfinancas.com securepubads.g.doubleclick.net
8	www.google.com	3 redirects mestreemfinancas.com 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com tpc.googlesyndication.com
6	www.gstatic.com	s0.2mdn.net script.joinads.me
6	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com mestreemfinancas.com pagead2.googlesyndication.com
5	s0.2mdn.net	mestreemfinancas.com s0.2mdn.net
5	fonts.googleapis.com	mestreemfinancas.com 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com securepubads.g.doubleclick.net s0.2mdn.net
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	ad4m.at	as.ad4m.at ad4m.at
4	as.ad4m.at	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com as.ad4m.at ad4m.at
3	dsum-sec.casalemedia.com	1 redirects googleads.g.doubleclick.net
3	ups.analytics.yahoo.com	3 redirects
3	eb2.3lift.com	3 redirects
3	x.bidswitch.net	3 redirects
3	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagmanager.com	mestreemfinancas.com www.googletagmanager.com
2	api.webgains.io	analytics.webgains.io
2	sync.teads.tv	1 redirects 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
2	d5p.de17a.com	2 redirects
2	assets.ad4m.at	as.ad4m.at
2	gum.criteo.com	1 redirects static.criteo.net
2	ssbsync.smartadserver.com	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
2	ssum-sec.casalemedia.com	2 redirects
2	oajs.openx.net	1 redirects mestreemfinancas.com
2	www.googletagservices.com	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com mestreemfinancas.com
2	www.google.de	mestreemfinancas.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	script.joinads.me	mestreemfinancas.com script.joinads.me
1	cdn.track.production.webgains.team	as.ad4m.at
1	analytics.webgains.io	track.webgains.com
1	um.simpli.fi	1 redirects
1	track.webgains.com	as.ad4m.at
1	google-bidout-d.openx.net	oa.openxcdn.net
1	mug.criteo.com	mestreemfinancas.com
1	sync.mathtag.com	1 redirects
1	cms.quantserve.com	64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
1	id5-sync.com	cdn.id5-sync.com
1	prod-rtb.ad4mat.net	mestreemfinancas.com
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	cdn.id5-sync.com	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	cdn.jsdelivr.net	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	www.googleadservices.com	www.googletagmanager.com
1	link.mestreemfinancas.com	1 redirects
1	supertrabalhocom.lt.acemlnb.com	1 redirects
219	55

This site contains no links.

Subject Issuer	Validity	Valid
mestreemfinancas.com R3	`2023-03-08` - `2023-06-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.joinads.me E1	`2023-02-19` - `2023-05-20`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-01-10` - `2023-03-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-01-29` - `2023-04-29`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-15`	3 months	crt.sh
cdn.prod.uidapi.com R3	`2023-02-25` - `2023-05-26`	3 months	crt.sh
prod-rtb.ad4mat.net GTS CA 1D4	`2023-02-11` - `2023-05-12`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.id5-sync.com R3	`2023-01-25` - `2023-04-25`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-09` - `2023-06-03`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.webgains.com Amazon RSA 2048 M01	`2023-02-22` - `2023-07-13`	5 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2023-03-06` - `2023-05-29`	3 months	crt.sh
*.webgains.io Amazon RSA 2048 M02	`2023-03-02` - `2023-09-21`	7 months	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M01	`2023-02-28` - `2023-10-28`	8 months	crt.sh

This page contains 30 frames:

Primary Page: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Frame ID: C026A1F4213B5909471B01C89606A296
Requests: 102 HTTP requests in this frame

Frame: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 6FFB6772A0D48C89327A2B9D5ABF2C9D
Requests: 1 HTTP requests in this frame

Frame: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 41BD6FAFAE1A0556663D88218274F65E
Requests: 8 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/dr?ed=1hcbfjy1vdjj910zknwf3n0jm31nzd7myk1v091cpvj0gzw3s37h36czzb2c45457nny4b0bxa607jckhvhqzy001q331hgs7q44734m2j14qy5mdzgg9s398zbpvxjsckez67mf429wvcp26jcv86228b7b53jndjj0xhc8t6qzbphb3gd8x6n47jw6e5ehvs695vc0ct3vhjfz2ym5khh563phkeffx2cv9eqc56kr2jkpt41dy55ggaetdx37hkz3nhtm0tkn45555rmdew0mhp26nx684hd23fc60ydmmtqwnsjvb07spk89qwpczhsthqfzs8jgwk3zfem6z844qcw55z70mwya0ecr5q4k9sm78s6nzwk14g6cha2karsbqseg4ytyvbtxfp0eer2m8pq8170823c6hwygt72bwk1npdsbbf5h4sgkeq651k4skgwm0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%26client%3Dca-pub-4894209870857905%26adurl%3D
Frame ID: 0C7A44CA090C040B2FEBA0D2E0523B63
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 1056978948BF63808993CD4ADF5DFA69
Requests: 9 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=mestreemfinancas.com
Frame ID: A5DF8BFF46827D814CC5FF4860BBE6F1
Requests: 2 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: 3A91D5B379D779E8B8C1C783789E4F16
Requests: 1 HTTP requests in this frame

Frame: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 0DD235B77018B5A1431B9AF9BC2E9D69
Requests: 3 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
Frame ID: 6F506AF9E7A7D924F549BF386226F2BE
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO6mwc4CEKHd9pAEGIOY-uEBMAE&v=APEucNWMFdPZb4k3V_mR6SmzsSnNN9TeJlNLBOF0-7aBGIH-lUYTxHGz5W99_Z021XlgI5J5fsLSt3gqZ5VVAEi3hpj7gbPB7IfVR6a8ByUvLIpc-WVE7rd0DbWydiArOJwhv9SLA6HpMBS9Gs4_LBKlMclZi8aNy1J0zy4Nl1BZRKAwciF6DWs
Frame ID: C7749E32F82CB322ADE863D5E7F4818A
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 6497C66D229583B3013AF39675F4BAD5
Requests: 16 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: C67F8D8744766925136E6237DF5FE946
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012302271541000/amp4ads-v0.mjs
Frame ID: 17D0EA612F46C442BA20A93A81F7B377
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 40CE28973CDE3D682EA689F48D2E4A07
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 3FBBEB0A510D91FAA228C6D44EF45CAD
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/index.html?e=69&leftOffset=0&topOffset=0&c=NFbU44Mfth&t=1&renderingType=2&ev=01_247
Frame ID: 6526CF2F37C44177E0290BB3611CBC49
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012302271541000/amp4ads-v0.mjs
Frame ID: AFB70C22F13A321467C4DE3DA2886E7B
Requests: 14 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/h7crsjCj0IX-282TYmrQfY-rOnXNYj6L0RJU8oUOaW4.js
Frame ID: EDF99F60A82F8771E778F86E01DE66C0
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: A02200C2C097C92C939CC2FE18CC4DAC
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: BF5388743BFA872F419257EB8333EF49
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4B92387941B8B11C203966D648A0DD41
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4438DE078B149F138C5EC064DE41C538
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 966E5B0F68FA742430C722566E5E8434
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: FDAB13D208AAFCAFA6E10A802F886A6E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: A4E6D5514ADBE48810E5E6555FEDE443
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 706BAD8982159E35425829C82765E6C3
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 8A52C9AA553EF0BBE118580A26195EC1
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: DB3A29176473890BD3BEC1778E1EA7D7
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: CEBD1CE440C78060F89A6476473290AF
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 5570E9327DA13D9379EDF32265375C82
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

e-FGTS-calamidade - Mestre em Financas

Page URL History Show full URLs

https://supertrabalhocom.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZsaW5rLm1lc3RyZWVtZmluYW5jYX... HTTP 302
https://link.mestreemfinancas.com/l/4496 HTTP 302
https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Firebase (Databases) Expand

Overall confidence: 100%
Detected patterns

/firebasejs/([\d.]+)/firebase

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

219
Requests

91 %
HTTPS

56 %
IPv6

40
Domains

55
Subdomains

45
IPs

7
Countries

3396 kB
Transfer

9551 kB
Size

30
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://supertrabalhocom.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZsaW5rLm1lc3RyZWVtZmluYW5jYXMuY29tJTJGbCUyRjQ0OTY=&sig=8qf4s8Um5XJoyorV3ncudUYxSyvzafdeFeaWYd5GDgxr&iat=1679484462&a=%7C%7C68355762%7C%7C&account=supertrabalhocom.activehosted.com&email=5qWP2PgIrOm8WhEHMHGUyQlBbB7D72b18UsxdNzCqD2I1IaHBC6v%3Ap2PB5nGb8cTV%2FM7tQdpz9OC8nSvsfT%2BY&s=1cdf428d0b5f5edcd2165476855a2c6a&i=1091A1093A6A3636 HTTP 302
https://link.mestreemfinancas.com/l/4496 HTTP 302
https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 53

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&label=sgBQCMy6kYMYEKj628Uo&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&gtm_ee=1&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=cGEbZKqEOPCV7_UPnIeZwAo&sscte=1&crd=&pscrd=Ek5DaEVJOE03cW9BWVF6dWF3eUp6QXUtN0lBUklsQUNTQVFjXzYzTEFZQ3dsdGNQT0xkMENBaC1pTFl3OHI3dVhKTTZ2WUwzMEhCcjdGUUEaWENoRUk4TTdxb0FZUXg2bWw5TDJtNzVQaEFSSXRBQjdPd2N1QnhPcEEybGdxRTNYMDlMSWNQNkVNVU41Z1ZRYTFuR1hJN3JVQ3VPUjdpekxhNXhTd2IzVVA HTTP 302
https://www.google.com/pagead/1p-conversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&label=sgBQCMy6kYMYEKj628Uo&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&gtm_ee=1&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE03cW9BWVF6dWF3eUp6QXUtN0lBUklsQUNTQVFjXzYzTEFZQ3dsdGNQT0xkMENBaC1pTFl3OHI3dVhKTTZ2WUwzMEhCcjdGUUEaWENoRUk4TTdxb0FZUXg2bWw5TDJtNzVQaEFSSXRBQjdPd2N1QnhPcEEybGdxRTNYMDlMSWNQNkVNVU41Z1ZRYTFuR1hJN3JVQ3VPUjdpekxhNXhTd2IzVVA&is_vtc=1&ocp_id=cGEbZKqEOPCV7_UPnIeZwAo&cid=CAQSKQDUE5ymyxg-j9LFgOpdAmSIuTOKsZ0kHmtqcG5k6xbMTTgvuQk250B5&random=1001367338 HTTP 302
https://www.google.de/pagead/1p-conversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&label=sgBQCMy6kYMYEKj628Uo&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&gtm_ee=1&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE03cW9BWVF6dWF3eUp6QXUtN0lBUklsQUNTQVFjXzYzTEFZQ3dsdGNQT0xkMENBaC1pTFl3OHI3dVhKTTZ2WUwzMEhCcjdGUUEaWENoRUk4TTdxb0FZUXg2bWw5TDJtNzVQaEFSSXRBQjdPd2N1QnhPcEEybGdxRTNYMDlMSWNQNkVNVU41Z1ZRYTFuR1hJN3JVQ3VPUjdpekxhNXhTd2IzVVA&is_vtc=1&ocp_id=cGEbZKqEOPCV7_UPnIeZwAo&cid=CAQSKQDUE5ymyxg-j9LFgOpdAmSIuTOKsZ0kHmtqcG5k6xbMTTgvuQk250B5&random=1001367338&ipr=y&prhg=0

Request Chain 74

https://oajs.openx.net/esp?url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rid=esp&cc=1

Request Chain 77

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENWG3yLR9vcmN8sPBlSOJrg&google_cver=1&google_push=Aer7DvK9Kid--vrtSmNTISUpBY_lsbOPpz7FRdT-bZgltxEB6DOA0Zrdh1P7WlwadTiiHaQlJvvQZ7PEXzhEMyZlu_PBSePDu8Rk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aer7DvK9Kid--vrtSmNTISUpBY_lsbOPpz7FRdT-bZgltxEB6DOA0Zrdh1P7WlwadTiiHaQlJvvQZ7PEXzhEMyZlu_PBSePDu8Rk

Request Chain 78

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFHacESBa9LZB4cu7ALGR1g&google_cver=1&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEFHacESBa9LZB4cu7ALGR1g&google_cver=1&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s&google_hm=_8lzMQPTROqSvSgEw17eJw==

Request Chain 79

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_cver=1&google_push=Aer7DvJIfYJXp1WKTSG_E1L8wlhjSTHKwE3wcvSs5FOFwEoz4dN9KuoztW5XkfqB2Om40mPDtY8jCupNRfEy7WuuCr1b2zJWCz7p HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_push=Aer7DvJIfYJXp1WKTSG_E1L8wlhjSTHKwE3wcvSs5FOFwEoz4dN9KuoztW5XkfqB2Om40mPDtY8jCupNRfEy7WuuCr1b2zJWCz7p&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_hm=ZBthcWIeQ4bq5WCgpmqk8AAADL4AAAIB&google_nid=index&google_push=Aer7DvJIfYJXp1WKTSG_E1L8wlhjSTHKwE3wcvSs5FOFwEoz4dN9KuoztW5XkfqB2Om40mPDtY8jCupNRfEy7WuuCr1b2zJWCz7p

Request Chain 80

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEPQ9Vt6yOBmtN8_7Mbxy7Og&google_cver=1&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWULM HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWULM&google_gid=CAESEPQ9Vt6yOBmtN8_7Mbxy7Og HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWULM

Request Chain 82

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECBpr8EsZWMuXFrhGJU6T7w&google_cver=1&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezvjdwy4tsCUjOpRmqsI9T0UF2_OQxg HTTP 302
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECBpr8EsZWMuXFrhGJU6T7w&google_cver=1&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezvjdwy4tsCUjOpRmqsI9T0UF2_OQxg&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezvjdwy4tsCUjOpRmqsI9T0UF2_OQxg

Request Chain 91

https://gum.criteo.com/sid/json?origin=publishertagids&domain=mestreemfinancas.com&sn=ChromeSyncframe&so=0&topUrl=mestreemfinancas.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=FtT38nx2RWNFT09uVHp6bUkxU2xsWG5Pb1lBc0x2Z1pRcDN6dGNrQnV1WHlPakxYaFA5MkpPMUdLdGp1Qm9sSG1tQkgzcUhFQ28vVlhDaUtGRk5wZDdsVnZsZnhjNlgzbXhONUNVTTh5TURqWGljVWZ3bDBJUEF6SDFITWMzZEt5YzVxZ2hwelFCRCtBOEsyUW42RUVKN0FKaWF2MWU4eGQvVUV1WDYwRk9WT3M3b3BGL0ZrMDM2bnZMVEpCS0pOem45bjVhMnFmTHJQVlVBNzB6WVk1aGJKK1gxT3dKWWJCNGZPMHA2K0FWSU1RYy91QTJlUVNaMTlCVkpJTXNVdDMyMlBpTFduTncrTWVmS0pMbUR0dmpPTUZYb2pMMm93Rzg0VlhOaFJ3a0RxV2Radz18&cppv=2

Request Chain 108

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1

Request Chain 109

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZBthcWIeQ4bq5WCgpmqk8AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1

Request Chain 110

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEJoYoGqBHFUYmlv33odD--g&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJoYoGqBHFUYmlv33odD--g%26google_cver%3D1

Request Chain 111

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4NzAwODk0NTI3NTU0NjQzOQ%3D%3D

Request Chain 134

https://um.simpli.fi/gp_match?google_gid=CAESEIdLS4Q25EGq5G0nromIWvU&google_cver=1&google_push=Aa02lx_sLRWiJbhshlmeCYx4zGgH2yAlEH8zLALJdHs1hl9FqLK0q0wuXi9gPc9Bg2tSfKIi4xPRwvt8_IPM9NP3yfGwn4Jjct5O HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=8D431E48F41945A3B08D5BBA80021651&google_push=Aa02lx_sLRWiJbhshlmeCYx4zGgH2yAlEH8zLALJdHs1hl9FqLK0q0wuXi9gPc9Bg2tSfKIi4xPRwvt8_IPM9NP3yfGwn4Jjct5O

Request Chain 135

https://d5p.de17a.com/cookies/google?google_gid=CAESEDkuQP3fxM7KVEnHl2oVvVo&google_cver=1&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVVvvOSH HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEDkuQP3fxM7KVEnHl2oVvVo&google_cver=1&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVVvvOSH HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVVvvOSH

Request Chain 136

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELaox9ZuBFQfqS-T_kdCZsc&google_cver=1&google_push=Aa02lx8imCpmnmxSOq7MBxbTJmlFSZJ95J9wfyp91xdDS9fd4cVxlxipA7fGiri0ejNYUcl-owNVSpfHIujfR2eRibZSVHG-OEsc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aa02lx8imCpmnmxSOq7MBxbTJmlFSZJ95J9wfyp91xdDS9fd4cVxlxipA7fGiri0ejNYUcl-owNVSpfHIujfR2eRibZSVHG-OEsc

Request Chain 138

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEHaKl3IM4subPQDpmqQ684I&google_cver=1&google_push=Aa02lx_baPDhf6Xih9lsGJ9yQ3iqBGO8m6E_cgEMP4AwVmvNjnx8dQb7cpOsRCvfyCNZV8EaoUzSSHCVT9khapZ3KmklVZ3lzK47Hw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aa02lx_baPDhf6Xih9lsGJ9yQ3iqBGO8m6E_cgEMP4AwVmvNjnx8dQb7cpOsRCvfyCNZV8EaoUzSSHCVT9khapZ3KmklVZ3lzK47Hw

Request Chain 139

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEC2tYn6oTMhOK8dEbvCVCNQ&google_cver=1&google_push=Aa02lx-iyiRbXeh2ALT2Q8YBnn4VWTZfofK_MmszLk_nZHdaS31JnRJjDcoj5HSPodmcU-rNZaEPdLPjV6kY3FZj_5MqsA12Canb7A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=Aa02lx-iyiRbXeh2ALT2Q8YBnn4VWTZfofK_MmszLk_nZHdaS31JnRJjDcoj5HSPodmcU-rNZaEPdLPjV6kY3FZj_5MqsA12Canb7A HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 140

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEHxwRCUT4AmfgZXkKi-zr6w&google_cver=1&google_push=Aa02lx-pB0kVQEl70iF6w6623aehYMH6VgMn5PjqNrUQfCaMBo7USBQaAJttSW0SCcf4ogQCBC_W4p_EoojnysuIWBxDFx9EeQ9m0A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ffc97331-03d3-44ea-92bd-2804c35ede27&%%GOOGLE_PUSH_PAIR%%

Request Chain 142

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 162

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

219 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
mestreemfinancas.com/e-fgts-calamidade/
Redirect Chain

https://supertrabalhocom.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZsaW5rLm1lc3RyZWVtZmluYW5jYXMuY29tJTJGbCUyRjQ0OTY=&sig=8qf4s8Um5XJoyorV3ncudUYxSyvzafdeFeaWYd5GDgxr&iat=16794...
https://link.mestreemfinancas.com/l/4496
https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

64 KB
14 KB

739ms
499ms

Document
text/html

108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 598b8c1110efc26823b59e938c43fe2e5342f4fe834e8ceba5263c1db3c2ad36

