knews.vip Open in urlscan Pro
104.21.74.35 Public Scan

fra24s12-in-f10.1e100.net

Software

cafe /

Resource Hash

65dd2bb1a4ec87411c6d981ea438e9df69baf6359f6069f474504f07c7229b0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: https://knews.vip
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 51342
x-xss-protection: 0
server: cafe
etag: 7548425312191149675
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 02:41:04 GMT

GET
H2

200

dakota-johnson.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/13/
Redirect Chain

https://knews.vip/assets/images/2021-10-13/20/dakota-johnson.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/dakota-johnson.jpg

2 MB
2 MB

79ms
8ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/dakota-johnson.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3ce11cfeaaba2f0a002a5133cf1574cf2f349ae23cbe35435cfe05e50cfd93cf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 11:47:17 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 13 Oct 2021 20:49:55 GMT
server: AmazonS3
age: 1004029
etag: "a7f32f3261e09f42dca5d9a4323db905"
x-cache: Hit from cloudfront
x-amz-version-id: Kudt5.aRlI.ey6wpDSyc9W78hdD00fbK
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 2525981
x-amz-cf-id: aSk-izRszGwE8xGZRIS4wrEORmIBVmHM9Q1x97tAqdqbkXWAjstm2g==
expires: Thu, 13 Oct 2022 20:49:54 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nr%2BVTMTcWeqLKUS2R%2F01IUpkie7GjlKHAwMjJy%2FFxLvH6Bdyn%2Ff5LfODicqySD2aLd0OrHgc4qosLxhi2evtFr1E6wcNbwCP%2BvvirFp8xS1XMO5on5sFbn3PhJQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/dakota-johnson.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4c8be3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Emma-Kenney-and-Emmy-Rossum0A.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/14/
Redirect Chain

https://knews.vip/assets/images/2021-10-14/20/Emma-Kenney-and-Emmy-Rossum0A.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Emma-Kenney-and-Emmy-Rossum0A.jpg

323 KB
324 KB

90ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Emma-Kenney-and-Emmy-Rossum0A.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 062841746151422e7ea0895a7de98b4b8fea27ed7b0d2e6f5d904c32d659bb84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 07:05:41 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 14 Oct 2021 03:38:08 GMT
server: AmazonS3
age: 1020925
etag: "9fbb4bb98779faae41a5f247aeec7d27"
x-cache: Hit from cloudfront
x-amz-version-id: Jwn1ihVCJhKNdm837gGTXTUEWGEj8yNM
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 330789
x-amz-cf-id: gD7tO0uLYEZ5jpHpAFIoixsRc645pmNK_A2ScE_L5SbIh6DZfUAVbA==
expires: Fri, 14 Oct 2022 03:38:06 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XitvwTl8ySaGTC6SDChOawtsvei%2BfWfSQ4C8HiwVrpYNgN1Hay8K6DfGhcnEFTwNUQaaN2TQRCbaVaqsOi2nhxc%2FMpP4M5pEgp1EAX9xqK3M5xQMGegWSAarGFA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Emma-Kenney-and-Emmy-Rossum0A.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8c93bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Javier-Munoz.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/14/
Redirect Chain

https://knews.vip/assets/images/2021-10-14/20/Javier-Munoz.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Javier-Munoz.jpg

325 KB
325 KB

99ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Javier-Munoz.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 575952ee6959307cda8a9e424ce7fe33bcdd90e4ba79c8d8eac1a6c5a2ef71a2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 07:46:05 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 14 Oct 2021 04:02:47 GMT
server: AmazonS3
age: 1018501
etag: "68a1e1c4d52c16938be6e8439084fb7e"
x-cache: Hit from cloudfront
x-amz-version-id: jWLR0dmhLzfrFqLQ2dsSORj_es3nghM9
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 332345
x-amz-cf-id: NmS60KIgnqeQoskAFgCQx-9Fq2nXzNNGNKwoG5Zq0hB69o4HzTcWFw==
expires: Fri, 14 Oct 2022 04:02:45 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zAtoaoz7MPQivlObh7NEYXjCVFr%2BYroy8TVEhB5ux9Igr5dbYl6lvJ3mtezNiTm5fMIlKO9u6E3%2FpXvCBiMqFw4k85%2BmhjJbRXViFdNGI%2BFL8hhHpyKxM%2FG97dM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Javier-Munoz.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8ca3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

rachael-ray-1-2000.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/09/21/
Redirect Chain

https://knews.vip/assets/images/2021-09-21/20/rachael-ray-1-2000.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/09/21/rachael-ray-1-2000.jpg