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 22 Mar 2023 20:13:35 GMT
link: <https://mestreemfinancas.com/wp-json/>; rel="https://api.w.org/", <https://mestreemfinancas.com/wp-json/wp/v2/pages/2526>; rel="alternate"; type="application/json", <https://mestreemfinancas.com/?p=2526>; rel=shortlink
server: Apache
vary: Accept-Encoding
x-ua-compatible: IE=edge

Redirect headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 22 Mar 2023 20:13:35 GMT
Location: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2 200 style.min.css
mestreemfinancas.com/wp-includes/css/dist/block-library/ 93 KB
17 KB 136ms
121ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 15 Nov 2022 21:06:39 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 classic-themes.min.css
mestreemfinancas.com/wp-includes/css/ 217 B
279 B 127ms
109ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/css/classic-themes.min.css?ver=1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Wed, 02 Nov 2022 08:48:59 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 189

GET
H2 200 styles.css
mestreemfinancas.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 404ms
387ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 18:53:50 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1010

GET
H2 200 preloader-plus.min.css
mestreemfinancas.com/wp-content/plugins/preloader-plus/assets/css/ 1 KB
628 B 128ms
112ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/preloader-plus/assets/css/preloader-plus.min.css?ver=2.2.1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 7b096cfae2525b059116d8b86e549bf6ae43fdcc78a90c72a3a42236d5caac52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 03 Feb 2023 21:49:45 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 573

GET
H2 200 widget-areas.min.css
mestreemfinancas.com/wp-content/themes/generatepress/assets/css/components/ 3 KB
866 B 134ms
118ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.2.4
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 20 Dec 2022 12:52:51 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 834

GET
H2 200 main.min.css
mestreemfinancas.com/wp-content/themes/generatepress/assets/css/ 19 KB
6 KB 131ms
116ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.2.4
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 20 Dec 2022 12:52:51 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 6114

GET
H2 200 elementor-icons.min.css
mestreemfinancas.com/wp-content/plugins/elementor/assets/lib/eicons/css/ 19 KB
4 KB 236ms
222ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.15.0
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: b651d87ef113cba0c8ec8a33bfdb694171effeba56b20be12e3c77fc15f6ae9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 3978

GET
H2 200 frontend-lite.min.css
mestreemfinancas.com/wp-content/plugins/elementor/assets/css/ 105 KB
21 KB 250ms
236ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.7
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: ecf785fe496796d2e4b026d58de7ea89a471d19255b06b3fefc5576db5a69dbc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 post-5.css
mestreemfinancas.com/wp-content/uploads/elementor/css/ 1 KB
387 B 248ms
234ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/uploads/elementor/css/post-5.css?ver=1675962711
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: e2f7d2878965ad61dcecd013500c1d038c5d6a8311a2da6299510566272e70f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Thu, 09 Feb 2023 17:11:51 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 355

GET
H2 200 global.css
mestreemfinancas.com/wp-content/uploads/elementor/css/ 9 KB
1 KB 244ms
231ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/uploads/elementor/css/global.css?ver=1675962711
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 7b64a84c219d901e94b497f2374a5eabfa89a26b3c2891c774979dea81bb66d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Thu, 09 Feb 2023 17:11:51 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1122

GET
H2 200 post-2526.css
mestreemfinancas.com/wp-content/uploads/elementor/css/ 4 KB
993 B 260ms
248ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/uploads/elementor/css/post-2526.css?ver=1676985291
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: c04d8a64a12d2baec77efe2a99b335351d98df781d96dde282b10a751e1b9be2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 21 Feb 2023 13:14:51 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 938

GET
H2 200 css
fonts.googleapis.com/ 42 KB
2 KB 48ms
16ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5dfdf00359b7743919a732ae8eb80536ff206faaf16a99fcdd3f967aca1f81e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 18:56:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Mar 2023 20:13:36 GMT

GET
H2 200 jquery.min.js Show response
mestreemfinancas.com/wp-includes/js/jquery/ 88 KB
38 KB 260ms
249ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Wed, 02 Nov 2022 08:48:59 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery-migrate.min.js Show response
mestreemfinancas.com/wp-includes/js/jquery/ 11 KB
5 KB 255ms
245ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Wed, 18 Nov 2020 17:36:06 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 4618

GET
H2 200 preloader-plus.min.js Show response
mestreemfinancas.com/wp-content/plugins/preloader-plus//assets/js/ 1 KB
593 B 256ms
246ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/preloader-plus//assets/js/preloader-plus.min.js?ver=2.2.1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: ea420d765b3a2def39c1b5ae6ec17b209cd156ab21fa8a8716159bb05ed655e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 03 Feb 2023 21:49:45 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 561

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 50ms
19ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ff2519842c31ec3137510db810cf4916a468af437872fb8fe1685a644508e37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27459
x-xss-protection: 0
server: sffe
etag: "1519 / 390 of 1000 / last-modified: 1679483383"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 22 Mar 2023 20:13:36 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
65 KB 75ms
45ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10883628328

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

078e029cb509e6c131d8c8983cacdcf186182af5c462f0cd3b4712ac43374357

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66428
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 19:09:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 20:13:36 GMT

GET
H2 200 push-notification.js Show response
script.joinads.me/ 1 KB
839 B 50ms
14ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.joinads.me/push-notification.js
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 39d0fd9943a1069718bb60c51587b8a2b7711d562766565fafd8ac6050e44cdb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 698182
cf-polished: origSize=1350
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 01 Apr 2021 12:59:38 GMT
server: cloudflare
etag: W/"6065c3ba-546"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FhpfbfSSlrA4HlYaoJpYsn0b9yD9yFvx%2FuFjDTleeWSIYzADrqUgfx6ZAO1tY9gsyBWS86R3sk1gLqSTDGRbP3iQLKQqLHhst8sMwfQE0STBqIFPRKm%2FnP7L6YV%2BvmDSNpJu5KTngVmRkhZCLHzdMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31104000
cf-ray: 7ac1189e0f01373e-FRA
expires: Fri, 08 Mar 2024 18:17:14 GMT

GET
H2 200 animations.min.css
mestreemfinancas.com/wp-content/plugins/elementor/assets/lib/animations/ 18 KB
3 KB 248ms
239ms Stylesheet
text/css 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.6.7
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2997

GET
H2 200 regenerator-runtime.min.js Show response
mestreemfinancas.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 250ms
241ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Mon, 11 Apr 2022 20:34:30 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2675

GET
H2 200 wp-polyfill.min.js Show response
mestreemfinancas.com/wp-includes/js/dist/vendor/ 17 KB
7 KB 355ms
347ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Wed, 02 Nov 2022 08:48:59 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 7621

GET
H2 200 index.js Show response
mestreemfinancas.com/wp-content/plugins/contact-form-7/includes/js/ 21 KB
8 KB 424ms
416ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 7abd36a2f651330420d86187c125331d679408d1be7b6cd93efa64e08eaf80c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 18:53:50 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 7973

GET
H2 200 menu.min.js Show response
mestreemfinancas.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 260ms
252ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.2.4
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 20 Dec 2022 12:52:51 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2176

GET
H2 200 back-to-top.min.js Show response
mestreemfinancas.com/wp-content/themes/generatepress/assets/js/ 757 B
425 B 254ms
247ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.2.4
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 808af092ebf9a3f9ffa55a0fcb1ec1809ac1a12ffa602e01e4ea91da1d2b5475

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 20 Dec 2022 12:52:51 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 393

GET
H2 200 webpack.runtime.min.js Show response
mestreemfinancas.com/wp-content/plugins/elementor/assets/js/ 5 KB
2 KB 357ms
350ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.7
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: e31e1cfb470365c46c451ae94f3a5f9bac9df96a0f403f044f851228a5bf1667

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2315

GET
H2 200 frontend-modules.min.js Show response
mestreemfinancas.com/wp-content/plugins/elementor/assets/js/ 14 KB
6 KB 260ms
254ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.7
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 133f35fbfc23c0d8cf814176860427bd6a02da9278de3de662da11d9602d8582

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 5798

GET
H2 200 waypoints.min.js Show response
mestreemfinancas.com/wp-content/plugins/elementor/assets/lib/waypoints/ 12 KB
4 KB 257ms
251ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 3747

GET
H2 200 core.min.js Show response
mestreemfinancas.com/wp-includes/js/jquery/ui/ 21 KB
8 KB 249ms
244ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: ca7154cdda62b535ceaba9ad2a2b2217ff49de94c069a2c4e89733f3f06b3651

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Wed, 02 Nov 2022 08:48:59 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 8344

GET
H2 200 frontend.min.js Show response
mestreemfinancas.com/wp-content/plugins/elementor/assets/js/ 37 KB
15 KB 248ms
242ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.7
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: e0f0d6d71e313ae3ee40517ae4df4806d42aacf7720c5c0220506c247796c4f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Jul 2022 17:06:53 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 14837

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 112 KB
44 KB 68ms
39ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-165983883-5

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e5afb01e1476b41582fb1334176f27ea0ba3c6eafcd98e433394df349e1bb217

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44723
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 19:09:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 20:13:36 GMT

GET
H2 200 wp-emoji-release.min.js Show response
mestreemfinancas.com/wp-includes/js/ 18 KB
5 KB 114ms
113ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
last-modified: Tue, 12 Apr 2022 14:26:24 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 5321

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 107 KB
28 KB 43ms
9ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0a19fce040b8127f3e2e3ed609f7800153be329d6420b53295fb79a4f40012ec

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:36 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27907
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: D43XhkT5DRpKNFu2Z6ZV54AMZXaU6ryPTIHnI2TQteTRldU3xpUIJgF7f96dlcCZTY7Y3PP6/DvHZuE/FD2zug==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 39ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mestreemfinancas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 08:37:39 GMT
x-content-type-options: nosniff
age: 128157
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Mar 2024 08:37:39 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 40ms
9ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mestreemfinancas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 08:37:40 GMT
x-content-type-options: nosniff
age: 128156
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Mar 2024 08:37:40 GMT

GET
H2 200 FGTS-7-1-768x512.png
mestreemfinancas.com/wp-content/uploads/2023/02/ 166 KB
166 KB 112ms
111ms Image
image/png 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mestreemfinancas.com/wp-content/uploads/2023/02/FGTS-7-1-768x512.png
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: a6d72c44ca09f0eb3e1af89f282ea5c1e94669f87d89cc6cab10925771c11cf2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
last-modified: Tue, 21 Feb 2023 12:58:37 GMT
server: Apache
accept-ranges: bytes
content-length: 169703
content-type: image/png

GET
H2 200 FGTS-8-768x512.png
mestreemfinancas.com/wp-content/uploads/2023/02/ 136 KB
136 KB 217ms
217ms Image
image/png 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mestreemfinancas.com/wp-content/uploads/2023/02/FGTS-8-768x512.png
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: a72da021ce55690ffbd77addc203b06896ed0f1168f2828d2cd9c47713341a2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
last-modified: Tue, 21 Feb 2023 12:58:30 GMT
server: Apache
accept-ranges: bytes
content-length: 139058
content-type: image/png

GET
H2 200 pubads_impl_2023032001.js Show response
securepubads.g.doubleclick.net/gpt/ 396 KB
134 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf2086397a5d0d6d9c67e72d0dce0c0e734c9867e3cf6c1dd529b1fd22713393

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 14:53:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19188
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 136699
x-xss-protection: 0
last-modified: Mon, 20 Mar 2023 08:34:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 21 Mar 2024 14:53:48 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 573 B
302 B 43ms
22ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=mestreemfinancas.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e100b78565f86a5cedf791f8ce4d3a7d39b6597f6070090d5fd38bfdf004ede5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 277
x-xss-protection: 0
expires: Wed, 22 Mar 2023 20:13:36 GMT

GET
H2 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 12ms
9ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.99

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7e86f52cb0d423805ec541a4bccae5156a01fbe36355e6d798a450593212651f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:36 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 20722
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 3Kq6smzBGdwBCnfi/nRdXfRNUg/3bfkCiOhKhM0CzV/3m5GhY1DsZWqPhCwgRGWAOQROAC5mQ2Sx48qYwUMk0w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 2059094117621613 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 163ms
160ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2059094117621613?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5cd1d3f62af07b4c29a844781688aadb6d84f30986e2c2aa5fd2d581ea517ed1

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:36 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: DhxnbH3jBMjG60Up5kgMwaxMouerY5z5AUKD+WHaRJOtpUYVA9r2SB3dXnm59Keb1URWXg91Og0YVlZvEGBRWw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 179 KB
65 KB 37ms
36ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10883628328&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-165983883-5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ad76476fc16a70ba7d64d7468c541495f133944145a21149596b54fd2bd12c98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66429
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 19:09:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 22 Mar 2023 20:13:36 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 30ms
6ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-165983883-5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 22 Mar 2023 20:05:11 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 505
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Wed, 22 Mar 2023 22:05:11 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10883628328/ 3 KB
2 KB 74ms
52ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10883628328/?random=1679516016852&cv=11&fst=1679516016852&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10883628328

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d35c329b30c79f995ec0c3046be01eb2651227def940a8bf5329a680ebfe01e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/10883628328/ 3 KB
2 KB 67ms
24ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/10883628328/?random=1679516016866&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&label=sgBQCMy6kYMYEKj628Uo&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&gtm_ee=1&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10883628328

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

171a7a43dfa4ecaab9766b8c0e94e013737345a7975092cfcecfd4b63000e743

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1612
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 51ms
15ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=mestreemfinancas.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 53ms
16ms Script
application/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=mestreemfinancas.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 40 KB
15 KB 687ms
687ms XHR
text/plain 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=553687043685601&correlator=2824422700490036&eid=31073316%2C31070233&output=ldjh&gdfp_req=1&vrg=2023032001&ptt=17&impl=fif&iu_parts=22526454507%2Cmestreemfinancas.com%2CMestreemfinancas_Interstitial_20230204&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=1&adks=3550336826&sfv=1-0-40&ists=1&fas=8&cust_params=id_post_wp%3D2526%26utm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&sc=1&cookie_enabled=1&abxe=1&dt=1679516016923&lmt=1679516016&dlt=1679516016270&idt=609&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=1636985903.1679516017&ga_sid=1679516017&ga_hid=1313710417&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28407c1f79f0179d777c12ea82ab9cb0388c3f1c0ed9ba5218063f7b3f38033c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15128
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mestreemfinancas.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
12 KB 1516ms
1515ms XHR
text/plain 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=553687043685601&correlator=2824422700490036&eid=31073316%2C31070233&output=ldjh&gdfp_req=1&vrg=2023032001&ptt=17&impl=fif&iu_parts=22526454507%2Cmestreemfinancas.com%2CMestreemfinancas_Content1_20230204&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=250x250%7C300x250%7C336x280&ifi=2&adks=1947044723&sfv=1-0-40&cust_params=id_post_wp%3D2526%26utm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&sc=1&cookie_enabled=1&abxe=1&dt=1679516016957&lmt=1679516016&dlt=1679516016270&idt=609&adxs=675&adys=832&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&frm=20&vis=1&psz=1120x0&msz=1120x0&fws=0&ohw=0&ga_vid=1636985903.1679516017&ga_sid=1679516017&ga_hid=1313710417&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9e159db20877543a7026539fa099bbb2d08de12857a51747e9e3a76f731fbc03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12049
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mestreemfinancas.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 53 KB
12 KB 951ms
951ms XHR
text/plain 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=553687043685601&correlator=2824422700490036&eid=31073316%2C31070233&output=ldjh&gdfp_req=1&vrg=2023032001&ptt=17&impl=fif&iu_parts=22526454507%2Cmestreemfinancas.com%2CMestreemfinancas_Anchor_20230204&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=3&adks=691987584&sfv=1-0-40&ists=1&fas=2&cust_params=id_post_wp%3D2526%26utm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&sc=1&cookie_enabled=1&abxe=1&dt=1679516016963&lmt=1679516016&dlt=1679516016270&idt=609&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=1636985903.1679516017&ga_sid=1679516017&ga_hid=1313710417&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac74720205d374254fe305f19474f51c52c2090be303ad9012f2b0f0e4ade22c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12404
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mestreemfinancas.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 27 KB
12 KB 375ms
375ms XHR
text/plain 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=553687043685601&correlator=2824422700490036&eid=31073316%2C31070233&output=ldjh&gdfp_req=1&vrg=2023032001&ptt=17&impl=fif&iu_parts=22526454507%2Cmestreemfinancas.com%2CMestreemfinancas_Mobile_Fixed_20230204&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C320x100&ifi=4&adks=4022149995&sfv=1-0-40&cust_params=id_post_wp%3D2526%26utm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&sc=1&cookie_enabled=1&abxe=1&dt=1679516016966&lmt=1679516016&dlt=1679516016270&idt=609&adxs=-12245933&adys=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&frm=20&vis=1&psz=0x-1&msz=0x-1&fws=640&ohw=0&ga_vid=1636985903.1679516017&ga_sid=1679516017&ga_hid=1313710417&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af916ed81b4bb3b0b23dd6a73a64b4bc84371a9269f767de15361d7d34c6628c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12358
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://mestreemfinancas.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6FFB 6 KB
3 KB 53ms
15ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:37 GMT
expires: Thu, 21 Mar 2024 20:13:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads_2023032001.js Show response
securepubads.g.doubleclick.net/gpt/ 33 KB
12 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2023032001.js?cb=31073316

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d239ba30d7b460a0780479fcf04ab11e0b5fb1af7d9a07987e6e0370ddc8d79a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 10:57:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119786
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12325
x-xss-protection: 0
last-modified: Mon, 20 Mar 2023 08:34:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 20 Mar 2024 10:57:10 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
209 B 14ms
13ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1313710417&t=pageview&_s=1&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&ul=en-us&de=UTF-8&dt=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAACAAI~&jid=829698370&gjid=1753670853&cid=1636985903.1679516017&tid=UA-165983883-5&_gid=896029059.1679516017&_r=1&gtm=457e33k0&z=1597934992

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://mestreemfinancas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://mestreemfinancas.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-conversion/10883628328/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmes...
https://www.google.com/pagead/1p-conversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe...
https://www.google.de/pagead/1p-conversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-...

42 B
108 B

33ms
32ms

Image
image/gif

2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&label=sgBQCMy6kYMYEKj628Uo&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&gtm_ee=1&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE03cW9BWVF6dWF3eUp6QXUtN0lBUklsQUNTQVFjXzYzTEFZQ3dsdGNQT0xkMENBaC1pTFl3OHI3dVhKTTZ2WUwzMEhCcjdGUUEaWENoRUk4TTdxb0FZUXg2bWw5TDJtNzVQaEFSSXRBQjdPd2N1QnhPcEEybGdxRTNYMDlMSWNQNkVNVU41Z1ZRYTFuR1hJN3JVQ3VPUjdpekxhNXhTd2IzVVA&is_vtc=1&ocp_id=cGEbZKqEOPCV7_UPnIeZwAo&cid=CAQSKQDUE5ymyxg-j9LFgOpdAmSIuTOKsZ0kHmtqcG5k6xbMTTgvuQk250B5&random=1001367338&ipr=y&prhg=0

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/10883628328/?random=192459952&cv=11&fst=1679516016866&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&label=sgBQCMy6kYMYEKj628Uo&hn=www.googleadservices.com&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&gtm_ee=1&auid=437127058.1679516017&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE03cW9BWVF6dWF3eUp6QXUtN0lBUklsQUNTQVFjXzYzTEFZQ3dsdGNQT0xkMENBaC1pTFl3OHI3dVhKTTZ2WUwzMEhCcjdGUUEaWENoRUk4TTdxb0FZUXg2bWw5TDJtNzVQaEFSSXRBQjdPd2N1QnhPcEEybGdxRTNYMDlMSWNQNkVNVU41Z1ZRYTFuR1hJN3JVQ3VPUjdpekxhNXhTd2IzVVA&is_vtc=1&ocp_id=cGEbZKqEOPCV7_UPnIeZwAo&cid=CAQSKQDUE5ymyxg-j9LFgOpdAmSIuTOKsZ0kHmtqcG5k6xbMTTgvuQk250B5&random=1001367338&ipr=y&prhg=0
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10883628328/ 42 B
455 B 47ms
20ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10883628328/?random=1679516016852&cv=11&fst=1679515200000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1179197639&rmt_tld=0&ipr=y

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10883628328/ 42 B
455 B 51ms
22ms Image
image/gif 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10883628328/?random=1679516016852&cv=11&fst=1679515200000&bg=ffffff&guid=ON&async=1&gtm=45be33k0&u_w=1600&u_h=1200&url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&frm=0&tiba=e-FGTS-calamidade%20-%20Mestre%20em%20Financas&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1179197639&rmt_tld=1&ipr=y

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1537353300119728 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 161ms
161ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1537353300119728?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1f29d91e07c72114188d0d5ec2a2166112fd0096b71519a39ed3555c7e30232a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: naxbgSIgVXkcrI4EpBj34CpovDGT3anOv9ioRe1zPOwswh4jaha3+GNC1JveNvX1naBT7jkA/PAhQUwkZKIpbQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 40ms
9ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2059094117621613&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516017019&sw=1600&sh=1200&v=2.9.99&r=stable&a=wordpress-6.1.1-3.0.8&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:37 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 1897808950573752 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 136ms
135ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1897808950573752?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8ef645c73a2e07d368aa41f762a2c1c8b94fff9116a06e66f506dce23f8e4fcb

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: dAZV/RLT4XkeSLHQ+HIrSk6clCTyqMJf0952HbD9eN0K4LDSN9bGa/aobOINH9WPg1IYJ5a3FyMx3axYTwMSkQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 33ms
14ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 41943
x-jsd-version: master
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230042-FRA, cache-yyz4568-YYZ
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aCyIqPw2IcrdtTI%2BU57x3C465c9GB0R0I%2Fa2qBis3Ub%2BssjoRPghyRzGzqq06yg6Di69iwbHwirjtlqmQOFh8jIOATmJYea643jy895OtxNcHW9xxb1ffF63RI6N%2BZfXQbgqxE5Kis8FsbI2lMw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7ac118a49c415c44-FRA

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 41ms
7ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 15 Mar 2023 08:31:33 GMT
content-encoding: gzip
age: 646924
x-guploader-uploadid: ADPycdvujfU_oLUmNVqI4f5BZnpSVte8PDLotLNZgvFd0cC54eAGvZm9f8-b4dRZmf4BnqGEW6yytSvFJRHHxFr_uK-ecw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 14 Mar 2024 08:31:33 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 59ms
21ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b1546ae8f493de03b1ca99f9f955a20785679be18625354b363f2f8311f421b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 13 Feb 2023 11:21:55 GMT
server: cloudflare
x-amz-request-id: X62HD4AEE1DVWSM7
age: 215
etag: W/"b988c8d91b8a22dcd50f129d3a9d67f1"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7ac118a4b8f33825-FRA
x-amz-id-2: EFYtIkWenICF2ZXdzn/IO5L6b6E2tXBoEDkeDs20HryboamOBykN5C1hmGl5u6SWwIzrBLiU+58=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 83ms
38ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-9c21"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 23 Mar 2023 20:13:37 GMT

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 46ms
7ms Script
text/javascript 2600:9000:2250:2c00:a:e047:752:b361
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:2c00:a:e047:752:b361 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 71fc1599035adc6bc34df2117b8631285905f97737ba730af28644ee6a0d8dde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date: Wed, 22 Mar 2023 05:18:42 GMT
Via: 1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
Last-Modified: Mon, 23 Jan 2023 04:07:36 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P2
Age: 53696
x-amz-server-side-encryption: AES256
ETag: "aded621b17723f487b3c9d0e43cf2f94"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1859
X-Amz-Cf-Id: AXc5fx7UjjDdZEZYsmF802ooIF5ibjLLx6rmANFoejvpsGQN7LPKUw==

GET
H2 200 container.html Show response
64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 41BD 6 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:37 GMT
expires: Thu, 21 Mar 2024 20:13:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 41BD 0
0 54ms
54ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C0adOcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTUAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmRN0aqVnoVOmYCK1JPjC74RWRsmfidOaXQV8USoksrdyk-KgnGNngBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTQ4OTQyMDk4NzA4NTc5MDUY09p-&sigh=iQThFUxrQhk&uach_m=[UACH]&cid=CAQSOwDUE5ymhSx5rPyOKvmKz_mbGD_sdFhlLSdRGQ8fPxuitRECkIt6TfP_WFbFS38KO7HXaA-lwWkRbZOUGAE
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 41BD 0
0 53ms
17ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1ka6f5g51fbzn0fb11naemsnhzzyrjrtgqs1sy89pv4z7cf43rbjpbd55gz9yqf0sqhxnqr9wp0d5989a6y8f6yytzarghmjxarwqm7g70jd3js60wxghh6q957zmwt8mz720nwyby9yr1032z09g00nf1pmffr5eqc11n6zs8bfajp6vgx1fvjn3k4z204xzjq3gn0jt203nw5h0cxcjajh1sv2nga3gwakx6593mqgbwmkp614hfv9x50zzxf9ntedfn7h9867w56d74kr5e0bp1s4qqj86v0s7n5zbqxfttrxa38eqc2p5k6e7n8haw6g3f3grvvmmys0qe38z2mg6xeh9xns3aqvj1a3ktf0p71g000qwhc8mqm039xejrdt278z1xh2g17d&b=ZBthcQAAHowI9kTaAAzQJXS0psJkVEA7XP04IQ
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 22 Mar 2023 20:13:37 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame 0C7A 2 KB
3 KB 57ms
31ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1hcbfjy1vdjj910zknwf3n0jm31nzd7myk1v091cpvj0gzw3s37h36czzb2c45457nny4b0bxa607jckhvhqzy001q331hgs7q44734m2j14qy5mdzgg9s398zbpvxjsckez67mf429wvcp26jcv86228b7b53jndjj0xhc8t6qzbphb3gd8x6n47jw6e5ehvs695vc0ct3vhjfz2ym5khh563phkeffx2cv9eqc56kr2jkpt41dy55ggaetdx37hkz3nhtm0tkn45555rmdew0mhp26nx684hd23fc60ydmmtqwnsjvb07spk89qwpczhsthqfzs8jgwk3zfem6z844qcw55z70mwya0ecr5q4k9sm78s6nzwk14g6cha2karsbqseg4ytyvbtxfp0eer2m8pq8170823c6hwygt72bwk1npdsbbf5h4sgkeq651k4skgwm0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%26client%3Dca-pub-4894209870857905%26adurl%3D

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b13ddd6cd424064f8d421734c4c19e692c68c74ec2c5c61f960cf799cca1b63e

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7ac118a4dd679bf4-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:37 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/ Frame 41BD 3 KB
1 KB 38ms
9ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/window_focus_fy2021.js

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 19:44:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 19:44:50 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1056 1 KB
1001 B 29ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 8820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 17:46:37 GMT
etag: 48472445140208031
expires: Thu, 23 Mar 2023 17:46:37 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/ Frame 41BD 20 KB
9 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83dd1a8208a83ec90a9a2d7774ab28e4b93b3eba53fb6a3fd444eb7e389ecbff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 11:58:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29706
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8627
x-xss-protection: 0
server: cafe
etag: 8620137988422272387
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 11:58:31 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 41BD 0
0 16ms
16ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTiJCPSGJBkr4dvcYbOfo3G5vTnQ1NPW2jzO0Qd8O62qtzt73YXlK6djKTlKrm4PR9iUW71Tu4Wbzp1hmxLqCgocT0QpQ
Requested by: Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 41BD 24 KB
7 KB 34ms
8ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7706
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 21 Mar 2024 18:05:11 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 41BD 158 KB
49 KB 68ms
18ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe14bc8a4e294c047589838fd09a3efc81771751a0be03ea8ec99e734e965fd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49540
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1679312138029146"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Mar 2023 20:13:37 GMT

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rid=esp&cc=1

85 B
203 B

132ms
119ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rid=esp&cc=1
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 91c12bf34c1747ec325fd81713811aad095ffea7e4e4a93aa4097669dd6d0056

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-XFrM35pRMRtvZZhP0g56pTpWJv0"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://mestreemfinancas.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Wed, 22 Mar 2023 20:13:37 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://mestreemfinancas.com
location: /esp?url=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
329 B 35ms
8ms XHR
text/plain 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://mestreemfinancas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://mestreemfinancas.com
date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 dpixel
cms.quantserve.com/ Frame 1056 35 B
464 B 62ms
19ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEB203Z8BnzZkKEDiFG20PJU&google_cver=1&google_push=Aer7DvJbCZNUvcG50NvL5Z14KU-wqf6lsO0gDC8lWGAe7ZQphgIMFWEMxDyQJoIFCIYQljhKolnb_YSv2nalHA3zwMCNFlLfDZnb

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1056
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESENWG3yLR9vcmN8sPBlSOJrg&google_cver=1&google_push=Aer7DvK9Kid--vrtSmNTISUpBY_lsbOPpz7FRdT-bZgltxEB6DOA0Zrdh1P7WlwadTiiHaQlJvvQZ7PEXzhEMyZl...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aer7DvK9Kid--vrtSmNTISUpBY_lsbOPpz7FRdT-bZgltxEB6DOA0Zrdh1P7WlwadTiiHaQlJvvQZ7PEXzhEMyZlu_PBSePDu8Rk

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aer7DvK9Kid--vrtSmNTISUpBY_lsbOPpz7FRdT-bZgltxEB6DOA0Zrdh1P7WlwadTiiHaQlJvvQZ7PEXzhEMyZlu_PBSePDu8Rk

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 22 Mar 2023 20:13:38 GMT
Server: MT3 668 4401257 master cdg-pixel-x28 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=Aer7DvK9Kid--vrtSmNTISUpBY_lsbOPpz7FRdT-bZgltxEB6DOA0Zrdh1P7WlwadTiiHaQlJvvQZ7PEXzhEMyZlu_PBSePDu8Rk
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 22 Mar 2023 20:13:37 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1056
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFHacESBa9LZB4cu7ALGR1g&google_cver=1&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEFHacESBa9LZB4cu7ALGR1g&google_cver=1&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4X...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s&google_hm=_8lzMQPTROqSvSgEw17eJw==

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s&google_hm=_8lzMQPTROqSvSgEw17eJw==

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s&google_hm=_8lzMQPTROqSvSgEw17eJw==
date: Wed, 22 Mar 2023 20:13:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1056
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_push=Ae...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_hm=ZBthcWIeQ4bq5WCgpmqk8AAADL4AAAIB&google_nid=index&google_push=Aer7DvJIfYJXp1WKTSG_E1L8wlhjSTHKwE3wc...

170 B
232 B

17ms
17ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_hm=ZBthcWIeQ4bq5WCgpmqk8AAADL4AAAIB&google_nid=index&google_push=Aer7DvJIfYJXp1WKTSG_E1L8wlhjSTHKwE3wcvSs5FOFwEoz4dN9KuoztW5XkfqB2Om40mPDtY8jCupNRfEy7WuuCr1b2zJWCz7p

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 22 Mar 2023 20:13:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESECIavvJi6YNEJ30iGwW45MU&google_hm=ZBthcWIeQ4bq5WCgpmqk8AAADL4AAAIB&google_nid=index&google_push=Aer7DvJIfYJXp1WKTSG_E1L8wlhjSTHKwE3wcvSs5FOFwEoz4dN9KuoztW5XkfqB2Om40mPDtY8jCupNRfEy7WuuCr1b2zJWCz7p
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1056
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEPQ9Vt6yOBmtN8_7Mbxy7Og&google_cver=1&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWULM
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWUL...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R...

170 B
329 B

18ms
18ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWULM

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aer7DvIh4d4cCRWD8Ah1XVTxoidrU8yppUO_XK4WFYloB_yBdd_jbI0R7OOOvBYiQDb4U6e6Q2DS11ijj4Y3IyT7sriOnwMzWULM
date: Wed, 22 Mar 2023 20:13:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 1056 0
75 B 241ms
46ms Image
text/plain 185.86.138.151
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEPTzcBRo3joDHHgSv_Ls_7Q&google_cver=1&google_push=Aer7DvLLT2jKbCQM3LeX3EliUaCbPbBhNxub1E98Hq9ZJvat1a8A3CXYzDn1rTbWHlQQDx_u5wVJjBoucbAje1_3GEP4GoZGl1MP
Requested by: Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.151 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1056
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECBpr8EsZWMuXFrhGJU6T7w&google_cver=1&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezv...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECBpr8EsZWMuXFrhGJU6T7w&google_cver=1&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezv...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-f...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezvjdwy4tsCUjOpRmqsI9T0UF2_OQxg

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aer7DvK1LOtkIxYOTwEdI9o3dsOMCdsUvCbCQltCt5D3F6C-uzfd9FG-fBeV7eIRQYpXk5Qezvjdwy4tsCUjOpRmqsI9T0UF2_OQxg
date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 1056 0
130 B 61ms
18ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KbaA5mF_UYf3GhK5pjcqt70Srvjz2XhQ_qs8PlqGcYQPXon7Ibu0npA7b_Pyydz9Ft1chGtA

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 1417078182161683 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 152ms
152ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1417078182161683?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

519ae5bc490c0c50483f78dca3697a8dd2be7bad9021bd4efa6e2c659666118e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: KanTorz1XAr+PbDWCYeGhcBiAgbYDHrT2w7K6rq7C711n/2AiMj3fSVpk3PbMclf18FIYs2Ag+JlyM1ga8yeYQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 default.css
as.ad4m.at/ad/style/0.1.35/one-ad/ Frame 0C7A 94 KB
12 KB 31ms
27ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.35/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1hcbfjy1vdjj910zknwf3n0jm31nzd7myk1v091cpvj0gzw3s37h36czzb2c45457nny4b0bxa607jckhvhqzy001q331hgs7q44734m2j14qy5mdzgg9s398zbpvxjsckez67mf429wvcp26jcv86228b7b53jndjj0xhc8t6qzbphb3gd8x6n47jw6e5ehvs695vc0ct3vhjfz2ym5khh563phkeffx2cv9eqc56kr2jkpt41dy55ggaetdx37hkz3nhtm0tkn45555rmdew0mhp26nx684hd23fc60ydmmtqwnsjvb07spk89qwpczhsthqfzs8jgwk3zfem6z844qcw55z70mwya0ecr5q4k9sm78s6nzwk14g6cha2karsbqseg4ytyvbtxfp0eer2m8pq8170823c6hwygt72bwk1npdsbbf5h4sgkeq651k4skgwm0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%26client%3Dca-pub-4894209870857905%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 926a4ca073c39c40cabffbf1b0371803f245f084cdb9177fc7b3f9d81c0e394d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1hcbfjy1vdjj910zknwf3n0jm31nzd7myk1v091cpvj0gzw3s37h36czzb2c45457nny4b0bxa607jckhvhqzy001q331hgs7q44734m2j14qy5mdzgg9s398zbpvxjsckez67mf429wvcp26jcv86228b7b53jndjj0xhc8t6qzbphb3gd8x6n47jw6e5ehvs695vc0ct3vhjfz2ym5khh563phkeffx2cv9eqc56kr2jkpt41dy55ggaetdx37hkz3nhtm0tkn45555rmdew0mhp26nx684hd23fc60ydmmtqwnsjvb07spk89qwpczhsthqfzs8jgwk3zfem6z844qcw55z70mwya0ecr5q4k9sm78s6nzwk14g6cha2karsbqseg4ytyvbtxfp0eer2m8pq8170823c6hwygt72bwk1npdsbbf5h4sgkeq651k4skgwm0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%26client%3Dca-pub-4894209870857905%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1677666448
age: 639605
cf-polished: origSize=96968
x-guploader-uploadid: ADPycduxnnyMRJTFaD4Dg7Hd8aRn6xTYu1PRy7TXWWh0GjCBxwAMZMkehaNAf-UCycuwqnGLPQWuj1EZCp5aL6ZRZOMYGSoR-sy7
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 01 Mar 2023 10:28:06 GMT
server: cloudflare
etag: W/"6110dc3a24c902508647a582294bcc25"
vary: Accept-Encoding
x-goog-generation: 1677666486645030
content-type: text/css
x-goog-hash: crc32c=6qzuyQ==, md5=YRDcOiTJAlCGR6WCKUvMJQ==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7XStGMO0425b%2FGc0vuZv0Rkmu6%2BOkATnGtdWPen5EFKrc40xJ%2BX8cxfXLOzRxxaN7cCZ%2BrrBA7Rt4hdHYvg%2FZj5vBY%2BKOcdgph0sk8DPTTKDVYve2HQzBiQtJ7TRoYkX0PwD6nFUSI0%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 96968
cf-ray: 7ac118a52dee9bf4-FRA
expires: Wed, 22 Mar 2023 21:13:37 GMT

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 0C7A 25 KB
10 KB 38ms
26ms Script
application/javascript 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1hcbfjy1vdjj910zknwf3n0jm31nzd7myk1v091cpvj0gzw3s37h36czzb2c45457nny4b0bxa607jckhvhqzy001q331hgs7q44734m2j14qy5mdzgg9s398zbpvxjsckez67mf429wvcp26jcv86228b7b53jndjj0xhc8t6qzbphb3gd8x6n47jw6e5ehvs695vc0ct3vhjfz2ym5khh563phkeffx2cv9eqc56kr2jkpt41dy55ggaetdx37hkz3nhtm0tkn45555rmdew0mhp26nx684hd23fc60ydmmtqwnsjvb07spk89qwpczhsthqfzs8jgwk3zfem6z844qcw55z70mwya0ecr5q4k9sm78s6nzwk14g6cha2karsbqseg4ytyvbtxfp0eer2m8pq8170823c6hwygt72bwk1npdsbbf5h4sgkeq651k4skgwm0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%26client%3Dca-pub-4894209870857905%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d5e67a38c9a11424cac19ce192c9fd124a6d74e64d3791a01561dbd3e39c0b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 Mar 2023 13:45:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 109677
etag: W/"fcb2a26b07bd76d9a925cae661d6d94d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2FqcIT0qHIj%2BuWgscwZJGgJXd1M%2ByDCnxcteG06ivbJcChRg46byf%2FPG2sHfxpxU3OiSN7siHoXIncm2KYfKgfEZyhXJiflbFOB2U63AgahpVBHAIiofmR91t4I3Ik%2BwMO4fKXI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 7ac118a53e059bf4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 21 Mar 2023 13:45:38 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A5DF 15 KB
6 KB 117ms
24ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=mestreemfinancas.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

97d67f8c2575e19d30ae28a32bad7610849e0e56c81ca66e51178124a5c5eed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:36 GMT
server: Kestrel
server-processing-duration-in-ticks: 466533
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 frame.html Show response
ad4m.at/ Frame 3A91 2 KB
1 KB 19ms
19ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1609070
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 7ac118a5ab5e3663-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Wed, 22 Mar 2023 20:13:37 GMT
expires: Mon, 27 Feb 2023 21:37:06 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zBIhdEwbxg%2Fds9a%2FrXulKKcdoOj877kLEEo%2B5lGQqMe8Zr2fBG5ZXKrHj9AZh3fnf0v2GcjKnO3K1SBi69zroau3ojCvuYsJ0okh1hOCWxxU469KLiHHxb8d1OuCZGxyQwSsm0U%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

POST
H3 200 rs Show response
ad4m.at/ Frame 0C7A 1 KB
2 KB 38ms
37ms XHR
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f98e3a43b646099a57d185042f32496e965d18ecc357f227739edf669a353c49

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fZHmwxHuriWZKeebEDiG27dkA7lBzJmaoNStGIkcYeRxRA7SkVXZsMKxlE6B898EPqoS5%2FGccixEudqZ43Gl6mmOLYCkveySqnUjMR8Til6I0UbfYjzcTtbLeloaK5eavzUaQMg%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
cf-ray: 7ac118a64c63690d-FRA
x-backend-server: aa-reachservice-group-europe-west1-w4c5
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 66ms
35ms Preflight
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://as.ad4m.at
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7ac118a60c08690d-FRA
content-length: 24
content-type: text/plain
date: Wed, 22 Mar 2023 20:13:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hQ8ljxg8B7RV8OhevEWD%2F61NE6SRJYrk4Fgl9wqKYvGSvZbMWXY20KoXdNSR93bw7mZIBvhYwlFFGnbORe5whOOk1Xur3g7vW8UUA%2BR3%2BEyQEer1YXzfJNhGef1MCAsSbqy7%2BFo%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-w4c5

GET
H2

200

sid Show response
mug.criteo.com/ Frame A5DF
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=mestreemfinancas.com&sn=ChromeSyncframe&so=0&topUrl=mestreemfinancas.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=FtT38nx2RWNFT09uVHp6bUkxU2xsWG5Pb1lBc0x2Z1pRcDN6dGNrQnV1WHlPakxYaFA5MkpPMUdLdGp1Qm9sSG1tQkgzcUhFQ28vVlhDaUtGRk5wZDdsVnZsZnhjNlgzbXhONUNVTTh5TURqWGljVWZ3bDBJUEF6SDFITW...