539 KB
540 KB

99ms
40ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/09/21/rachael-ray-1-2000.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01af6349de69f43cea7b3a0166a835ed558740d7e6eb107898ec2b23accd129b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 15:24:29 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Tue, 21 Sep 2021 20:29:16 GMT
server: AmazonS3
age: 2891797
etag: "491536573229404013b7bff250bdcd15"
x-cache: Hit from cloudfront
x-amz-version-id: rM1TFt8mRdf_ksns0rVo1XPhWyPSU7Mz
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 551872
x-amz-cf-id: xY97JYIZJwe59dGFSy1d5yFqmcIsX_CCTrIO_av4gXkNCq5i909beA==
expires: Wed, 21 Sep 2022 20:29:10 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kg%2BNYqjfaFpfP0nXtADChsUtRu6HUSgCKN8gnvnhUgJplC7irJrLtPLE5iyJIGUaFmKD3A965Rf7ZhrYU1WZ4Wus6YIFvIeu0VIjT4irgWXgi4cyLg%2F77gOLmso%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/09/21/rachael-ray-1-2000.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8cb3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Freida-Pinto40.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/14/
Redirect Chain

https://knews.vip/assets/images/2021-10-14/20/Freida-Pinto40.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Freida-Pinto40.jpg

500 KB
501 KB

88ms
43ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Freida-Pinto40.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a094736001c5eda0357f063114d92408adc2d8e4d726586f89673bb9baf61e3a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 08:03:50 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 14 Oct 2021 02:30:33 GMT
server: AmazonS3
age: 1017436
etag: "3cbdfb26e1578be13f48350f46a9d7be"
x-cache: Hit from cloudfront
x-amz-version-id: n6K761NZMPOBX2QRPHNKP5aePCl69oBU
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 512059
x-amz-cf-id: qqJfJCgkteAUFrVenzyv0Pn3wtlJfMHVzYz75KRM5LzgVGBw1grHfg==
expires: Fri, 14 Oct 2022 02:30:32 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1vTNg%2FNKgqCBJd5jn4FmjyrpIxaA3JaIbEmUhSPYWk%2BBRvbX7pAgSK%2Fs7iyyRpchiYWim8NE479SHWO04OzmXYa%2BASI3k1lfpCiuVEx9lKRV%2B6zSkVYlVBGse2M%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Freida-Pinto40.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8cc3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Matt-Damon-and-Harry-Styles.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/14/
Redirect Chain

https://knews.vip/assets/images/2021-10-14/20/Matt-Damon-and-Harry-Styles.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Matt-Damon-and-Harry-Styles.jpg

259 KB
260 KB

85ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Matt-Damon-and-Harry-Styles.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: acc099ea48e7446fafe468eb642808cabdc3eec67819779e3df80c52bc0b5fd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 14:27:49 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 14 Oct 2021 03:09:36 GMT
server: AmazonS3
age: 994396
etag: "c1e5c49bfc038012ab98f34ff464e74b"
x-cache: Hit from cloudfront
x-amz-version-id: VuVEB9AOrwJu7jUJq_TNAjV8yhBqyzJH
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 265671
x-amz-cf-id: H_SA0Beu2KvqHR5u4pBkcg4PUDkeENPcurpTqmBMZpcCVhR-EEhoBA==
expires: Fri, 14 Oct 2022 03:09:35 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BibRJrgOtNt0jUjC3BbjmC9d1MWSomF1qiyssgdpQJIWmNvbUNyqZGWokLCjX%2FUAyjI%2BilZrU5QeuHpsev%2FExfsTb%2BWTyEX%2FS4FeX0EVz7YmVDzTje5zq0l9zzA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Matt-Damon-and-Harry-Styles.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8cd3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

yara-1.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/13/
Redirect Chain

https://knews.vip/assets/images/2021-10-13/20/yara-1.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/yara-1.jpg

2 MB
2 MB

114ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/yara-1.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f2d5446b96176bac344ff0eb473f3d55d1c03208f91f05380ae75571185dd8b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 07:05:41 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 13 Oct 2021 19:31:45 GMT
server: AmazonS3
age: 1020925
etag: "7ca78b92a9c09f1ed5c2ec9429886205"
x-cache: Hit from cloudfront
x-amz-version-id: Syzp1Z1WR8ABDydTLBCjn3_VjsuqM7sY
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 2439253
x-amz-cf-id: RnXGAbmysIRG6sC99GuDnI2yJYXUnfa2-toqZuyLxFRANU1k-b_y1w==
expires: Thu, 13 Oct 2022 19:31:44 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dX6icoxzV0NgrAkPwQz%2Fd4n370Ypwafj8DfzOx8ZdrVDAU51F%2FWZAeeNekHYPguFxqJGZkFO6WlKnJDPLGcAiztQ7pKLfSShrr1xdfDH5c5YIj6WkTDBo1nHldI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/yara-1.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8ce3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Sam-Asghari-BRITNEY.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/13/
Redirect Chain

https://knews.vip/assets/images/2021-10-13/20/Sam-Asghari-BRITNEY.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/Sam-Asghari-BRITNEY.jpg