462 B
673 B

158ms
17ms

Fetch
application/json

178.250.1.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=FtT38nx2RWNFT09uVHp6bUkxU2xsWG5Pb1lBc0x2Z1pRcDN6dGNrQnV1WHlPakxYaFA5MkpPMUdLdGp1Qm9sSG1tQkgzcUhFQ28vVlhDaUtGRk5wZDdsVnZsZnhjNlgzbXhONUNVTTh5TURqWGljVWZ3bDBJUEF6SDFITWMzZEt5YzVxZ2hwelFCRCtBOEsyUW42RUVKN0FKaWF2MWU4eGQvVUV1WDYwRk9WT3M3b3BGL0ZrMDM2bnZMVEpCS0pOem45bjVhMnFmTHJQVlVBNzB6WVk1aGJKK1gxT3dKWWJCNGZPMHA2K0FWSU1RYy91QTJlUVNaMTlCVkpJTXNVdDMyMlBpTFduTncrTWVmS0pMbUR0dmpPTUZYb2pMMm93Rzg0VlhOaFJ3a0RxV2Radz18&cppv=2

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

c5c23b3d97840dd493a5adaec306d9a930ff0d7ef513a9320ccf213a3693bb83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1856367
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=FtT38nx2RWNFT09uVHp6bUkxU2xsWG5Pb1lBc0x2Z1pRcDN6dGNrQnV1WHlPakxYaFA5MkpPMUdLdGp1Qm9sSG1tQkgzcUhFQ28vVlhDaUtGRk5wZDdsVnZsZnhjNlgzbXhONUNVTTh5TURqWGljVWZ3bDBJUEF6SDFITWMzZEt5YzVxZ2hwelFCRCtBOEsyUW42RUVKN0FKaWF2MWU4eGQvVUV1WDYwRk9WT3M3b3BGL0ZrMDM2bnZMVEpCS0pOem45bjVhMnFmTHJQVlVBNzB6WVk1aGJKK1gxT3dKWWJCNGZPMHA2K0FWSU1RYy91QTJlUVNaMTlCVkpJTXNVdDMyMlBpTFduTncrTWVmS0pMbUR0dmpPTUZYb2pMMm93Rzg0VlhOaFJ3a0RxV2Radz18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 366649
content-length: 0
expires: 0

GET
H3 200 1213417872897242 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 144ms
144ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1213417872897242?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

62a8dfc83e39220c06dead3948f5faa65f23e9fa05ade08db7b8204f614e48de

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: /nsJQdcG3+atsx/fe72mNuHnj9gPznit2UGVAk0RzUu9sfoFPcqBtfY0cSDUd4vpqUAT8m8m8DtzNorXEt+zuQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 container.html Show response
64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0DD2 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:37 GMT
expires: Thu, 21 Mar 2024 20:13:37 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame 6F50 5 KB
3 KB 32ms
31ms Document
text/html 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

460b2dbe88f3cd1f5833c6f699a9b87d0f2f0ea26defd425074e0ba5bbcbd11a

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-src ;img-src data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/dr?ed=1hcbfjy1vdjj910zknwf3n0jm31nzd7myk1v091cpvj0gzw3s37h36czzb2c45457nny4b0bxa607jckhvhqzy001q331hgs7q44734m2j14qy5mdzgg9s398zbpvxjsckez67mf429wvcp26jcv86228b7b53jndjj0xhc8t6qzbphb3gd8x6n47jw6e5ehvs695vc0ct3vhjfz2ym5khh563phkeffx2cv9eqc56kr2jkpt41dy55ggaetdx37hkz3nhtm0tkn45555rmdew0mhp26nx684hd23fc60ydmmtqwnsjvb07spk89qwpczhsthqfzs8jgwk3zfem6z844qcw55z70mwya0ecr5q4k9sm78s6nzwk14g6cha2karsbqseg4ytyvbtxfp0eer2m8pq8170823c6hwygt72bwk1npdsbbf5h4sgkeq651k4skgwm0r&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%26client%3Dca-pub-4894209870857905%26adurl%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7ac118a69cbf3663-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-src *;img-src * data:;manifest-src 'none';media-src 'none';object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:37 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H2 200 css2
fonts.googleapis.com/ Frame 0DD2 4 KB
732 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 20:10:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Mar 2023 20:13:37 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C774 624 B
242 B 32ms
28ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO6mwc4CEKHd9pAEGIOY-uEBMAE&v=APEucNWMFdPZb4k3V_mR6SmzsSnNN9TeJlNLBOF0-7aBGIH-lUYTxHGz5W99_Z021XlgI5J5fsLSt3gqZ5VVAEi3hpj7gbPB7IfVR6a8ByUvLIpc-WVE7rd0DbWydiArOJwhv9SLA6HpMBS9Gs4_LBKlMclZi8aNy1J0zy4Nl1BZRKAwciF6DWs

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6497 78 KB
28 KB 31ms
26ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 22 Mar 2023 20:13:37 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/ Frame 6497 3 KB
1 KB 13ms
9ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/window_focus_fy2021.js

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 19:44:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 19:44:50 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/ Frame 6497 20 KB
8 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230320/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83dd1a8208a83ec90a9a2d7774ab28e4b93b3eba53fb6a3fd444eb7e389ecbff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 11:58:31 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29706
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8627
x-xss-protection: 0
server: cafe
etag: 8620137988422272387
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 11:58:31 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6497 158 KB
48 KB 22ms
19ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

fe14bc8a4e294c047589838fd09a3efc81771751a0be03ea8ec99e734e965fd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49540
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1679312138029146"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Mar 2023 20:13:37 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6497 42 B
173 B 45ms
42ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AJhULGuAbrIN1w9hg91dv87n4HqNSguVuph4WR89KvEkiO2o5m7vJDKl1ByrpItn9UWxcEmUViFKYfV-5o3cIWx_8gjP19zk_FcaV8efDs9TV8nXo

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6497 0
58 B 46ms
43ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5999483494518831624&x=1&ct=132

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230320/r20110914/elements/html/ Frame 0DD2 20 KB
8 KB 13ms
10ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230320/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0102fdfbd0b06f4718e32f6586659557a6234c0111940c1fa3d697c42b067c1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:58:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8563
x-xss-protection: 0
server: cafe
etag: 3720302941478166528
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 18:58:08 GMT

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.35/one-ad/ Frame 6F50 94 KB
12 KB 25ms
22ms Stylesheet
text/css 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.35/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 926a4ca073c39c40cabffbf1b0371803f245f084cdb9177fc7b3f9d81c0e394d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1677666448
age: 639605
cf-polished: origSize=96968
x-guploader-uploadid: ADPycduxnnyMRJTFaD4Dg7Hd8aRn6xTYu1PRy7TXWWh0GjCBxwAMZMkehaNAf-UCycuwqnGLPQWuj1EZCp5aL6ZRZOMYGSoR-sy7
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 01 Mar 2023 10:28:06 GMT
server: cloudflare
etag: W/"6110dc3a24c902508647a582294bcc25"
vary: Accept-Encoding
x-goog-generation: 1677666486645030
content-type: text/css
x-goog-hash: crc32c=6qzuyQ==, md5=YRDcOiTJAlCGR6WCKUvMJQ==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WigElxu4xBLlSip372c7xObWC8xrcNCl5igejJuMs7UMpOTDkKY5bGbFLC6IWZNLY8HRxzVuC89ofagsSOG70rFAJ5G%2BOGLnb4zIgmEztbai7TuHrORMH5Prqb36G0asCYjTzmDFxzg%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 96968
cf-ray: 7ac118a6ed5a3663-FRA
expires: Wed, 22 Mar 2023 21:13:37 GMT

GET
H2 200 B6C55515525C2192B97E1253116BAA5C685DD07AF79BB6C9C4097CAEDCCAF04D1DC2B7B5FD417FB88EA0B39E23DED47A8BBF448407373E4FBED422FA6A33EF14
assets.ad4m.at/logo/ Frame 6F50 26 KB
26 KB 53ms
35ms Image
image/webp 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/B6C55515525C2192B97E1253116BAA5C685DD07AF79BB6C9C4097CAEDCCAF04D1DC2B7B5FD417FB88EA0B39E23DED47A8BBF448407373E4FBED422FA6A33EF14
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90cbcae2f75cbdcf2a00d82c83cb2926f1a4ad7ab38eb3d629f2e7d3ad72410e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1295647
cf-polished: origFmt=png, origSize=53992
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 26236
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Jun 2022 14:47:26 GMT
server: cloudflare
etag: "e460905652d65e6a54a57da046f52d6c"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jnPJBX7X9yxQN7OnYhFLzDRLrA3NAQX8jJCmkSNZBfluLwl6aQ%2BJlRZSkdZmue%2BEBRsH1yiKlRlwXbRCN6J8%2BlldQj%2F3vCkcb44L8qOXMba2Hx0b%2B9QxY7g24lglvalzYLkB%2Faa9c8VET67%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7ac118a6f9479bf4-FRA
expires: Thu, 23 Mar 2023 20:13:37 GMT

GET
H2 200 A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
assets.ad4m.at/product_image/ Frame 6F50 91 KB
91 KB 38ms
27ms Image
image/png 2606:4700:20::681a:bd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/A36DAD0D440985CF6ABFA23492945CE5BC6D94350A66B19418CB771AFE823AD9B48ADE8E2F007546F0A50A710172EEFC2CAC1468E38852CE2028C22592AAFB75
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3222903b284496abdef15963fa04202511e222f17463bcd9d756e26e1effa08

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 208590
cf-polished: origSize=105738, status=vary_header_present
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 92686
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Jul 2022 08:55:40 GMT
server: cloudflare
etag: "147be38db57f89c69c9e65b05983ff0e"
vary: X-Goog-Allowed-Resources, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ES%2FOSE2QUNCwnPTCtfzWa%2FVi3vdmWNhpr6s7GdW%2F8dCgBn8XhGPl0Us82MhbF9wS19O90uPHbCj5ADJSlTjROKtGFnJX8OnRqHRRjwzIyxqRsI%2FB7KT5JmG4nRU%2BLrPks4Dg0m2p3L1VuxAZ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 7ac118a6f9419bf4-FRA
expires: Thu, 23 Mar 2023 20:13:37 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame C67F 0
176 B 88ms
19ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Wed, 22 Mar 2023 20:13:37 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C774
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1

43 B
632 B

14ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO6mwc4CEKHd9pAEGIOY-uEBMAE&v=APEucNWMFdPZb4k3V_mR6SmzsSnNN9TeJlNLBOF0-7aBGIH-lUYTxHGz5W99_Z021XlgI5J5fsLSt3gqZ5VVAEi3hpj7gbPB7IfVR6a8ByUvLIpc-WVE7rd0DbWydiArOJwhv9SLA6HpMBS9Gs4_LBKlMclZi8aNy1J0zy4Nl1BZRKAwciF6DWs
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 22 Mar 2023 20:13:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C774
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZBthcWIeQ4bq5WCgpmqk8AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1

43 B
632 B

12ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO6mwc4CEKHd9pAEGIOY-uEBMAE&v=APEucNWMFdPZb4k3V_mR6SmzsSnNN9TeJlNLBOF0-7aBGIH-lUYTxHGz5W99_Z021XlgI5J5fsLSt3gqZ5VVAEi3hpj7gbPB7IfVR6a8ByUvLIpc-WVE7rd0DbWydiArOJwhv9SLA6HpMBS9Gs4_LBKlMclZi8aNy1J0zy4Nl1BZRKAwciF6DWs
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 22 Mar 2023 20:13:37 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENyv9XRT9VrwjmviP6qv6tA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame C774
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEJoYoGqBHFUYmlv33odD--g&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJoYoGqBHFUYmlv33odD--g%26google_cver%3D1

43 B
1 KB

13ms
13ms

Image
image/gif

185.89.210.46
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJoYoGqBHFUYmlv33odD--g%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO6mwc4CEKHd9pAEGIOY-uEBMAE&v=APEucNWMFdPZb4k3V_mR6SmzsSnNN9TeJlNLBOF0-7aBGIH-lUYTxHGz5W99_Z021XlgI5J5fsLSt3gqZ5VVAEi3hpj7gbPB7IfVR6a8ByUvLIpc-WVE7rd0DbWydiArOJwhv9SLA6HpMBS9Gs4_LBKlMclZi8aNy1J0zy4Nl1BZRKAwciF6DWs