198 KB
198 KB

86ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/Sam-Asghari-BRITNEY.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0a0097db6dd73239214085fc1157bed95df5f9f243e23c9ae1fe5eaece034ede

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 05:57:23 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 13 Oct 2021 23:43:57 GMT
server: AmazonS3
age: 1025022
etag: "d5fccef8a884e3ac1e0edd58a3b57b75"
x-cache: Hit from cloudfront
x-amz-version-id: 6Q_F85iOKwd9VIMgCaSgKYBfcfyHusqE
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 202616
x-amz-cf-id: wZce80q-Esrk9jT4RoqSbed6wRqC9Dd7Smi-De_cSg0eXtnj2ap82g==
expires: Thu, 13 Oct 2022 23:43:55 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1JHqRm75yi02d1pBM6ntu4HgzdBYQI3GzLuiKsilhXT0RzWCOfKrqQ%2B9abEvK6zz5P%2FPutrCBHCGY6AJVmorxlTbQqFzHLVoeHrLf4Acwu03XWZa0t4Ux%2B%2BdFDU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/Sam-Asghari-BRITNEY.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8cf3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

kacey-musgraves-1.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/08/23/
Redirect Chain

https://knews.vip/assets/images/2021-08-23/20/kacey-musgraves-1.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/08/23/kacey-musgraves-1.jpg

1 MB
1 MB

109ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/08/23/kacey-musgraves-1.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1e4547ed67d6095aadc906be8ce27f461077479df8c8391cf1c50e172a80f2e4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 15:26:26 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Mon, 23 Aug 2021 14:18:42 GMT
server: AmazonS3
age: 990880
etag: "ffa01f65a9aa318e67398e0248ccb771"
x-cache: Hit from cloudfront
x-amz-version-id: WbjJ6ZMld.Q6FjTpR7M5sPpFHGK5_5GV
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 1112520
x-amz-cf-id: 5k4p2VdR1_3AiZhmu_VhiDnaZWZeV6X3R68HlG38fgR_GtBmCDYVtA==
expires: Tue, 23 Aug 2022 14:18:41 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FO5lHkCQDNT%2Fg5g%2FzLwf4yrQjHOzluaBRldI2BRX1D%2Bqz7l0NwDnrChLd4h0%2BmFB4j%2BJGBREIlAe43jWoLLP%2FY8QJyd7w9yCrj99bvKfY0NTbponWY14x9qBRHY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/08/23/kacey-musgraves-1.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8d13bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Kim-Kardashian.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/10/
Redirect Chain

https://knews.vip/assets/images/2021-10-10/20/Kim-Kardashian.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/10/Kim-Kardashian.jpg

764 KB
765 KB

92ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/10/Kim-Kardashian.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7afa51255c33af4f9958cbdff9269bf74bbf92dc1c457095a1b445dd2d6fbc71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 03:20:05 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Sun, 10 Oct 2021 13:29:23 GMT
server: AmazonS3
age: 1034461
etag: "a0f85750f4dfd2aafa21466fcf89ba79"
x-cache: Hit from cloudfront
x-amz-version-id: tjdprX5188gCsz6L.mXMEJoMs4czNuLh
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 782237
x-amz-cf-id: kb7SPvAqScKvu6sHQ8Low1NOZRLWjkvJ_m4lThmxLch5r8VVOwlLyQ==
expires: Mon, 10 Oct 2022 13:29:21 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWBAHkTZcTqdSVhlUEcFXsBBn7mOLQlj5HGPmRE7lSjEaMfPNChGHQrlfMlnpfm3yi0M%2BVMN%2F9bmIj%2BCLwc2dREd4Qu65q6I2U0yLI0tpuEpi9GNlYxkjklkeDE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/10/Kim-Kardashian.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8d23bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Kourtney-Kardashian38.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/14/
Redirect Chain

https://knews.vip/assets/images/2021-10-14/20/Kourtney-Kardashian38.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Kourtney-Kardashian38.jpg

549 KB
550 KB

95ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Kourtney-Kardashian38.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3a2a5f60b330f5c46de2705bc0edccb3154bd9dc621e1ae2e730a4ceb6d64adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 15:26:26 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 14 Oct 2021 01:44:29 GMT
server: AmazonS3
age: 990880
etag: "38e0f64865a05197d9fed20aa79c71c0"
x-cache: Hit from cloudfront
x-amz-version-id: 3LB0MN1RscQAfNWWw3Qffx6Mjvh53HGq
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 562061
x-amz-cf-id: djj4EBgzOTC4Oi8DSLzJOYOkFxs6yTzufGeceepUn9w9uywIk43V8A==
expires: Fri, 14 Oct 2022 01:44:27 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8sgtOV3gQnU1q%2BXcd9t3MtcdUWBVwwBPTJDM4w4LqBPZqsojqnDtnAILt4nL8BMFKkrEQ5xOWaD1SHFyX%2B30TxA0KTE0PtJ7V%2F8XES%2F1y%2FCfuJv7W7aeRRpRpKM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Kourtney-Kardashian38.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8d33bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