Protocol

HTTP/1.1

Server

185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 22 Mar 2023 20:13:37 GMT
AN-X-Request-Uuid: 9350810f-bf4e-4bb9-8375-ee8255794c43
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 146.70.117.102; 146.70.117.102; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 22 Mar 2023 20:13:37 GMT
AN-X-Request-Uuid: ee0bc2d9-7a39-4e0a-a52e-765b952a7c39
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEJoYoGqBHFUYmlv33odD--g%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 146.70.117.102; 146.70.117.102; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C774
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4NzAwODk0NTI3NTU0NjQzOQ%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4NzAwODk0NTI3NTU0NjQzOQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 22 Mar 2023 20:13:37 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 146.70.117.102; 146.70.117.102; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 0b2db830-7630-48ab-949b-6e720ddf9160
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjY4NzAwODk0NTI3NTU0NjQzOQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6497 0
20 B 48ms
47ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6242587785694&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6497 0
20 B 44ms
43ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6242587785694&version=m202301230201&ct=132&x=1&cor=5999483494518832000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6497 92 KB
37 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AeBqAaiT3X3byvQUri7JLluWsFrgeJaq_YfD7yvST5KhU3gelmWIhW42W1OxMJHnsCRom_86QBBkLfYFz-qx7wOhKmjAR1nrDq91PAdOA8geZB9XdCXTx5BDKtJnVn7k7dghF6OuIKKlM-1E6gFD9QxyEM2pk4rAL4N5bKF1L_dRDN6785SMgSKtABZd6Tr3KM3I31&cry=1&dbm_d=AKAmf-Dq1wTMQTaXw4JmttF9EA2twJ-ftDP7vZHzcCWe3Mg6IezEKq8B-Iw_2-G-WK4r30Onpr1nPW5FUYBMvFqw2RHUKUT3D6ea07eUFgwkoTaNNF78yI4X95YXRl4ZbIFMTzThYdc7A4nr5RRgSZbXHWNZUl247PIkU28umZ6LSpkObLinWwb8pT9ULKESuopLyCASGzyrEosFenKVMWublnyAoD1OjhK2rCS8oizerTiCfPP595Rhl6BVK1-ggFQlvIXSHxz42jD3ZAM7XTnfSEjqKG1nDh2H3fvbBF3hXPW-Se1_ql3g8k9ZUh6l_XCKym2tk8jTPh5j7fOeTFqiQritOYe6C5_y_3lzXA9oqRKlNo4l1cAhFDtbg0a2myWMjQmpanv8LtTmxH2iBVNBhGU9oZnmav3bvbi-Ng4e6sQ5IVk69i-tTM46im91dNbgzXi3tY5NFY3lpnTTSVrghFLxjo0oovMldGM2HlVdyrpC_2WAumiA60puUrNJMei8zVwjeQg7rve11uyJxPXPoRW0dccdZ2Nq9Ra1RLIjS5xGElDslHvPhmBQCWBbTba4SGKPF5qB_O_K3S-wK3VRA3hWIcDEjCRySSPJuRGjnZLjCgxActL0Gs4V0EG9YG8JmsytxyWrbz6LfM2NXeL6rIUXAtAVNWQbzo1tWVqstcAi8FARo2JJ0dCOYKXEksRa8ap4vppjOMNmJ4rEOPrpI1j7oK-JEAqlZWREuth7yoSXY2Dz3_1FBK8-2PgUh86npp-ZHDL-y9ny2WaUPljI3bxkwQRNTFGIQ-2tXOfz75GfFAgAtYHpRUpXWTydePYXzI6wvpDMLJ7LjuWR1JJj4AObGCyyvSf2fXU1bMlMw-e2S0QJZjghu4pF_XuY06wGoeNdcDpHcS3cOeyclccFnLAY6Ka6bCU4eKx_z32LcB2Cr4cAMAjHGPmYtwVqFT9Ao5aDYdVXGb9QvuUCf2yrwdwpS62vntgDbpUcnFJSMd7z_0HMxCrdsjNE2XuiqjmYq9PcsUxsKz8pLskYTnHN9kqGhE51oWClXlHAbtPiuJ0iBsi5C3fZwR24Iblgx1hS8nNM7JznbUeYUjxyLbdoilsDtjfvZNBqAYvgW9OsCGDBeSwexr8CK7X1v-DdiweZ7bKIUyuFRVdyhDK8qAIr-c7DJdsVgf5AEOX9MInQLszl27PfTa7jD9Ki9i-q3J1X6QHQBAGGKGYOiw5zveg4EhmtRMySgol_RNNen9orZdcMfcb2Yh6Llvh760SfNrxosWl2xlVhrtV1n1ulAaiRNAT8-NQTmp0c0XjZJ5rGw5VXITv72xLtsVHR2uMI3ZEwxcSGrsSffSH6UDhIAWU7r8jnBACiNlZjTh7TJR2AJL4neuW3kyIHW8kQ3vo4Vu94OawTENuWJZWRJWohywf0rSzSVREDinUERtO0-4kSCv2t7JpsTRfZlp_SI9Yo39yg9PO8T_Nj9G3us0HPd9jo1upWhbTOe1Ri7KM3e-qZR1FwKjIMYhl6osBLKoikpEB-33TF8qWJDeDDNaQcuDJl19qIJT0qEBoQej4nbpFVUH_gPw1KgtkFiY2Id5Ky7nUFHfV-CRn4tHQLy4NYotAbt8F87X6LhVOO0iqvyfJdQdRG3KnCjvJlb0kB827bMyoLJY2do2v8mGc21Amiyu3Mj44ji8ugUCPoQncqty8h2sCVkLgl1XwTdPEy4TnNsiuuS1CmYDpDXnn1joVBSB-KQdsvakXV-0VISYGOPI3AJ8qrRvyuHH8dvyhKiOzcwhRA-Se9C4K9WY7uHuY-skmyjLCmzcvV8e9PGHL5suJpTgBLFg8CcTpwXGF2FkUUp77lQ2L3hiMgHoFMq9shVa5JQzvbg0xEjs95Qj88UJpustiiC9kQDrVoRBdTmPBhSOQwk3yT2fbRDaI_XI6-4UzT6eGHvbjrHE7ysAUTD20pcnft84f-RupUNNUKxawNzfGNtMZW_tVKo2h5UHGTfyKoAA9JIc2JJxAyExU1OdyCzfC-QR4ASf8Zo8gUArttp22rjQlIYgWwI4KuBv5qhvM7EM3ROxUd7zx8t2cRlwPv7d3bgC9LJAP3RM-zq7Zds8My6RUaQ5G_P49KR_2T4fytQMl0-YpNAV3x9TMun5QaizEt58YoKqAq3dhga4MZqyZLWQy5bI4VjoFDZFj_JMvMjvszXUy7eRRJM7iogaQzRSUPZiuP5KXAGy-TJo5ZgDAAoHrXo-_aix_Prw76In0R9iKTC_durARnFSt8Lg4czLNW2TTUolTYAdy6_SvXG57Q_uVuGw-moCvfqo7yotQx1d4zuj1hPKCEAEtBm7iBWkqp0Zi-asv3Y3yf4vFaPQIUZVGbENfxtmbS753qesTJ5Oo7lNS4dOQ9zT5vBjwYnq3WebhKk5j3dXmfUSYfoMimbuEfHjGnp22QmPz406nHm5clE2lfIwvU7EBZijikHUzmXd4DuZaOPbkSrZF0ar3W9ZuVtjAJGDbBc-TGFyhasn69c5f1d-cxrZcTeK3QcmN7xSqi9GVzuWJLs8otf-wc84IAVLZoM--43hdNUborvJ3jiXhFeF2kqgSvopedU1-jwEMkOepb2JkqgUxRAKmvyjXpfIVUjIxvMqJnoI8Rk3CRUNx5uEeE7outMs76RrdZiAyAmtFr1O9TACNhptBsFOuN7OczyqOZ_vNK8yXhkHU9OWsXkhBvzWMsjEdD3I6e5efDdYExvDmT2_pM7KaQX_AOHzJKGHj8yDH2ZnL6O61-MYQi6G_pLNaCgSxCeqM7wZjGrIbY-VWYiYuFcOYDF4rXSveDgHZrw_PZEy96x0YszonI3dyzGNeFX7t3otNW-n6k1Z2VwOoyNnyTdaCfLlf3IoXrwmG--0D0ozkKlSCxI8mFf5iEQT0gVsPfXyGt-cltkkAYO91ZEOFPrhVQaqqAdw720YtFY-nDee1wDw8Js1OODM4qdl_vBqkgLg3aarTjWVr3ejFVCHQyB5c-eE0GY9jDXqAsuUt_B61qOIJvOE0WzKuf6VeDR0dyyJiXOGtp_TgqGl7imqoWkR1qO1oSwdUJA0jgOkOiT_uQiyTpFvY2uItJO0k1D4yKwlXVNBUy1IsrN4yxSslQcDTgudYX4EU5eIYu-IITL5gy6btYefnWvtX3TaMNQMcAzWDKR2q2yoLkY61pgAwgDI0OovkamDbKMhfMt2_VXMq7leIv4xQiq0z_wnA-ceNHjLVDqh4lk0nUVIj7fWV3xb6bmIL3wOjJ0na6Ozr8K3rGhIDrxI601H1pktjaAc9B8Lz3H2i0n-tMIsVyDkYMAuLY0tUPo6EfE4pvuUIWNagF_XRdGf5-LbYF-QI2HPLjCKvXo1vZjApod1b8-eJLC9CULgdECO-tpl3tnYCmVhfLsOT-nAtlMxiowHo41x4fUpw4YoGMwhDW13-DGnE1Iw8uAM9twlcJdEA16MSSAgcj9chKywmJ2-gDWK_eSXlb6ZUhMLDKYC0JgTnJ1UNUeq2cvcqCPOlscIK_TjUee1lYwzATKY8VX5a8RYrwHrwhsTRrnp_9SyvtSjF8MuPyMmc8EV6UJTgK0cmzXTlw-DyA6Q7nCnHRyiT9scGEgAfMBEyrKw2rJDYnJJGMWas-IGtIyNaihrlKK6MbalxWu7uzNcJW6zN-oWgDW_LKvJ5_W3YfELgvZTAaVOw0sNtovFBuBVDElteJWsr5JcELjykLj33yA7ispUK1bHFKiV7DKbbZIBzzGMtJFb0prp1hlL13CuTFNU7r7GmB98VXPJrlFeRPYU5rSuMZbLv5Il_YVB6oSJOvECb4sWfxZUvFz6FlemcmwOUYJsFCI20e3QK85nHkLNOnrQ6rAtPjHv1J5lV-piq8EQQtBfO8ngoMOyhds7fyvSVcg1mlqJDCcY6UxryBndoK_eINennYCMgw-jb2gghNgg7qvHtDpub6nHowH9wZ4p-bMe3ddNkc1PBKn3aQ6QbVEqjDQ1yvi6wTL6WXYbV99upYsfes67kTS7ROrO3Yh_5XjbBWxyfB1Vk2GRzk3WGDkw&cid=CAQSOwDUE5ym7Gx-ereyIke_G_LqPYeVWiYvEDjmAW1soSx7W9iPG7ULUwzq3NdpdE0A4d5nq1ThciAMgvnHGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fmestreemfinancas.com%2F&ds=l&xdt=1&iif=1&cor=5999483494518832000&adk=497053795&idt=40&cac=0&dtd=12

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d35a6bc1d3dfce567e618926e5bb4fce4e437f0b88ce41a07bc1b131bd2039c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38031
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 6F50 2 KB
2 KB 505ms
67ms Script
text/html 18.132.110.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1hqw7fmbjg6wk7ykjq870vf2p34wvb2ktznttw5kg1brjfktkhx78w80psrjgqnbcqymx8v0cmwp0e7h878zq0p26d68qnxxvk3mjcasxw6sz7skbg5kj2x9p0k7rpxd5qnws1abkq75d276ab2rja82mn9tef9g3610j0meqnb5g9296mvgtm0j62rmz23a4xpbxd3efdwwert3eqtznxd41vhn4jdkkkj1jxbycqm6whwkcjtve5q5kwaq7pwnngy0%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%252526client%25253Dca-pub-4894209870857905%252526adurl%25253D&clickref=oneidDXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjWoneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneideYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpboneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.132.110.241 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-132-110-241.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: b448b80138d66335bb75615b067a56d0e5d3522ff914ea30a27809f8618bbdd8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
last-modified: Wed, 22 Mar 2023 20:13:38 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 22 Mar 2023 20:14:38 GMT

GET
H3 200 2740767399393350 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 135ms
135ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2740767399393350?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c0147cfaf9052893e9a24a1dc6b565de3281b23436ab4d312b883e3cd40eec7d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:37 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: CtYIbJGZOkYSas7u3rlSd8Lth57l7oQdkIxrg8oHWvUhC1tIAVkaIgP2mRcuFOWYSwHTNtRQUaRaSV+iyKlL3w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 html_obb_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 6497 169 KB
60 KB 382ms
9ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd2056d3c5a5f9a087647154dc26dbed362a61b733a6cbc8d9e5330b4f4d4284

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Origin: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60459
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 23 Mar 2023 18:05:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230321/r20110914/elements/html/ Frame 6497 11 KB
4 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230321/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AeBqAaiT3X3byvQUri7JLluWsFrgeJaq_YfD7yvST5KhU3gelmWIhW42W1OxMJHnsCRom_86QBBkLfYFz-qx7wOhKmjAR1nrDq91PAdOA8geZB9XdCXTx5BDKtJnVn7k7dghF6OuIKKlM-1E6gFD9QxyEM2pk4rAL4N5bKF1L_dRDN6785SMgSKtABZd6Tr3KM3I31&cry=1&dbm_d=AKAmf-Dq1wTMQTaXw4JmttF9EA2twJ-ftDP7vZHzcCWe3Mg6IezEKq8B-Iw_2-G-WK4r30Onpr1nPW5FUYBMvFqw2RHUKUT3D6ea07eUFgwkoTaNNF78yI4X95YXRl4ZbIFMTzThYdc7A4nr5RRgSZbXHWNZUl247PIkU28umZ6LSpkObLinWwb8pT9ULKESuopLyCASGzyrEosFenKVMWublnyAoD1OjhK2rCS8oizerTiCfPP595Rhl6BVK1-ggFQlvIXSHxz42jD3ZAM7XTnfSEjqKG1nDh2H3fvbBF3hXPW-Se1_ql3g8k9ZUh6l_XCKym2tk8jTPh5j7fOeTFqiQritOYe6C5_y_3lzXA9oqRKlNo4l1cAhFDtbg0a2myWMjQmpanv8LtTmxH2iBVNBhGU9oZnmav3bvbi-Ng4e6sQ5IVk69i-tTM46im91dNbgzXi3tY5NFY3lpnTTSVrghFLxjo0oovMldGM2HlVdyrpC_2WAumiA60puUrNJMei8zVwjeQg7rve11uyJxPXPoRW0dccdZ2Nq9Ra1RLIjS5xGElDslHvPhmBQCWBbTba4SGKPF5qB_O_K3S-wK3VRA3hWIcDEjCRySSPJuRGjnZLjCgxActL0Gs4V0EG9YG8JmsytxyWrbz6LfM2NXeL6rIUXAtAVNWQbzo1tWVqstcAi8FARo2JJ0dCOYKXEksRa8ap4vppjOMNmJ4rEOPrpI1j7oK-JEAqlZWREuth7yoSXY2Dz3_1FBK8-2PgUh86npp-ZHDL-y9ny2WaUPljI3bxkwQRNTFGIQ-2tXOfz75GfFAgAtYHpRUpXWTydePYXzI6wvpDMLJ7LjuWR1JJj4AObGCyyvSf2fXU1bMlMw-e2S0QJZjghu4pF_XuY06wGoeNdcDpHcS3cOeyclccFnLAY6Ka6bCU4eKx_z32LcB2Cr4cAMAjHGPmYtwVqFT9Ao5aDYdVXGb9QvuUCf2yrwdwpS62vntgDbpUcnFJSMd7z_0HMxCrdsjNE2XuiqjmYq9PcsUxsKz8pLskYTnHN9kqGhE51oWClXlHAbtPiuJ0iBsi5C3fZwR24Iblgx1hS8nNM7JznbUeYUjxyLbdoilsDtjfvZNBqAYvgW9OsCGDBeSwexr8CK7X1v-DdiweZ7bKIUyuFRVdyhDK8qAIr-c7DJdsVgf5AEOX9MInQLszl27PfTa7jD9Ki9i-q3J1X6QHQBAGGKGYOiw5zveg4EhmtRMySgol_RNNen9orZdcMfcb2Yh6Llvh760SfNrxosWl2xlVhrtV1n1ulAaiRNAT8-NQTmp0c0XjZJ5rGw5VXITv72xLtsVHR2uMI3ZEwxcSGrsSffSH6UDhIAWU7r8jnBACiNlZjTh7TJR2AJL4neuW3kyIHW8kQ3vo4Vu94OawTENuWJZWRJWohywf0rSzSVREDinUERtO0-4kSCv2t7JpsTRfZlp_SI9Yo39yg9PO8T_Nj9G3us0HPd9jo1upWhbTOe1Ri7KM3e-qZR1FwKjIMYhl6osBLKoikpEB-33TF8qWJDeDDNaQcuDJl19qIJT0qEBoQej4nbpFVUH_gPw1KgtkFiY2Id5Ky7nUFHfV-CRn4tHQLy4NYotAbt8F87X6LhVOO0iqvyfJdQdRG3KnCjvJlb0kB827bMyoLJY2do2v8mGc21Amiyu3Mj44ji8ugUCPoQncqty8h2sCVkLgl1XwTdPEy4TnNsiuuS1CmYDpDXnn1joVBSB-KQdsvakXV-0VISYGOPI3AJ8qrRvyuHH8dvyhKiOzcwhRA-Se9C4K9WY7uHuY-skmyjLCmzcvV8e9PGHL5suJpTgBLFg8CcTpwXGF2FkUUp77lQ2L3hiMgHoFMq9shVa5JQzvbg0xEjs95Qj88UJpustiiC9kQDrVoRBdTmPBhSOQwk3yT2fbRDaI_XI6-4UzT6eGHvbjrHE7ysAUTD20pcnft84f-RupUNNUKxawNzfGNtMZW_tVKo2h5UHGTfyKoAA9JIc2JJxAyExU1OdyCzfC-QR4ASf8Zo8gUArttp22rjQlIYgWwI4KuBv5qhvM7EM3ROxUd7zx8t2cRlwPv7d3bgC9LJAP3RM-zq7Zds8My6RUaQ5G_P49KR_2T4fytQMl0-YpNAV3x9TMun5QaizEt58YoKqAq3dhga4MZqyZLWQy5bI4VjoFDZFj_JMvMjvszXUy7eRRJM7iogaQzRSUPZiuP5KXAGy-TJo5ZgDAAoHrXo-_aix_Prw76In0R9iKTC_durARnFSt8Lg4czLNW2TTUolTYAdy6_SvXG57Q_uVuGw-moCvfqo7yotQx1d4zuj1hPKCEAEtBm7iBWkqp0Zi-asv3Y3yf4vFaPQIUZVGbENfxtmbS753qesTJ5Oo7lNS4dOQ9zT5vBjwYnq3WebhKk5j3dXmfUSYfoMimbuEfHjGnp22QmPz406nHm5clE2lfIwvU7EBZijikHUzmXd4DuZaOPbkSrZF0ar3W9ZuVtjAJGDbBc-TGFyhasn69c5f1d-cxrZcTeK3QcmN7xSqi9GVzuWJLs8otf-wc84IAVLZoM--43hdNUborvJ3jiXhFeF2kqgSvopedU1-jwEMkOepb2JkqgUxRAKmvyjXpfIVUjIxvMqJnoI8Rk3CRUNx5uEeE7outMs76RrdZiAyAmtFr1O9TACNhptBsFOuN7OczyqOZ_vNK8yXhkHU9OWsXkhBvzWMsjEdD3I6e5efDdYExvDmT2_pM7KaQX_AOHzJKGHj8yDH2ZnL6O61-MYQi6G_pLNaCgSxCeqM7wZjGrIbY-VWYiYuFcOYDF4rXSveDgHZrw_PZEy96x0YszonI3dyzGNeFX7t3otNW-n6k1Z2VwOoyNnyTdaCfLlf3IoXrwmG--0D0ozkKlSCxI8mFf5iEQT0gVsPfXyGt-cltkkAYO91ZEOFPrhVQaqqAdw720YtFY-nDee1wDw8Js1OODM4qdl_vBqkgLg3aarTjWVr3ejFVCHQyB5c-eE0GY9jDXqAsuUt_B61qOIJvOE0WzKuf6VeDR0dyyJiXOGtp_TgqGl7imqoWkR1qO1oSwdUJA0jgOkOiT_uQiyTpFvY2uItJO0k1D4yKwlXVNBUy1IsrN4yxSslQcDTgudYX4EU5eIYu-IITL5gy6btYefnWvtX3TaMNQMcAzWDKR2q2yoLkY61pgAwgDI0OovkamDbKMhfMt2_VXMq7leIv4xQiq0z_wnA-ceNHjLVDqh4lk0nUVIj7fWV3xb6bmIL3wOjJ0na6Ozr8K3rGhIDrxI601H1pktjaAc9B8Lz3H2i0n-tMIsVyDkYMAuLY0tUPo6EfE4pvuUIWNagF_XRdGf5-LbYF-QI2HPLjCKvXo1vZjApod1b8-eJLC9CULgdECO-tpl3tnYCmVhfLsOT-nAtlMxiowHo41x4fUpw4YoGMwhDW13-DGnE1Iw8uAM9twlcJdEA16MSSAgcj9chKywmJ2-gDWK_eSXlb6ZUhMLDKYC0JgTnJ1UNUeq2cvcqCPOlscIK_TjUee1lYwzATKY8VX5a8RYrwHrwhsTRrnp_9SyvtSjF8MuPyMmc8EV6UJTgK0cmzXTlw-DyA6Q7nCnHRyiT9scGEgAfMBEyrKw2rJDYnJJGMWas-IGtIyNaihrlKK6MbalxWu7uzNcJW6zN-oWgDW_LKvJ5_W3YfELgvZTAaVOw0sNtovFBuBVDElteJWsr5JcELjykLj33yA7ispUK1bHFKiV7DKbbZIBzzGMtJFb0prp1hlL13CuTFNU7r7GmB98VXPJrlFeRPYU5rSuMZbLv5Il_YVB6oSJOvECb4sWfxZUvFz6FlemcmwOUYJsFCI20e3QK85nHkLNOnrQ6rAtPjHv1J5lV-piq8EQQtBfO8ngoMOyhds7fyvSVcg1mlqJDCcY6UxryBndoK_eINennYCMgw-jb2gghNgg7qvHtDpub6nHowH9wZ4p-bMe3ddNkc1PBKn3aQ6QbVEqjDQ1yvi6wTL6WXYbV99upYsfes67kTS7ROrO3Yh_5XjbBWxyfB1Vk2GRzk3WGDkw&cid=CAQSOwDUE5ym7Gx-ereyIke_G_LqPYeVWiYvEDjmAW1soSx7W9iPG7ULUwzq3NdpdE0A4d5nq1ThciAMgvnHGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fmestreemfinancas.com%2F&ds=l&xdt=1&iif=1&cor=5999483494518832000&adk=497053795&idt=40&cac=0&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3501a3f0a7b6bc47f9f81c7be85b3603816fe2d3026ab4b396127ed9eb8895c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 15:16:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17846
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4115
x-xss-protection: 0
server: cafe
etag: 1914039858798321668
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 15:16:11 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230321/r20110914/ Frame 6497 28 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230321/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11f1414c6342d8a5a5124286921298b09b1e776f0aae7bbc4c83b96685166019

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 15:16:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17835
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10980
x-xss-protection: 0
server: cafe
etag: 17255800071175307161
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 05 Apr 2023 15:16:22 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012302271541000/ Frame 17D0 221 KB
61 KB 315ms
9ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae9552d446982cedbbeb56c92ec7461d79f2e7734efa66bd0633e095b12d645