Jennifer-Love-Hewitt.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/14/
Redirect Chain

https://knews.vip/assets/images/2021-10-14/20/Jennifer-Love-Hewitt.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Jennifer-Love-Hewitt.jpg

217 KB
218 KB

95ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Jennifer-Love-Hewitt.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9af5f9699136ac49eee9829aa4d76f02256f71f9f075f4ffcb8e29cdf3a6e5b6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 14:27:50 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 14 Oct 2021 00:23:12 GMT
server: AmazonS3
age: 994395
etag: "8fbe58ceec7d30d972d6770e60d6ff0a"
x-cache: Hit from cloudfront
x-amz-version-id: iKHovyEQmz0zn6Tu85Bx1YGdelwfODlT
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 222392
x-amz-cf-id: MV1hyjOAYfyhfIairJYbYfYkQAtflNzMrC9Rl8KkPabYnIRb6HnHFg==
expires: Fri, 14 Oct 2022 00:23:11 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uRAMQUIEiKdTv5kDmURG5m5nJqzDQ9WFnVdM4PSYS7mjZHGRPipT%2BqjuekzMZMRaGvg9zWZVBm97WfFzuMfheQ9RpKf%2FkfUQxz%2BlGZEAYNlTG8fQXv%2FHRP0rH0M%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/14/Jennifer-Love-Hewitt.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8d53bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

batman.jpg
static.onecms.io/wp-content/uploads/sites/20/2020/12/19/
Redirect Chain

https://knews.vip/assets/images/2020-12-19/20/batman.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2020/12/19/batman.jpg

319 KB
320 KB

87ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2020/12/19/batman.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c6d1c06b989a6b2150a674eca3de63db351e51c55253c9a86d90d21c67c4bb0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 02:25:44 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Sat, 19 Dec 2020 00:02:18 GMT
server: AmazonS3
age: 1037722
etag: "3060a2d488da7041b6b45fcc3be5eb2d"
x-cache: Hit from cloudfront
x-amz-version-id: mLBZZBY69TN7tL_TZLnO.xjbr0Cn4nrf
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 327025
x-amz-cf-id: 4zb25GerOaBVsOJ_BrXFjccjArFCkGwtNgfIfvHX1tsB8R92kP8XXw==
expires: Sun, 19 Dec 2021 00:02:17 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BwNHDqjdhHCo6RDDsSeSewzjgXndPnJtNEqsFGP8HjxBG%2B4bu%2BQtuQDhTryazi5pYEu9cEO%2F2MtGh1Uh%2Br9BlM%2BB178FKOolQgE5cccENEjpnqEw5P8BTF3t5Qs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2020/12/19/batman.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8d63bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

americas-got-talent-2.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/05/28/
Redirect Chain

https://knews.vip/assets/images/2021-05-28/20/americas-got-talent-2.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/05/28/americas-got-talent-2.jpg

475 KB
476 KB

95ms
43ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/05/28/americas-got-talent-2.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fdfd6f2ef1cbb6c2ec5b9af69abd80a4450cd3aa57c651129759b2ef116cb72

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 13 Oct 2021 14:03:00 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Fri, 28 May 2021 18:33:09 GMT
server: AmazonS3
age: 1082286
etag: "c7207edd83b04f76dc2fcdbdf802af58"
x-cache: Hit from cloudfront
x-amz-version-id: jhmZ.B2ZDf48ry34DqwDiSRRiiHVlQVO
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 486386
x-amz-cf-id: oo03RAWCNL6VCub2fWgMzg2S9Qha8Ttk-RbhXjSkGw_oW0tw6zds0A==
expires: Sat, 28 May 2022 18:33:07 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tM8RwGSEh%2BJ7QJDR2dNMZQedtXtx7oWcBTlEK9iSJq2HywiCP%2FcfhMSMTYHYJLsnONri%2F3fnGXHco%2B%2BVsUFPcgUA0iCabN8m%2FaexkCqu5a%2BHBIaO942TkDlX2ic%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/05/28/americas-got-talent-2.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8d83bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

ray-j.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/06/
Redirect Chain

https://knews.vip/assets/images/2021-10-06/20/ray-j.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/06/ray-j.jpg

329 KB
330 KB

95ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/06/ray-j.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1388c64fe549aa56b6274bd660a9a7d96b53a1981e6b82c9b45e04acfa810bc9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 07:49:27 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 06 Oct 2021 21:18:38 GMT
server: AmazonS3
age: 1018299
etag: "96540a3295a8d99a9b28ff392dd69017"
x-cache: Hit from cloudfront
x-amz-version-id: QOL7Fk4sZC6Jtt8RO59ceQCh0rca5jWK
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 336806
x-amz-cf-id: 1Mijh2AlsGZiVN_Y7qLIQsG0XBQtYULH1koGkNDf7PnpS0v-VGfe3Q==
expires: Thu, 06 Oct 2022 21:18:37 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F9vn7SBb35Hj3M6cTfXusza4OyTaQQyJnaf%2FjLGBbb8EB5rNns%2FVMziyv9dp%2FdYUqc87NIon1Y%2FaVCzIlQrs8P3%2BCuZBfRENA92ImCQvbcy0CbLDRza0BWD%2BtYI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/06/ray-j.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8db3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

chris-goles.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/13/
Redirect Chain

https://knews.vip/assets/images/2021-10-13/20/chris-goles.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/chris-goles.jpg

352 KB
353 KB

99ms
41ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/chris-goles.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 116285d4bc3676024c5e8f9653805e7a2bfcbc9c6a6f3a4f7b07853263f7ac85

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 06:55:42 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 13 Oct 2021 17:19:20 GMT
server: AmazonS3
age: 1021524
etag: "371efee31c08c9e9777f872fd00a9548"
x-cache: Hit from cloudfront
x-amz-version-id: yBTZi13GXSZ4HsEQxkOOWjqY_Wwb.Dl0
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 360321
x-amz-cf-id: borC1RLkYhAlD29DkrogcTog56sU2QdcsdjUjUzSB4wlGi6-_F5NWg==
expires: Thu, 13 Oct 2022 17:19:18 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mfgPB9NCx7xDkNGo53Z4SkcW8HJLLs2kCeM4q7krx1YF%2Bvn6IOiSPOGZk6ejJHylcDu9yjkvBKcRagAGubCTmtx9TQRSVKORNOiv7F2qFaESAk42e6cnx5FmadE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/chris-goles.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8dc3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

jonah-hill.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/08/25/
Redirect Chain

https://knews.vip/assets/images/2021-08-25/20/jonah-hill.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/08/25/jonah-hill.jpg

2 MB
2 MB

87ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/08/25/jonah-hill.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 605bc622f5094dd28ab8b0022bb0f5fefeaf9539a2819c80fb33b98d34027395

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 02:32:32 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 25 Aug 2021 20:22:33 GMT
server: AmazonS3
age: 1037314
etag: "67015ab537c16a10d51a8a56af1bd80a"
x-cache: Hit from cloudfront
x-amz-version-id: r1W7EqATyBhUJFWXFmyV9BnhCw5712BO
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 1960050
x-amz-cf-id: dPpigNSS_lGdCSdsWgcerI_H__32GSnqL6vedj8UdT7x3RHLaNMvjw==
expires: Thu, 25 Aug 2022 20:22:31 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ow5E2k6pMqYR2DlvupwdS1WHuwqMUa7xUm47H5B%2Fue%2BfYo%2FS8KWUpk7KssrBwE3Ecd6zmgvMLNVYSYlfy6FSi%2Ff1CcGcJvhaUN8CqbEr8AM6HhcoHFLMAyen2UY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/08/25/jonah-hill.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8dd3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

beanie-lea-michele.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/13/
Redirect Chain

https://knews.vip/assets/images/2021-10-13/20/beanie-lea-michele.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/beanie-lea-michele.jpg

374 KB
375 KB

100ms
43ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/beanie-lea-michele.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8831cede8ed70ec2dbba23d75849d3aa26a86ac4b7faeb9db5e6f7e5825a95e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 15:26:26 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 13 Oct 2021 22:40:39 GMT
server: AmazonS3
age: 990880
etag: "c1c51ee089552ee0122c9acd3fe739ff"
x-cache: Hit from cloudfront
x-amz-version-id: nj0TVx3Fgg6gqyc83JZAKx1_a_ltiuXc
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 383288
x-amz-cf-id: GQjlNP5R7sOkXTGuqxepXxw61Ww7PZF0ErmosxdmcnFtKFSY__5mBQ==
expires: Thu, 13 Oct 2022 22:40:38 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=93HJ6FG%2FCKKVYhwADu3ecvvajndB3sx1NIsw8NucJ627AAKb%2FEGUjgIuto9IOtNQyu3SO6GY2ovyHkw%2FlPB8W7pPelM%2B7zBMqv5KEDwUSr0%2FGgporU3ISVKztf8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/beanie-lea-michele.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8de3bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

erika-girardi.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/06/24/
Redirect Chain

https://knews.vip/assets/images/2021-06-24/20/erika-girardi.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/06/24/erika-girardi.jpg

1000 KB
1001 KB

92ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/06/24/erika-girardi.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a068d17b571dd5032a40a65e913ffa1dcf011d5c3259265026671083b8266386