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 18 Mar 2023 03:24:11 GMT
age: 406167
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61845
x-xss-protection: 0
server: sffe
etag: "4fba9ccee66ca96a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 17 Mar 2024 03:24:11 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame 17D0 15 KB
5 KB 325ms
20ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46b2829524e1ffcfacb15998bbe38941bfbf6110ce8f028d8117efcdbd8273fb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 22 Mar 2023 10:06:00 GMT
age: 36458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5236
x-xss-protection: 0
server: sffe
etag: "cedf9691907d886d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Mar 2024 10:06:00 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame 17D0 94 KB
28 KB 328ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e76a81d16824d3288fd16917a64dd4ed831b530e14f9f9e37b56d014eb585f5e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 22 Mar 2023 10:06:00 GMT
age: 36458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28954
x-xss-protection: 0
server: sffe
etag: "eb54a928dd76f593"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Mar 2024 10:06:00 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame 17D0 5 KB
2 KB 330ms
25ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58788a30af68f92836329a22bed11ee437cdcc310cc9697f53d7a06142ad1416

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Mar 2023 22:43:59 GMT
age: 422979
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1898
x-xss-protection: 0
server: sffe
etag: "aaf5c93962f41d5e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Mar 2024 22:43:59 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame 17D0 40 KB
13 KB 331ms
26ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b150d9b4151f7cd309c4c7808de642e3030efcdbc40f3bec35ae1c87e17b111a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 22 Mar 2023 10:06:00 GMT
age: 36458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12965
x-xss-protection: 0
server: sffe
etag: "2e1a930b1f14d060"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Mar 2024 10:06:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 17D0 8 KB
895 B 21ms
21ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 22 Mar 2023 20:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 18:56:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Mar 2023 20:13:37 GMT

GET
H3 200 pt.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 17D0 3 KB
3 KB 8ms
8ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/pt.png

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

744b436600cd35e7898be8843c04c1115c45bf08143d085ac149e8c4f8151e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:12 GMT
x-content-type-options: nosniff
server: cafe
age: 7705
etag: 7735524722462771930
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2886
x-xss-protection: 0
expires: Thu, 23 Mar 2023 18:05:12 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 17D0 344 B
368 B 9ms
8ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
x-content-type-options: nosniff
server: cafe
age: 7706
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Thu, 23 Mar 2023 18:05:11 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 17D0 0
0 17ms
17ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRszxRrJO7F4YMQwgkJPK7BTyJ0XSkw5P8IVbcInQgE8EJ8RZ5r6Yei0VUfaDXley_kKbwKB-plP3KorpE0tNwz_3zWFQ
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6497 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Sun, 19 Mar 2023 09:39:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 297257
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 18 Mar 2024 09:39:21 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 40CE 1 KB
643 B 7ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 8821
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 17:46:37 GMT
etag: 48472445140208031
expires: Thu, 23 Mar 2023 17:46:37 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 9038410082867569 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 140ms
140ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/9038410082867569?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2e3fca3b6adcefb77b53a3088ac08e65951566785a9bfc895bbcccd05745c863

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:38 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: UFzx/A0qXW+IeO6/o3WFB5gJmqdJUjrY73Q8x2fevAdkTdko1jbAVoQGUaag2IQjGs6rtCFsYMiReZCDdfV9hQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3FBB 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 368848
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Mar 2023 13:46:10 GMT
expires: Sun, 17 Mar 2024 13:46:10 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/ Frame 6526 62 KB
14 KB 32ms
16ms Document
text/html 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/index.html?e=69&leftOffset=0&topOffset=0&c=NFbU44Mfth&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3085aac649fa0d732e9fd1e54e0ce46f115238e1c115a7f7ce9de4bc416ab551

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 14745
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-richmedia-studio-eng"
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:38 GMT
expires: Wed, 22 Mar 2023 21:03:38 GMT
last-modified: Thu, 30 Dec 2021 12:48:00 GMT
report-to: {"group":"ads-richmedia-studio-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-richmedia-studio-eng"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 40CE
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEIdLS4Q25EGq5G0nromIWvU&google_cver=1&google_push=Aa02lx_sLRWiJbhshlmeCYx4zGgH2yAlEH8zLALJdHs1hl9FqLK0q0wuXi9gPc9Bg2tSfKIi4xPRwvt8_IPM9NP3yfGwn4Jjct5O
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=8D431E48F41945A3B08D5BBA80021651&google_push=Aa02lx_sLRWiJbhshlmeCYx4zGgH2yAlEH8zLALJdHs1hl9FqLK0q0wuXi9gPc9Bg2tSfKIi4xPRwvt8_IPM9NP...

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=8D431E48F41945A3B08D5BBA80021651&google_push=Aa02lx_sLRWiJbhshlmeCYx4zGgH2yAlEH8zLALJdHs1hl9FqLK0q0wuXi9gPc9Bg2tSfKIi4xPRwvt8_IPM9NP3yfGwn4Jjct5O

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 22 Mar 2023 20:13:38 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=8D431E48F41945A3B08D5BBA80021651&google_push=Aa02lx_sLRWiJbhshlmeCYx4zGgH2yAlEH8zLALJdHs1hl9FqLK0q0wuXi9gPc9Bg2tSfKIi4xPRwvt8_IPM9NP3yfGwn4Jjct5O
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 21 Mar 2023 20:13:38 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 40CE
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEDkuQP3fxM7KVEnHl2oVvVo&google_cver=1&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVV...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEDkuQP3fxM7KVEnHl2oVvVo&google_cver=1&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3I...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVVvvOSH

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVVvvOSH

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=Aa02lx9cg0LX-_EKGo_SZpVW-TCidaGEoBZjowBtBxH51LUQpKzUGRWZSacPA_d0TYdi_M5oPLsayJ4m8yHhqdSIFJx3IVVvvOSH
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 40CE
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESELaox9ZuBFQfqS-T_kdCZsc&google_cver=1&google_push=Aa02lx8imCpmnmxSOq7MBxbTJmlFSZJ95J9wfyp91xdDS9fd4cVxlxipA7fGiri0ejNYUcl-owNVSpfHIujfR2eRibZSVHG-OEsc
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aa02lx8imCpmnmxSOq7MBxbTJmlFSZJ95J9wfyp91xdDS9fd4cVxlxip...

170 B
188 B

30ms
30ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aa02lx8imCpmnmxSOq7MBxbTJmlFSZJ95J9wfyp91xdDS9fd4cVxlxipA7fGiri0ejNYUcl-owNVSpfHIujfR2eRibZSVHG-OEsc

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MjQ2MTMwMjIxODY2NDQyNDA2MDYwMw%3D%3D&google_push=Aa02lx8imCpmnmxSOq7MBxbTJmlFSZJ95J9wfyp91xdDS9fd4cVxlxipA7fGiri0ejNYUcl-owNVSpfHIujfR2eRibZSVHG-OEsc
date: Wed, 22 Mar 2023 20:13:38 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 40CE 0
75 B 25ms
22ms Image
text/plain 185.86.138.151
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEEA2dNDE9366fm8egUTGyVg&google_cver=1&google_push=Aa02lx_amcik2RFphhme2YgJXg-R8IKw9p5IIhx4kbi823Jmv-DK7Iu-riSKUWD7726PyQ-ymf3giiPXZ8yjvgEwMqNgVbZv8s44
Requested by: Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.151 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 40CE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEHaKl3IM4subPQDpmqQ684I&google_cver=1&google_push=Aa02lx_baPDhf6Xih9lsGJ9yQ3iqBGO8m6E_cgEMP4AwVmvNjnx8dQb7cpOsRCvfyCNZV8EaoU...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aa02lx_baPDhf6Xih9lsGJ9yQ3iqBGO8m6E_cgEMP4AwVmvNjnx8dQb7c...

170 B
188 B

28ms
28ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aa02lx_baPDhf6Xih9lsGJ9yQ3iqBGO8m6E_cgEMP4AwVmvNjnx8dQb7cpOsRCvfyCNZV8EaoUzSSHCVT9khapZ3KmklVZ3lzK47Hw

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1Yd2FndE41RTJ1RjY5SHJCSmhDbGtwNnEyRElxRmdzaX5B&google_push=Aa02lx_baPDhf6Xih9lsGJ9yQ3iqBGO8m6E_cgEMP4AwVmvNjnx8dQb7cpOsRCvfyCNZV8EaoUzSSHCVT9khapZ3KmklVZ3lzK47Hw
date: Wed, 22 Mar 2023 20:13:38 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

report
sync.teads.tv/um/ Frame 40CE
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEC2tYn6oTMhOK8dEbvCVCNQ&...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=Aa02lx-iyiRbXeh2ALT2Q8YBnn4VWTZfofK_MmszLk_nZHdaS31JnRJjDcoj5HSPodmcU-rNZaEPdLPjV6kY3FZj_5MqsA12Canb7A
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
172 B

58ms
58ms

Image
image/gif

23.213.169.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 23.213.169.115 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-213-169-115.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

expires: Wed, 22 Mar 2023 20:13:38 GMT
pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 40CE
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEHxwRCUT4...
https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ffc97331-03d3-44ea-92bd-2804c35ede27&%%GOOGLE_PUSH_PAIR%%

170 B
188 B

20ms
20ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ffc97331-03d3-44ea-92bd-2804c35ede27&%%GOOGLE_PUSH_PAIR%%

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=the_mediagrid_eb&google_hm=ffc97331-03d3-44ea-92bd-2804c35ede27&%%GOOGLE_PUSH_PAIR%%
date: Wed, 22 Mar 2023 20:13:38 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 40CE 0
12 B 18ms
16ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LfzQcre7jyIaiegESOBI3-C1q6F5WFQtK5vgO-nWhPn5d8dC6x_HzJQ3ZbXFzfpsjlgGNzDeGf

Requested by

Host: 64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
URL: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 17D0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

21ms
21ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H3
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Redirect headers

date: Wed, 22 Mar 2023 20:13:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 6526 2 KB
539 B 19ms
18ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/index.html?e=69&leftOffset=0&topOffset=0&c=NFbU44Mfth&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 22 Mar 2023 20:13:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 19:02:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Mar 2023 20:13:38 GMT

GET
H2 200 gwd_webcomponents_min.js Show response
www.gstatic.com/external_hosted/gwd_webcomponents/ Frame 6526 16 KB
6 KB 107ms
50ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/external_hosted/gwd_webcomponents/gwd_webcomponents_min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edcf7e9d00cf9801aa15790eed1b8eca5c403d8ee03c323f042562b426a8a8db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5563
x-xss-protection: 0
last-modified: Sat, 01 Oct 2022 02:38:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=0
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 22 Mar 2023 20:13:38 GMT

GET
H3 200 Enabler_01_238.js Show response
s0.2mdn.net/879366/ Frame 6526 106 KB
36 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_238.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80c7fe7749a6e8c85fa6473e7bbba5c5dc6ffe20a86036de26d91bd4b9a4e8d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/index.html?e=69&leftOffset=0&topOffset=0&c=NFbU44Mfth&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36751
x-xss-protection: 0
last-modified: Tue, 11 Jun 2019 21:21:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 23 Mar 2023 18:05:11 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6F50 85 KB
31 KB 159ms
51ms Script
text/javascript 13.32.145.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3641431&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1hqw7fmbjg6wk7ykjq870vf2p34wvb2ktznttw5kg1brjfktkhx78w80psrjgqnbcqymx8v0cmwp0e7h878zq0p26d68qnxxvk3mjcasxw6sz7skbg5kj2x9p0k7rpxd5qnws1abkq75d276ab2rja82mn9tef9g3610j0meqnb5g9296mvgtm0j62rmz23a4xpbxd3efdwwert3eqtznxd41vhn4jdkkkj1jxbycqm6whwkcjtve5q5kwaq7pwnngy0%26a%3Dhttps%253A%252F%252Fas.ad4m.at%252Fdct%253Fed%253D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%2526h%253Dhttps%25253A%25252F%25252Fadclick.g.doubleclick.net%25252Faclk%25253Fsa%25253DL%252526ai%25253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%252526num%25253D1%252526sig%25253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%252526client%25253Dca-pub-4894209870857905%252526adurl%25253D&clickref=oneidDXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjWoneid__suite_Netmix_Reach128_WEBGAINSMOSTLY&viewref=oneideYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpboneid__suite_Netmix_Reach128_WEBGAINSMOSTLY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.145.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-145-6.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 17:26:42 GMT
content-encoding: gzip
via: 1.1 4123f5d267403eba4e7db5e4d8d9a6e0.cloudfront.net (CloudFront)
last-modified: Wed, 15 Mar 2023 17:26:29 GMT
server: AmazonS3
x-amz-cf-pop: CDG50-C2
age: 10017
etag: W/"876c293e6c37046ecb0c11ce2e276942"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: f1GCVQdL2TWEkBTeKHuMKa-wF2TKLUZ9yPNJMCZs_bXW89AijPFBOw==

GET
H2 200 1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png
cdn.track.production.webgains.team/286305/ Frame 6F50 15 KB
15 KB 682ms
232ms Image
image/png 18.64.141.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/286305/1619604937_fPkEZHu3MNy3GC7XuV3lA1s9E5XlSAcF.png?Expires=1679516318&Signature=JdFz39p7jKhOx-sQBjl2Rrs89P5ZsYLF~OS77lfQUpP~CRjVJ0UYeh92qnpt8MC3QArB7-K7wp~1enC-MDxyIa8Il57avuHUcg2lPfIzfrdmRyI4M7rm40LCh2HJQLnx350quTa~BcxCqmAeTQ5~kxMdlNMNrOwpsO4f0ceiInrpXqrnBrUoXBL0UajOco7EZ1L9GnDVbB6gHUNnu6ZWRcLCxDDiy2IsjvyLFUl6cMgYjZba0rlpTFj4S-1Qzhq06D4zBSFEpPKdm~vY1ck1cFv~-Sx9q1I4nYmVibD5UvF2Oq~-O3BrrQnsDZnL9-wNlUT9y93tjcHOHD50wz-fBQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197862&b=eYdU3fVfreQGCjHZHet1tXpEZfwSQTKrACYXpb&f=DXdT3fwfGjkQU3HmH9twCkp9QCxSmTYW3aXdjW&c=320&d=50&e=&g=6dcb80db1b5975a4e68828646e35dfd2%2F3010234162176904827&i=71725&j=21&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach128_WEBGAINSMOSTLY&r=1679516017667&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jmzz35ky7b0sv3wff1k22bjea0bj4ttatz6zqjt7e23zac4arhm7gbqmhzn4jfdejx32d3mp5efagk3xb556jswqn4xrzyqbc15ejz441bfjqth991xzn58vhyezhhwbmkfz279fpt6cwqsa2mn7fkyfe9kc1bydtz9rhhf5vybacbc53ff3mqa979fwcxgvjf2g2c1rr11facge1j859exrpjwrbwx1f4bvnjtc970zpf5feea9x8vdn7f05q2s78j553e25h040et22pqb9gahw%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCv25LcWEbZIw92onZ9w-loLPYCpDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTQ4OTQyMDk4NzA4NTc5MDXIAQmpAnAVlr1wG7I-4AIAqAMBqgTXAk_QxrHCjIAf2UixZFterL1-PZRdYXY955knzoYRQ8WKaEh5mhH3UXoiRJFQ_W-i5LWNq4tI0x8aLrdsoG3iB7HqbAht4WqxlVswUju3WL9wvBS9UFdD_hb9BIqQK_yQBIW_WgKnjwRa_iJ89PiZ3r6AJKEI3e2V22ZYoiMdzVvmxBez_bgPwTL1S6jj9UN2QJu7j5o_rb2cJ5qfe4Pz9mcgEAHYFQjp3O3y86TCRMp6tDISqwVHl-XZ-uAfMP-KKFaiS82dIG7QMcpGGBM_jx-wrAyd3zNjjlrceNhwFC4RsmzFDlBJm26-dx8rPrLziSsfDbGQnf1-5kMsrTeE2nydBhbiTY5an0eOThATVLbJd-stcMnGVkVZ5vqT-ZYBlGWZ7n38e-zzsIDhq5DmBt87O44R06lQj-Xf5HkpEyyFuMroWv5KwZ1d2HG4s_C8LXS4WBE9IojgBAGABrHCidmg6dXLkAGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_2lNeZ8B84BNNKPrQcTFUmDZrGuxw%2526client%253Dca-pub-4894209870857905%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.64.141.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-64-141-41.mct50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60bf02832688d14251ec1c7b8acfda233a91f927f26c7202bdaba781a1f0fcdf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Wed, 22 Mar 2023 00:57:33 GMT
via: 1.1 4e2901614196bfe90fb50b501afa539c.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 10:41:35 GMT
server: AmazonS3
x-amz-cf-pop: MCT50-P1
age: 69366
etag: "d4e8f970f24f6d19b53aa92b1907c1ef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 15054
x-amz-cf-id: _D8GJqXsuAatbg9oylFVAlxvSnZpJ9zgqHC7Ahamgmkp86yxRluVrw==

GET
H3 200 TU2PSynrXT7p2KnzXte8fEgQWf4_RAVzpVc0SCm-B08.js Show response
pagead2.googlesyndication.com/bg/ Frame 3FBB 36 KB
14 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TU2PSynrXT7p2KnzXte8fEgQWf4_RAVzpVc0SCm-B08.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d4d8f4b29eb5d3ee9d8a9f35ed7bc7c481059fe3f440573a557344829be074f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 15:30:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 103388
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14279
x-xss-protection: 0
last-modified: Mon, 20 Mar 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Mar 2024 15:30:30 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012302271541000/ Frame AFB7 221 KB
60 KB 26ms
23ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae9552d446982cedbbeb56c92ec7461d79f2e7734efa66bd0633e095b12d645

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 18 Mar 2023 03:24:11 GMT
age: 406167
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61845
x-xss-protection: 0
server: sffe
etag: "4fba9ccee66ca96a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 17 Mar 2024 03:24:11 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame AFB7 15 KB
5 KB 31ms
28ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46b2829524e1ffcfacb15998bbe38941bfbf6110ce8f028d8117efcdbd8273fb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 22 Mar 2023 10:06:00 GMT
age: 36458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5236
x-xss-protection: 0
server: sffe
etag: "cedf9691907d886d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Mar 2024 10:06:00 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame AFB7 94 KB
28 KB 32ms
30ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e76a81d16824d3288fd16917a64dd4ed831b530e14f9f9e37b56d014eb585f5e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 22 Mar 2023 10:06:00 GMT
age: 36458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28954
x-xss-protection: 0
server: sffe
etag: "eb54a928dd76f593"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Mar 2024 10:06:00 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame AFB7 5 KB
2 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58788a30af68f92836329a22bed11ee437cdcc310cc9697f53d7a06142ad1416

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Mar 2023 22:43:59 GMT
age: 422979
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1898
x-xss-protection: 0
server: sffe
etag: "aaf5c93962f41d5e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Mar 2024 22:43:59 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012302271541000/v0/ Frame AFB7 40 KB
13 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012302271541000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b150d9b4151f7cd309c4c7808de642e3030efcdbc40f3bec35ae1c87e17b111a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 22 Mar 2023 10:06:00 GMT
age: 36458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12965
x-xss-protection: 0
server: sffe
etag: "2e1a930b1f14d060"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Thu, 21 Mar 2024 10:06:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame AFB7 8 KB
895 B 42ms
41ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 22 Mar 2023 20:13:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 22 Mar 2023 19:01:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 22 Mar 2023 20:13:38 GMT