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 12 Oct 2021 09:45:48 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Thu, 24 Jun 2021 18:27:56 GMT
server: AmazonS3
age: 1184118
etag: "a5ef818a5626820dee61f42ccda8f5a7"
x-cache: Hit from cloudfront
x-amz-version-id: _DPg1k8kEbZabHxG4c22Uz3.gVRsTRHw
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 1023843
x-amz-cf-id: Fh34P6N3QeHK6fX6lEDVwuPUkAeMxmwjij3lnxaphwZD_OdRC4ZePg==
expires: Fri, 24 Jun 2022 18:27:54 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CWB90PPY34efqxtyEyE47UPG26P0LC%2Bq55Bk8uGQ%2FHUH82DmrvkXz8KuddiGKQVyvbQyQ1ejH43UGcCh3YOSCyMdZ6K9%2Fx3VgE46xaHT7ws94qTtfkE3oZfsRSA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/06/24/erika-girardi.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8e03bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2

200

masked-singer-1.jpg
static.onecms.io/wp-content/uploads/sites/20/2021/10/13/
Redirect Chain

https://knews.vip/assets/images/2021-10-13/20/masked-singer-1.jpg
https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/masked-singer-1.jpg

719 KB
720 KB

80ms
42ms

Image
image/jpeg

13.32.121.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/masked-singer-1.jpg
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-122.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efdc6fab59db35df1f105bc3170d6ff853f72e063cbe027aa85e4106b5fd9858

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 14 Oct 2021 02:25:06 GMT
via: 1.1 bc0a0f9f99d36a68240a31a25e39addc.cloudfront.net (CloudFront)
last-modified: Wed, 13 Oct 2021 09:21:09 GMT
server: AmazonS3
age: 1037760
etag: "2bf631baf72a6c20e9d32261fe079c90"
x-cache: Hit from cloudfront
x-amz-version-id: .qHQviCja.dd5eJe0sQdvuIQa1jrnQFu
cache-control: max-age=31536000
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
content-type: image/jpeg
content-length: 736462
x-amz-cf-id: wW3G53tiu1EWN8lfBi94vg8tehR57ljX-sBK_BnajFd7hhkDiq041g==
expires: Thu, 13 Oct 2022 09:21:07 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:04 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qG7KGDrrJtTbP4df%2B36fYr%2B97lY4SPLo7ro8sFIdleETJuxVGBkku8IoxPooFaZLJLh22QySGTMj0TxvKh40ML3XjuprNd8cgvzWj34DmTHMTPsBaa4G1Ewmn4U%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
location: https://static.onecms.io/wp-content/uploads/sites/20/2021/10/13/masked-singer-1.jpg
strict-transport-security: max-age=63072000
cf-ray: 6a4052d4d8e23bda-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 email-decode.min.js Show response
knews.vip/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 22ms
18ms Script
application/javascript 104.21.74.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://knews.vip/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.74.35 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: knews.vip
cookie: PHPSESSID=nn4j0gpnkukth0qic5i4crfa5p; _csrf=59365f5983a912ef19081641a0066c3286af3f17a2e30511193a00cd780952dfa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22hr9w4R0BjFjrXkCaoop11wjL2kHzk1v-%22%3B%7D
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Oct 2021 12:26:29 GMT
server: cloudflare
etag: W/"616eb975-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m2wbWywfgPUcgBokHT8K8MUPG%2BZdTW4bbcb51EsESmXaYqMZJdK9xHeOKa6XUb%2F5Ud%2Bd6H%2FX2fzahcWTZLyxwwbMolhnCDSI5lGHWAlcgGaqhMJW7XsaVviU4NA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800 public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6a4052d4c8b53bda-CDG
vary: Accept-Encoding
expires: Thu, 28 Oct 2021 02:41:04 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 95ms
23ms Script
text/javascript 142.250.184.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:26:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36861
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Tue, 25 Oct 2022 16:26:43 GMT

GET
H2 200 bootstrap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/ 36 KB
9 KB 39ms
15ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.19.94 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 420775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 8722
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04010-90b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6%2FtD6wrFIAmE06SwsIeyd%2F7uBoyzv1P%2Bxa570eYly22T9cXE5jSSVmO44eRS%2FYs7TD6YYftbGx8uoPOxEyk1kXp%2F%2Beil2UDwgQk0fUmJtG1DAptrGrVWN0T9uwdnVfelYqZTfhY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a4052d4e9d12169-DUS
expires: Sun, 16 Oct 2022 02:41:04 GMT

GET
H2 200 yii.js Show response
knews.vip/assets/6c104152/ 20 KB
6 KB 187ms
183ms Script
application/javascript 104.21.74.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://knews.vip/assets/6c104152/yii.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.74.35 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67bed69f23af460ec3341aefcdf793955c250fbf879589de4b93d17b8ec4ae54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Request headers

:path: /assets/6c104152/yii.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: knews.vip
cookie: PHPSESSID=nn4j0gpnkukth0qic5i4crfa5p; _csrf=59365f5983a912ef19081641a0066c3286af3f17a2e30511193a00cd780952dfa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22hr9w4R0BjFjrXkCaoop11wjL2kHzk1v-%22%3B%7D
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 26 Nov 2020 04:30:56 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5fbf2f80-51c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2jw9R39LMhibT8WeyD6qUGgf%2FNWOhF6k7OtrJGwlGtZTTQcH3Xas3f7WnzAIsAgzt9vR0Ykzryu1Ibt1a1lHU8zFqMvRpC411ltcT%2Bjp8RVAvP1DF5LQe0Z5tmw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6a4052d4c8b93bda-CDG

GET
H2 200 theme.options.js Show response
knews.vip/themes/v1/files/js/ 3 KB
2 KB 210ms
205ms Script
application/javascript 104.21.74.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://knews.vip/themes/v1/files/js/theme.options.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.74.35 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdebdc14b79c41bb073f8390fbe5fab5ddde75078b0d23fe946380b4500eb96b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Request headers

:path: /themes/v1/files/js/theme.options.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: knews.vip
cookie: PHPSESSID=nn4j0gpnkukth0qic5i4crfa5p; _csrf=59365f5983a912ef19081641a0066c3286af3f17a2e30511193a00cd780952dfa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22hr9w4R0BjFjrXkCaoop11wjL2kHzk1v-%22%3B%7D
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 07 May 2020 02:17:08 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5eb36fa4-b52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xQl0I0%2BzUCCEU%2BNS92qffb%2Fhu%2Fh7mZnEfN0eBY4k6RVMwOhNn6hwG9Y9VnZf4hJeJ76t20DRrO1RCpg6Nl1YYGIPJZa7uJ9E6WYtHX%2F8Up8hSQzqJhlZlvOxAuE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6a4052d4c8ba3bda-CDG

GET
H2 200 app.min.js Show response
knews.vip/themes/files/themes/admin/dist/js/ 10 KB
3 KB 213ms
209ms Script
application/javascript 104.21.74.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://knews.vip/themes/files/themes/admin/dist/js/app.min.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.74.35 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46d2d23656c7a5ac146fcada3e2f7b66f9cd8e8b69200a81c17e17d58f33cb6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Request headers

:path: /themes/files/themes/admin/dist/js/app.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: knews.vip
cookie: PHPSESSID=nn4j0gpnkukth0qic5i4crfa5p; _csrf=59365f5983a912ef19081641a0066c3286af3f17a2e30511193a00cd780952dfa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22hr9w4R0BjFjrXkCaoop11wjL2kHzk1v-%22%3B%7D
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 07 May 2020 02:17:08 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5eb36fa4-262d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uK5iXBgWy%2FfZ%2FwprJT33IaU5qhiQbAjRvTy5f060xvh7UMLFIR%2BCdU%2F8G4nF76EyrZ8853wdxVOSXUUI81XR970LYgExQIJ2xiyEDTydwDzCs86duLD5qIQ4hz8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6a4052d4c8bb3bda-CDG

GET
H2 200 jquery.scrollUp.min.js Show response
cdnjs.cloudflare.com/ajax/libs/scrollup/2.4.1/ 2 KB
1 KB 39ms
16ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/scrollup/2.4.1/jquery.scrollUp.min.js

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.19.94 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7662ba99a132eafd0b7ccc8c3404c8ae442d97e7e6b73bb3ce0d4f11c28c98c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 11228594
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 806
cf-request-id: 0abecb5a120000219fbb9ef000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fcb-7f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J%2FzxvgJ28g8TsXRnhCfpwZKdOIugXecQn2gR%2F5jSmMobtyWPjBdNCjbZBskk359OIuBHhXMObIxXV%2FvQCPD2UI3IN%2BIb2BNmaH8aglhMeAbSAVYPIr5k65CW6bvTZCm49ynPFtp1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a4052d4e9d22169-DUS
expires: Sun, 16 Oct 2022 02:41:04 GMT

GET
H2 200 functions.js Show response
knews.vip/themes/v1/files/js/ 9 KB
4 KB 202ms
198ms Script
application/javascript 104.21.74.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://knews.vip/themes/v1/files/js/functions.js?1

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.74.35 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3a68fe5684414b8f1e1e73851473659a35ddb436fa829b39ee96dc31d58bebf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Request headers