GET
H3 200 pt.png
tpc.googlesyndication.com/pagead/images/abg/ Frame AFB7 3 KB
3 KB 25ms
24ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/pt.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

744b436600cd35e7898be8843c04c1115c45bf08143d085ac149e8c4f8151e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:12 GMT
x-content-type-options: nosniff
server: cafe
age: 7706
etag: 7735524722462771930
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2886
x-xss-protection: 0
expires: Thu, 23 Mar 2023 18:05:12 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame AFB7 344 B
368 B 32ms
31ms Image
image/png 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
x-content-type-options: nosniff
server: cafe
age: 7707
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Thu, 23 Mar 2023 18:05:11 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AFB7 0
0 39ms
38ms Image
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS6JQNrQkytWj9g2X3WgdMtbNSTD0SXOIKWrvXd6IS31_41W7OK0UQPbYufeXiwgEFbSjKWPaM8jqyi8Gr2YhVF16Mcug
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame AFB7 0
0 71ms
71ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CRTnVcWEbZPKcNY-2zAaJwInAC-XEyKBvi86diJER5ta8ia4PEAEgpJ2XjwFgleKQgqAHoAGI8Y2HKcgBAakCy5Ka-rWDiT7gAgCoAwHIAwqqBLgCT9BSHhZPWOwxQk9Wmmao2fggdN-2nF1xMpqM7ZGnlc_dV3CpzXK3-oMGiddsxG9RZbzSVe7-h7RDFyF7X2fvq-eRHrvecsiNBNRsRh_QJF-nbA7I8_4cyX0y2tsVHZ6OjPZHXa_56wNnP3jThboHm832pgLAPDr_ftopGYXkQpFLjpYLnW-CjNPj_o0BGBUGS8iw_RwaJHUowsjHuaAGy-a4pqrSjAz7BIxcfHQ4_8jB_NSwyq8B7E0ieeMxbQ6Tt7w2NeVKtarmQ-cL4ZZFhVJFnmimFnAcRV_dHLDOQAsq9EabDVCcTcdOKcSFI4CsS8voz_imDCuqJDS76LfsTo49tJPVNswlCvdi5Iw3PSJTVtKifVN4Mwm_WCZbEMowKLx1xP-vr2YiAz0p-x1AVRFNLQklcnhuwASpn538pgTgBAGSBQQIBBgBkgUECAUYBKAGZoAHiKne5gOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBC3tSjSCBEIgOGAEBABGB0yAqoCOgKAQIAKA8gLAdgTDdAVAYAXAbIXHgocCAASFHB1Yi04NTE5NTY2NDAxODUxMjM2GNPafg&sigh=vDJ9sDa1iys&uach_m=[UACH]&cid=CAQSOwDUE5ymAtTsfTzK0w2-qfsE9DZ_-Pr9e10YQzPl3kqJDSUcmgqOokGkHGbqF3uX9LBP5xohFwVFxJHXGAE
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame AFB7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6671e599ffd30d54da527cf3a255350318fe9402827dd3e839bb62458fa6d9ad

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 507317848148093 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 152ms
141ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/507317848148093?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9b2a32cad15696155a3c1874a48fa11fc6d73278569e387df98f19ac1029f65f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:38 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 5iKp8oR8XNNHY2QYPg/6xdx7LB1/CGGxnox2C7xBkcivsTM7pUdg1/iMpmQ19ZNBmZEyhIKArTAYmRbY+/xa1A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame AFB7 28 KB
28 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mestreemfinancas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Tue, 21 Mar 2023 08:37:38 GMT
x-content-type-options: nosniff
age: 128160
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Mar 2024 08:37:38 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame AFB7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

21ms
20ms

Image
text/html

2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H3
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Redirect headers

date: Wed, 22 Mar 2023 20:13:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6497 8 KB
6 KB 66ms
50ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=latest&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3310d0b720bd3ac611780ecc8f07e3ddc4958235c8b626ec03e94b1a2bf8601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5927
x-xss-protection: 0

GET
H3 200 prod_studio_01_238_configurablemodule.js Show response
s0.2mdn.net/879366/ Frame 6526 31 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_238_configurablemodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_238.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf9a6d2d58d42b5239d8c9405c627d9c995f11eb4e2807be1f4f142028dd5f9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/index.html?e=69&leftOffset=0&topOffset=0&c=NFbU44Mfth&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10829
x-xss-protection: 0
last-modified: Tue, 11 Jun 2019 21:21:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 23 Mar 2023 18:05:11 GMT

GET
H3 200 11351990575487261858
s0.2mdn.net/simgad/ Frame 6526 4 KB
4 KB 8ms
7ms Image
image/png 2a00:1450:4001:80b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11351990575487261858

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68f8b357a624a2f4e7ee991c1d05207220f4b34f814f7ebd7355dcb564618310

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/mu/templates/brand_awareness_blanket/responsive/V2/index.html?e=69&leftOffset=0&topOffset=0&c=NFbU44Mfth&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:32 GMT
x-content-type-options: nosniff
age: 7686
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3754
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 09:12:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Mar 2024 18:05:32 GMT

GET
DATA 200
OK truncated
/ Frame 6526 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6497 17 KB
6 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 22 Mar 2023 20:13:38 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FBB 0
20 B 47ms
47ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bv7YHcWEbZL71MJaJ7gPwu7dQAAAAADgB4AQC&bg=!4eKl4rbNAAbO2UOH7tk7ADkAdvg8WjcnNLeuXTeVmValNnrkEbXocTt445d25MzqnX8WbdKUNaM-Au8bUPsInQrbM0a2Nuh3KwECAAAA7FIAAAADaAEHmQNBygRr4ZQMg159Jphm4rD4MlzRUKodML38dLq0Xvc6viCpsoNpZIrKSdj5rsBPHgllyYmyQf35-iIktQqD0mzzNZ3KfdCrO3gXMHifbJI4QJBWhht6vPCVLA-d43DgBhF0yXIm6xMwy4gd1Dw8mrWDbzkuAUAAiPFJArE2Q8gxTBkMhhKSLtx0BYbYgX-Eb3QH2v_GPwuNYETRfqI3PnRraB2g3E7CYgiR1Eci0r-3OyruRW8ePY5LWdm7E_ipJ89uM8WPv4pT_-eX4f5H8AOpSAj25fQboSZNVjMRoD9L0Z009IgYTevjkf4NJRRf7iMMx3qp05Cosu0emgBvZZz9zcahNPJDBAWNXQD7qRkHQM7yqCi91p6kWrPES9EX19cXu2HheUiLXWmfVqUzuJ9g942gF_sVLBb1fLvoWZEWXs03oAaEekxT0AktToZGLXHzKFeMFHR58oXUct7bsT81f_3PGHq7FkYLXJErlErb7ce9UT6lBcVfM1HpDE0ImwYynoDSDRLjT5msQxEpjUQM-64U9ZyY1n9TT8Q6omOX-Tg_vP3e-PjuqxzCVMdOOmE9nbV_Qa9q9hzXqkLu_zRrQ8zS--YTLwTucb8Jd1hemXxnQwjp-jGMiu5KZ1UJ4eQlYegI3jmaLl_HoEM0NMJoqBm1gow6JqlyULk_hjdXJInHTVz4eVumE5_yPjCbH-ApQrnZbdQvYEimCEdBs8HDH4JekDEvSMJV-I1Fse2IUXRSA3MtcET1e9xyRLU3UmTEPaL-3c8wpfa7OQ3dt-h-ZrWfQy4yx4bjK9zBRCDVic2YQ_SwecIrxvkPt7jfsufcGcVZGiWTpJ0iaG1MdLm1BbIt2E_1_lMIsPKd-wt9-NXJoO0QiTB3iwxIRMN-8pDnQheB7AQiB7b4_5WhvBFI55Wb7qhI_ILZ4bc1lLqPJwDvJ0rtMXOTO9M3LmiaImfCT0Hcb_FnjZneyH6NGbzMobEA2UXYDxjVRhqnHXqBAqJr0HqKK3_PHBNqOrqE3Wn50nzc79njdqAbPGl09ng6_OhdRH_hdUV4zmyBapcj-RROzB72m5fjmIW403AYb7nxkg49kmDqeZcqVP6Z3anNYhQ

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:38 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 886845122549418 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 159ms
158ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/886845122549418?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9bacbd0edab95080f2f4082ed4322eaedfddb040e8a4976194f5429b03182a7d

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:38 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: vBJFxLAEMSRml30d1qP4atRkV+UjydWEZccXIJY0f01ArM9OIge34T8XCmTEK4x4WMWHWE3Hfz/GtGm/sqSfjg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 h7crsjCj0IX-282TYmrQfY-rOnXNYj6L0RJU8oUOaW4.js Show response
pagead2.googlesyndication.com/bg/ Frame EDF9 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/h7crsjCj0IX-282TYmrQfY-rOnXNYj6L0RJU8oUOaW4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87b72bb230a3d085fedbcd93626ad07d8fab3a75cd623e8bd11254f2850e696e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 12:56:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26210
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14251
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 12:56:48 GMT

GET
H3 200 851723189461274 Show response
connect.facebook.net/signals/config/ 377 KB
108 KB 140ms
139ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/851723189461274?v=2.9.99&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d46f30d2b3ac588c7e79e47a4deff21dc581dff071db9266684fa587c93f7a27

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: oUfAGp385XVNOtXCR2FERfGbN8IhlcPgE+b+udQFJy4rZOQaRXjvwkUmAwW5mWR991EgOaZ5J7sTfsYdNRGN5g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
54 B 17ms
12ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1537353300119728&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019250&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 17ms
12ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1897808950573752&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019250&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 18ms
12ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1417078182161683&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019251&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 18ms
13ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1213417872897242&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019252&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 18ms
13ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2740767399393350&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019252&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 19ms
14ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=9038410082867569&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019253&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 19ms
14ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=507317848148093&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019254&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 19ms
15ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=886845122549418&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019254&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 19ms
15ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=851723189461274&ev=PageView&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019255&sw=1600&sh=1200&v=2.9.99&r=stable&ec=0&o=30&cs_est=true&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 20ms
16ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2059094117621613&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019256&sw=1600&sh=1200&v=2.9.99&r=stable&a=wordpress-6.1.1-3.0.8&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 20ms
16ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1537353300119728&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019256&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 21ms
17ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1897808950573752&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019257&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 21ms
17ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1417078182161683&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019257&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 22ms
19ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1213417872897242&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019258&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 23ms
19ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2740767399393350&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019258&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 23ms
20ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=9038410082867569&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019259&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 23ms
21ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=507317848148093&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019259&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 24ms
21ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=886845122549418&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019260&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 24ms
22ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=851723189461274&ev=ViewContent&dl=https%3A%2F%2Fmestreemfinancas.com%2Fe-fgts-calamidade%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3D3_active_email_1090&rl=&if=false&ts=1679516019260&sw=1600&sh=1200&v=2.9.99&r=stable&ec=1&o=30&fbp=fb.1.1679516017017.1561558263&it=1679516016810&coo=false&rqm=GET

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 22 Mar 2023 20:13:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H3 200 / Show response
www.facebook.com/tr/ Frame A022 0
18 B 14ms
12ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 firebase-app.js Show response
www.gstatic.com/firebasejs/8.3.1/ 20 KB
7 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.3.1/firebase-app.js

Requested by

Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aade4473b4c7427f41a5b3aeacddf7a2e3532f2b7fece88a77644ec0e27d81a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7708
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6586
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 20:14:48 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 18:05:11 GMT

GET
H2 200 firebase-analytics.js Show response
www.gstatic.com/firebasejs/8.3.1/ 35 KB
11 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.3.1/firebase-analytics.js

Requested by

Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5bda00a5ec63e26748b9f40cf1356b3823db279199d74813874255c748657d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7708
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10746
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 20:14:43 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 18:05:11 GMT

GET
H2 200 firebase-auth.js Show response
www.gstatic.com/firebasejs/8.3.1/ 173 KB
173 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.3.1/firebase-auth.js

Requested by

Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0460dfa53507eb6b050b3035d367ab5ddd0d2c7ccb31fe7a68fc6ac1cfbb2c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:48 GMT
x-content-type-options: nosniff
age: 7671
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 177065
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 20:14:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 18:05:48 GMT

GET
H2 200 firebase-firestore.js Show response
www.gstatic.com/firebasejs/8.3.1/ 320 KB
89 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.3.1/firebase-firestore.js

Requested by

Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d73b123cd2ef3afda65cb6e76579341b1bb1f27faddb0dfc54875e7a05b0114b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:06:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7608
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90517
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 20:14:48 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 18:06:51 GMT

GET
H2 200 firebase-messaging.js Show response
www.gstatic.com/firebasejs/8.3.1/ 40 KB
11 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/firebasejs/8.3.1/firebase-messaging.js

Requested by

Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5243470d2be31f9aaf768f030f06b894aad081801460b75f6b396aca06fd8dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 18:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7708
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10884
x-xss-protection: 0
last-modified: Thu, 18 Mar 2021 20:14:56 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
vary: Accept-Encoding
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 18:05:11 GMT

GET
H2 200 openbridge_plugin.js Show response
mestreemfinancas.com/wp-content/plugins/official-facebook-pixel/js/ 182 KB
73 KB 120ms
119ms Script
application/javascript 108.179.193.123
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mestreemfinancas.com/wp-content/plugins/official-facebook-pixel/js/openbridge_plugin.js
Requested by: Host: mestreemfinancas.com
URL: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.193.123 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 108-179-193-123.unifiedlayer.com
Software: Apache /
Resource Hash: 761aeff2e8803ba4c48511b4424f2bef7ec26194f4decf3ed8d2741d52952871

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/e-fgts-calamidade/?utm_source=active&utm_medium=email&utm_campaign=3_active_email_1090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:39 GMT
content-encoding: gzip
last-modified: Thu, 09 Feb 2023 17:58:53 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: application/javascript

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 67ms
66ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2023032001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0279f3e12029cba9e38fe595ecb05f657aadcb63081c62658413dd8870c36cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11327
x-xss-protection: 0

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 6F50 16 B
232 B 67ms
67ms Fetch
application/json 13.40.90.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.40.90.84 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-40-90-84.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 22 Mar 2023 20:13:39 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 113ms
23ms Preflight 13.40.90.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.40.90.84 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-40-90-84.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 22 Mar 2023 20:13:39 GMT
server: nginx

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023032001.js?cb=31073316

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 22 Mar 2023 20:13:39 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BF53 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3198
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 19:20:21 GMT
expires: Thu, 21 Mar 2024 19:20:21 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4B92 783 B
535 B 18ms
17ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a55218622a21ff533b6dc2bf791125b63d44b4ea299a4fa88b93738d41b0bfab

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FXqegljw-b79jCMQTEGu-Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-FXqegljw-b79jCMQTEGu-Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
expires: Wed, 22 Mar 2023 20:13:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4B92 0
0 41ms
40ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2023032001&jk=553687043685601&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H3 200 h7crsjCj0IX-282TYmrQfY-rOnXNYj6L0RJU8oUOaW4.js Show response
pagead2.googlesyndication.com/bg/ Frame BF53 36 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/h7crsjCj0IX-282TYmrQfY-rOnXNYj6L0RJU8oUOaW4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87b72bb230a3d085fedbcd93626ad07d8fab3a75cd623e8bd11254f2850e696e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 12:56:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26211
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14251
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 09:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 21 Mar 2024 12:56:48 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame BF53 0
10 B 7ms
6ms Image
text/plain 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?qbjl7g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:39 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6497 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6242587785694&version=m202301230201&ct=132&x=1&cor=5999483494518832000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame AFB7 42 B
64 B 51ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssuBeBwELcOzayb6QcbBdubOU2AYHYGafpHqs_sFTEfQEWn64va0NRsfvkEuosMA48Kw2GlGM4qy9pceF2vZul0_U3nI0v7C_RbI8kSes_IfXzuO6Zmsix3fxEgtp81NUu5YPuvRA&sai=AMfl-YThVHly1VHWNSJCpZse54jVylzBnX1xygj-vd7sV7EQm8RCQmAM3W4Egsm_wjpGesgL2Zy7Y2dA4kZjJ9NA1K3-DXJLMqE2NhTUJpdGwfelYQV7mwgkHsTz8d4&sig=Cg0ArKJSzBMHmKC2Ltu-EAE&cid=CAQSOwDUE5ymAtTsfTzK0w2-qfsE9DZ_-Pr9e10YQzPl3kqJDSUcmgqOokGkHGbqF3uX9LBP5xohFwVFxJHXGAE&id=ampim&o=240,832&d=1120,280&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=170&tls=1172&g=100&h=100&tt=1172&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 22 Mar 2023 20:13:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 4438 0
15 B 9ms
8ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 966E 0
15 B 8ms
8ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame FDAB 0
15 B 11ms
10ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame A4E6 0
15 B 12ms
12ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 706B 0
15 B 14ms
8ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 8A52 0
15 B 14ms
10ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame DB3A 0
15 B 15ms
10ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame CEBD 0
15 B 13ms
10ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 5570 0
15 B 13ms
11ms Document
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://mestreemfinancas.com
Referer: https://mestreemfinancas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://mestreemfinancas.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 22 Mar 2023 20:13:39 GMT
priority: u=0,i
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 51ms
51ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2023032001&jk=553687043685601&bg=!fH-lfyvNAAZEjmHWZI47ADkAdvg8Wrt8yx_5qbuc8-pdRLnDiXfkoJHITjzLcWI7PvAaux7SxQ-oQ06iR8VQFdeRXvfk7VH72u4CAAAArlIAAAAHaAEHCgC-Cbmqk-RQQ-kZaeDh5zFKgIOHQ_bIZlS5SbGipKOJk7J2vBqTeD5RNe2B-AOTdQEnCcuWrCAKnYm4YlpoCKiLkLeYCO4ThaUJlFadg3rZoMbA7JMORXt2_jFl_BOlEyhS29NfASi4ZOhNDhONoP79m5JKYXPIEfBXxY6eSlB_IxTxTtoG5Q9qEQWqGM-k7xZOPfl-ywks19nXHTZhnxx63j4eFWlRXtShSbuSSiEU06vtOo1V7XhmKFF4-giMoZkCqUSVlypO6YO7J58Ys6X6BcDTbba925hDzDY2ZYJm-XQTXjxwvoPsLxM5OBiAUXAXzxiFCdJ4LlFICRiBNnC5OUM6PpyU_yQ3bp4qnXsNuEUWthtysy1bYkf__v_kX-26dcVAf7UDxlYSMymOR7Yk6iT4sycA3vebBsNapkU3vvivjgSnhTvzEeDUdRewfQhlvWGLUcMkngbIPR-zGNfgYhsOt_Nc343JPK9CpiXsY9WlvRAMRWxg3aHVpDA3jemDhXodL_MQ4b3WZBBqfQvJDPEADmpbIuxd2l7_euQ4djl-jyPBSBDg3S3T5Nv-rmnKnnFm5ea3_L5adw2RDXUAG-wRAq8pr-UUztzYBsvmycPz2T6Bf5pxcb_CEhhHREFPEcu0RNtUlpogdW4tIFjjPNofAnhcyEVDfXsLQa246qMxaDPoAyRU0Xg1F0aKMN0FnERyU-6eGGC7eA55VJSXGyyhFPEBiqSJR7QGFUQ1wq_7WUl918E4TUOP8ipiqPeigXZIClr1H-s7UqFjoZVd4vuMqmHIP6AZny1hcu7ptZ7PjH2BJSpqUH6zINkMGWXBgWg4CvLXwJ2wLbBRbuYv9uXGlDWd70fILZQatveIgpoRn8QaVJ0O-n7t8dy05lkUELH6d0RyHsY80SdxlMu3rVGxdcdji4dACXX7WK6xAcSbDJ4ehD916OUvT4JHaOSlmF9leXwxG8D3IGm3u9fzGjHMEnIw3OiwKmDx89h1qOrJSCqfRZZTJRkHoiskKLimMofHgqFgkV3rTAz1LvQswedTwu4Z6Hxy7k1A6SfXxWJ6BwS-hOaZj9n6d9_baNOI0USUChyOqB6Zv8kTUIWMOaK-TvTUKnonGxDBop50xvRbjl8reswrdUR1-9HPx2o5hvmd980DcBKIyQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

GET
H2 200 script-push.js Show response
script.joinads.me/ 1 KB
1 KB 15ms
14ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.joinads.me/script-push.js
Requested by: Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3cb238c7630ba8bd60ede523b57d4b3619086b3c54c04297662d2fddc65c6c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mestreemfinancas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Wed, 22 Mar 2023 20:13:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 698594
cf-polished: origSize=1468
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 01 Apr 2021 12:59:37 GMT
server: cloudflare
etag: W/"6065c3b9-5bc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KqJfrzNAKEY%2Bsn29MYBkQblKdLLTJp1qJ%2FS9IjdLeDz9hkwbL6hZAc%2Bqf%2BvX%2FSaM5ulDkY%2BOowXn4Mz9%2Fpe26d1B6jvI6KvPiB%2Bjz6RInrEsjalUb5vynQ5b4WpzK%2FlPl7VF3ffF%2Ftlyj5ioIhq9Gw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31104000
cf-ray: 7ac118bd8b0a373e-FRA
expires: Fri, 08 Mar 2024 18:10:27 GMT

Verdicts & Comments Add Verdict or Comment

76 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mestreemfinancas.com/	1970-01-20 12:41:32	Name: _gcl_au Value: 1.1.437127058.1679516017
.mestreemfinancas.com/	1970-01-20 20:07:56	Name: _ga Value: GA1.2.1636985903.1679516017
.mestreemfinancas.com/	1970-01-20 10:33:22	Name: _gid Value: GA1.2.896029059.1679516017
.mestreemfinancas.com/	1970-01-20 10:31:56	Name: _gat_gtag_UA_165983883_5 Value: 1
.mestreemfinancas.com/	1970-01-20 12:41:32	Name: _fbp Value: fb.1.1679516017017.1561558263
.3lift.com/	1970-01-20 12:41:32	Name: tluid Value: 2461302218664424060603
.quantserve.com/	1970-01-20 12:41:32	Name: d Value: EHkBCQHJKIEA
.quantserve.com/	1970-01-20 20:02:10	Name: mc Value: 641b6171-76019-893f6-30c31
.casalemedia.com/	1970-01-20 19:17:32	Name: CMID Value: ZBthcWIeQ4bq5WCgpmqk8AAA
.casalemedia.com/	1970-01-20 12:41:32	Name: CMPS Value: 3262
.casalemedia.com/	1970-01-20 12:41:32	Name: CMPRO Value: 3262
.bidswitch.net/	1970-01-20 19:17:32	Name: tuuid Value: ffc97331-03d3-44ea-92bd-2804c35ede27
.bidswitch.net/	1970-01-20 19:17:32	Name: c Value: 1679516017
.bidswitch.net/	1970-01-20 19:17:32	Name: tuuid_lu Value: 1679516017
.bidswitch.net/	1970-01-20 10:31:56	Name: google_push Value: Aer7DvLpoGYyNQoiqOO9WwPhZVYIzK_RN_V_kKJ2gpaCRLoQbexilSS3FAdrve0YN2PVK-3pHQru-bpqjMFL4Xeq4sYj6O8_X7s
.yahoo.com/	1970-01-20 19:17:53	Name: A3 Value: d=AQABBHFhG2QCEE8SvfbMxVt_eEfNp5dZPz4FEgEBAQGyHGQlZAAAAAAA_eMAAA&S=AQAAApqEDjoA_zlmQvhp6nDbFh8
.analytics.yahoo.com/	1970-01-20 19:17:32	Name: IDSYNC Value: 18yx~2anw
.openx.net/	1970-01-20 19:17:32	Name: i Value: 3fef55da-bd82-482c-9ca3-415daa4a7b37\|1679516017
.criteo.com/	1970-01-20 19:53:32	Name: uid Value: 3af2fd98-d8e9-4345-8776-3438d1a95d3a
.mestreemfinancas.com/	1970-01-20 19:53:32	Name: cto_bundle Value: XhE5JV96WFByZEV2TXN2a092eFpmV3dsb25ncjNCVTBtciUyQlJHJTJCYWs1MjhIRzVCdEF3NXQlMkIyZ292bVZwWTZ4M1dwSkxUMDRGcWN2MGQ5MjlXaU9Ca2RIT203Zk41JTJGQTQzZTVGZ2V0Z0xnbWh4SktrdHR0S0RETGd0Ym4lMkZVT0tLZ0dJZlFwV1gzJTJGRWNHc3RaOGwxRDNUYTY2NUdnTE1ZUUpUOWJ4elBzNFJXS0UwVUUlM0Q
.adnxs.com/	1970-01-20 12:41:32	Name: uuid2 Value: 2687008945275546439
.adnxs.com/	1970-01-20 12:41:32	Name: anj Value: dTM7k!M41.D>6NRF']wIg2ImOu'G_r!@wnfH8K6pQK`!5=E<L5?%K38?Q03i+o3[4gv#kgm.rBeG6njC2]g>`lYm9bpRzqF1`b`>(*<v68
.mathtag.com/	1970-01-20 19:57:51	Name: uuid Value: 40aa641b-6172-4400-a319-08bcf8442bb8
.mathtag.com/	1970-01-20 11:15:08	Name: mt_mop Value: 4:1679516018
.simpli.fi/	1970-01-20 19:18:58	Name: suid Value: 8D431E48F41945A3B08D5BBA80021651
.doubleclick.net/	1970-01-20 10:31:59	Name: DSID Value: NO_DATA
.de17a.com/	1970-01-20 19:10:20	Name: guid Value: 1.4973849038668865292
.doubleclick.net/	1970-01-20 19:53:32	Name: IDE Value: AHWqTUk3ncfH0LK45HMdXBDy8ZBo_7HW1u2DWxgw7nyuofatwc2WdM42CSbtz2cgZ2Y
.mestreemfinancas.com/	1970-01-20 19:53:32	Name: __gads Value: ID=767aef0b6f1f5474:T=1679516016:S=ALNI_MbVx2aToNqGxchB9tJsjeKB0kFelQ
.mestreemfinancas.com/	1970-01-20 19:53:32	Name: __gpi Value: UID=00000bf1fa825949:T=1679516016:RT=1679516016:S=ALNI_MaA6o80qn7KzjNkUgizAjcthWBiUg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

64943b43673e292ba0ee8504d9e599fe.safeframe.googlesyndication.com
ad4m.at
adservice.google.com
adservice.google.de
analytics.webgains.io
api.webgains.io
as.ad4m.at
assets.ad4m.at
cdn.ampproject.org
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.prod.uidapi.com
cdn.track.production.webgains.team
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
d5p.de17a.com
dsum-sec.casalemedia.com
eb2.3lift.com
fonts.googleapis.com
fonts.gstatic.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
id5-sync.com
link.mestreemfinancas.com
mestreemfinancas.com
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
prod-rtb.ad4mat.net
s0.2mdn.net
script.joinads.me
securepubads.g.doubleclick.net
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
static.criteo.net
supertrabalhocom.lt.acemlnb.com
sync.mathtag.com
sync.teads.tv
tpc.googlesyndication.com
track.webgains.com
um.simpli.fi
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
108.179.193.123
13.32.145.6
13.40.90.84
137.184.92.206
142.250.185.66
162.19.138.119
178.250.1.11
18.132.110.241
18.194.91.195
18.64.141.41
185.29.134.244
185.80.39.216
185.86.138.151
185.89.210.46
213.155.156.164
23.213.169.115
2600:1901:0:76b9::
2600:9000:2250:2c00:a:e047:752:b361
2606:4700:10::ac43:266a
2606:4700:20::681a:bd1
2606:4700:20::ac43:4a81
2606:4700::6810:5614
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2a00:1450:4001:803::2003
2a00:1450:4001:806::2002
2a00:1450:4001:806::2003
2a00:1450:4001:808::2002
2a00:1450:4001:808::2004
2a00:1450:4001:809::2003
2a00:1450:4001:80b::2006
2a00:1450:4001:80e::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:827::2001
2a00:1450:4001:827::2002
2a00:1450:4001:827::200e
2a00:1450:4001:828::2008
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:831::2001
2a02:2638:3::c
2a02:2638::3
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a06:98c1:3121::3
3.75.62.37
34.102.146.192
34.120.135.53
34.98.64.218
35.204.158.49
54.205.51.31
76.223.111.18
00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe
0102fdfbd0b06f4718e32f6586659557a6234c0111940c1fa3d697c42b067c1c
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2
078e029cb509e6c131d8c8983cacdcf186182af5c462f0cd3b4712ac43374357
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0a19fce040b8127f3e2e3ed609f7800153be329d6420b53295fb79a4f40012ec
0aade4473b4c7427f41a5b3aeacddf7a2e3532f2b7fece88a77644ec0e27d81a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
11f1414c6342d8a5a5124286921298b09b1e776f0aae7bbc4c83b96685166019
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
133f35fbfc23c0d8cf814176860427bd6a02da9278de3de662da11d9602d8582
171a7a43dfa4ecaab9766b8c0e94e013737345a7975092cfcecfd4b63000e743
1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b
1f29d91e07c72114188d0d5ec2a2166112fd0096b71519a39ed3555c7e30232a
1ff2519842c31ec3137510db810cf4916a468af437872fb8fe1685a644508e37
214674cc77aba35ab3567b88e2739fd08e8e96c61d279559ad61874069683ea0
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
28407c1f79f0179d777c12ea82ab9cb0388c3f1c0ed9ba5218063f7b3f38033c
2d5e67a38c9a11424cac19ce192c9fd124a6d74e64d3791a01561dbd3e39c0b4
2e3fca3b6adcefb77b53a3088ac08e65951566785a9bfc895bbcccd05745c863
3085aac649fa0d732e9fd1e54e0ce46f115238e1c115a7f7ce9de4bc416ab551
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
39d0fd9943a1069718bb60c51587b8a2b7711d562766565fafd8ac6050e44cdb
460b2dbe88f3cd1f5833c6f699a9b87d0f2f0ea26defd425074e0ba5bbcbd11a
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
46b2829524e1ffcfacb15998bbe38941bfbf6110ce8f028d8117efcdbd8273fb
46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143
4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d4d8f4b29eb5d3ee9d8a9f35ed7bc7c481059fe3f440573a557344829be074f
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
519ae5bc490c0c50483f78dca3697a8dd2be7bad9021bd4efa6e2c659666118e
5243470d2be31f9aaf768f030f06b894aad081801460b75f6b396aca06fd8dda
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
58788a30af68f92836329a22bed11ee437cdcc310cc9697f53d7a06142ad1416
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
598b8c1110efc26823b59e938c43fe2e5342f4fe834e8ceba5263c1db3c2ad36
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5ae9552d446982cedbbeb56c92ec7461d79f2e7734efa66bd0633e095b12d645
5b1546ae8f493de03b1ca99f9f955a20785679be18625354b363f2f8311f421b
5cd1d3f62af07b4c29a844781688aadb6d84f30986e2c2aa5fd2d581ea517ed1
5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab
5dfdf00359b7743919a732ae8eb80536ff206faaf16a99fcdd3f967aca1f81e7
60bf02832688d14251ec1c7b8acfda233a91f927f26c7202bdaba781a1f0fcdf
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62a8dfc83e39220c06dead3948f5faa65f23e9fa05ade08db7b8204f614e48de
6671e599ffd30d54da527cf3a255350318fe9402827dd3e839bb62458fa6d9ad
68f8b357a624a2f4e7ee991c1d05207220f4b34f814f7ebd7355dcb564618310
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d35a6bc1d3dfce567e618926e5bb4fce4e437f0b88ce41a07bc1b131bd2039c
71fc1599035adc6bc34df2117b8631285905f97737ba730af28644ee6a0d8dde
744b436600cd35e7898be8843c04c1115c45bf08143d085ac149e8c4f8151e3d
761aeff2e8803ba4c48511b4424f2bef7ec26194f4decf3ed8d2741d52952871
775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1
7abd36a2f651330420d86187c125331d679408d1be7b6cd93efa64e08eaf80c7
7b096cfae2525b059116d8b86e549bf6ae43fdcc78a90c72a3a42236d5caac52
7b64a84c219d901e94b497f2374a5eabfa89a26b3c2891c774979dea81bb66d4
7e86f52cb0d423805ec541a4bccae5156a01fbe36355e6d798a450593212651f
808af092ebf9a3f9ffa55a0fcb1ec1809ac1a12ffa602e01e4ea91da1d2b5475
80c7fe7749a6e8c85fa6473e7bbba5c5dc6ffe20a86036de26d91bd4b9a4e8d4
83dd1a8208a83ec90a9a2d7774ab28e4b93b3eba53fb6a3fd444eb7e389ecbff
87b72bb230a3d085fedbcd93626ad07d8fab3a75cd623e8bd11254f2850e696e
8ef645c73a2e07d368aa41f762a2c1c8b94fff9116a06e66f506dce23f8e4fcb
90cbcae2f75cbdcf2a00d82c83cb2926f1a4ad7ab38eb3d629f2e7d3ad72410e
91c12bf34c1747ec325fd81713811aad095ffea7e4e4a93aa4097669dd6d0056
926a4ca073c39c40cabffbf1b0371803f245f084cdb9177fc7b3f9d81c0e394d
97d67f8c2575e19d30ae28a32bad7610849e0e56c81ca66e51178124a5c5eed2
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b2a32cad15696155a3c1874a48fa11fc6d73278569e387df98f19ac1029f65f
9bacbd0edab95080f2f4082ed4322eaedfddb040e8a4976194f5429b03182a7d
9e159db20877543a7026539fa099bbb2d08de12857a51747e9e3a76f731fbc03
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3310d0b720bd3ac611780ecc8f07e3ddc4958235c8b626ec03e94b1a2bf8601
a3501a3f0a7b6bc47f9f81c7be85b3603816fe2d3026ab4b396127ed9eb8895c
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a55218622a21ff533b6dc2bf791125b63d44b4ea299a4fa88b93738d41b0bfab
a6d72c44ca09f0eb3e1af89f282ea5c1e94669f87d89cc6cab10925771c11cf2
a72da021ce55690ffbd77addc203b06896ed0f1168f2828d2cd9c47713341a2f
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
ac74720205d374254fe305f19474f51c52c2090be303ad9012f2b0f0e4ade22c
ad76476fc16a70ba7d64d7468c541495f133944145a21149596b54fd2bd12c98
af916ed81b4bb3b0b23dd6a73a64b4bc84371a9269f767de15361d7d34c6628c
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b13ddd6cd424064f8d421734c4c19e692c68c74ec2c5c61f960cf799cca1b63e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b150d9b4151f7cd309c4c7808de642e3030efcdbc40f3bec35ae1c87e17b111a
b448b80138d66335bb75615b067a56d0e5d3522ff914ea30a27809f8618bbdd8
b5bda00a5ec63e26748b9f40cf1356b3823db279199d74813874255c748657d2
b651d87ef113cba0c8ec8a33bfdb694171effeba56b20be12e3c77fc15f6ae9f
c0147cfaf9052893e9a24a1dc6b565de3281b23436ab4d312b883e3cd40eec7d
c04d8a64a12d2baec77efe2a99b335351d98df781d96dde282b10a751e1b9be2
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c3222903b284496abdef15963fa04202511e222f17463bcd9d756e26e1effa08
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
c5c23b3d97840dd493a5adaec306d9a930ff0d7ef513a9320ccf213a3693bb83
c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca7154cdda62b535ceaba9ad2a2b2217ff49de94c069a2c4e89733f3f06b3651
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
cd2056d3c5a5f9a087647154dc26dbed362a61b733a6cbc8d9e5330b4f4d4284
cf2086397a5d0d6d9c67e72d0dce0c0e734c9867e3cf6c1dd529b1fd22713393
cf9a6d2d58d42b5239d8c9405c627d9c995f11eb4e2807be1f4f142028dd5f9f
d0460dfa53507eb6b050b3035d367ab5ddd0d2c7ccb31fe7a68fc6ac1cfbb2c2
d239ba30d7b460a0780479fcf04ab11e0b5fb1af7d9a07987e6e0370ddc8d79a
d35c329b30c79f995ec0c3046be01eb2651227def940a8bf5329a680ebfe01e5
d46f30d2b3ac588c7e79e47a4deff21dc581dff071db9266684fa587c93f7a27
d73b123cd2ef3afda65cb6e76579341b1bb1f27faddb0dfc54875e7a05b0114b
e0f0d6d71e313ae3ee40517ae4df4806d42aacf7720c5c0220506c247796c4f7
e100b78565f86a5cedf791f8ce4d3a7d39b6597f6070090d5fd38bfdf004ede5
e2f7d2878965ad61dcecd013500c1d038c5d6a8311a2da6299510566272e70f0
e31e1cfb470365c46c451ae94f3a5f9bac9df96a0f403f044f851228a5bf1667
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cb238c7630ba8bd60ede523b57d4b3619086b3c54c04297662d2fddc65c6c4
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e5afb01e1476b41582fb1334176f27ea0ba3c6eafcd98e433394df349e1bb217
e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab
e76a81d16824d3288fd16917a64dd4ed831b530e14f9f9e37b56d014eb585f5e
ea420d765b3a2def39c1b5ae6ec17b209cd156ab21fa8a8716159bb05ed655e7
ecf785fe496796d2e4b026d58de7ea89a471d19255b06b3fefc5576db5a69dbc
edcf7e9d00cf9801aa15790eed1b8eca5c403d8ee03c323f042562b426a8a8db
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0279f3e12029cba9e38fe595ecb05f657aadcb63081c62658413dd8870c36cd
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f98e3a43b646099a57d185042f32496e965d18ecc357f227739edf669a353c49
fe14bc8a4e294c047589838fd09a3efc81771751a0be03ea8ec99e734e965fd2
fe513ef974b767510d0a2b9f1b4d3afa53185b89ab617c869e5e3d6db960192c

mestreemfinancas.com Open in urlscan Pro 108.179.193.123 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

219 Requests

91 %HTTPS

56 %IPv6

40 Domains

55 Subdomains

45 IPs

7 Countries

3396 kBTransfer

9551 kBSize

30 Cookies

0 Outgoing links

Page URL History

Redirected requests

219 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

mestreemfinancas.com Open in urlscan Pro
108.179.193.123 Public Scan

Screenshot
Live screenshot

Full Image

219
Requests

91 %
HTTPS

56 %
IPv6

40
Domains

55
Subdomains

45
IPs

7
Countries

3396 kB
Transfer

9551 kB
Size

30
Cookies

219 HTTP transactions
2 data transactions