:path: /themes/v1/files/js/functions.js?1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: knews.vip
cookie: PHPSESSID=nn4j0gpnkukth0qic5i4crfa5p; _csrf=59365f5983a912ef19081641a0066c3286af3f17a2e30511193a00cd780952dfa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22hr9w4R0BjFjrXkCaoop11wjL2kHzk1v-%22%3B%7D
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 18 May 2020 02:43:55 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5ec1f66b-2592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pQSoU%2F86pH1TQonofaaXnu4b4g7q23KcnMLsmLQrpOb809k0V7qI7KVPfBUOmgGHumC5TGlgMn2TAJuWrg9KqQT%2BpmePNdnG%2BYNC2zMZYqx2NyrKgfF94Y7thW0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6a4052d4c8bc3bda-CDG

GET
H2 200 init.js Show response
knews.vip/themes/v1/files/js/ 8 KB
3 KB 208ms
204ms Script
application/javascript 104.21.74.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://knews.vip/themes/v1/files/js/init.js?1

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.74.35 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c453cfdea86fabf7ed28ab544f07854b896d71fba9a5ca91d45ced24e2c62ce1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Request headers

:path: /themes/v1/files/js/init.js?1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: knews.vip
cookie: PHPSESSID=nn4j0gpnkukth0qic5i4crfa5p; _csrf=59365f5983a912ef19081641a0066c3286af3f17a2e30511193a00cd780952dfa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22hr9w4R0BjFjrXkCaoop11wjL2kHzk1v-%22%3B%7D
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 07 May 2020 02:17:08 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5eb36fa4-212d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kQbCfR3znAviT2VyGwVC1q8zOrtLHoRutjlSycWJbI7xOgoYSbA8BB4w4S784Hd3FWb8rr3ifKKJsIUMKCjjIrIfyXC7F4AUiyZRztUCnEqRaOfNXDDOShq1jb8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6a4052d4c8bd3bda-CDG

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 89 KB
35 KB 107ms
50ms Script
application/javascript 142.250.185.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-23576931-63

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

36686c06f3ae1a9674d3088b6d248700878d0e56958d4440a94ebe3dfe48ddf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35756
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 26 Oct 2021 02:41:04 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110200101/ 270 KB
97 KB 76ms
48ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8071954460122741&plah=knews.vip

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8071954460122741

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51fbc43a986a30d22ab621f23d0d95e51dd574f1f1b677af3bc77c226cf957cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 99003
x-xss-protection: 0
server: cafe
etag: 2748601908783812869
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 02:41:04 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211020/r20190131/ Frame 2677 10 KB
5 KB 80ms
23ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211020/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-8071954460122741

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211020/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 15:13:19 GMT
expires: Mon, 08 Nov 2021 15:13:19 GMT
content-type: text/html; charset=UTF-8
etag: 15765991816257340444
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4703
x-xss-protection: 0
age: 41266
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 css
fonts.googleapis.com/ 15 KB
2 KB 88ms
30ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700,300italic,400italic,600italic

Requested by

Host: knews.vip
URL: https://knews.vip/themes/v1/files/css/knews/theme.css?1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c6a2a2256a07c37434aaff7fbafa71ebf8b4d0f4580507e550812c3f89aca00b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:32:58 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:05 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 199 B
605 B 105ms
31ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=knews.vip&callback=_gfp_s_&client=ca-pub-8071954460122741

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110200101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8071954460122741&plah=knews.vip

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

8e88689df948e8522ab461744a9765e8dbb019eecaa513f99a45571a97ef7a6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 189
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
716 B 113ms
36ms Script
application/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=knews.vip

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
520 B 118ms
40ms Script
application/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=knews.vip

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A9DA 196 KB
47 KB 423ms
372ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&adk=1812271804&adf=3025194257&lmt=1635216065&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fknews.vip%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216064922&bpp=3&bdt=185&idt=129&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1867538364568&frm=20&pv=2&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=143

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1f1a140d5ad4d25e956bfac6ceba95e283030f4ca43f208f2e84350c4894eea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8071954460122741&output=html&adk=1812271804&adf=3025194257&lmt=1635216065&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fknews.vip%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216064922&bpp=3&bdt=185&idt=129&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1867538364568&frm=20&pv=2&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=143
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 26 Oct 2021 02:41:05 GMT
server: cafe
content-length: 48027
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 26-Oct-2021 02:56:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:05 GMT
cache-control: private

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 104ms
26ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700,300italic,400italic,600italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f110.1e100.net

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://knews.vip
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 24 Oct 2021 11:16:30 GMT
x-content-type-options: nosniff
age: 141875
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 24 Oct 2022 11:16:30 GMT

GET
H3 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ 75 KB
76 KB 55ms
29ms Font
application/octet-stream 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Origin: https://knews.vip
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 351985
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 77160
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-12d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oGXMJn2lktJWiNs29McVnnhv2BqRtHmbq3HB21HL5MwQEe8%2F56LCR3MPbuxL0Zg%2Fs23smZkmfbmLbEQyfYmQYrKUPu%2BsvAHgdNrJ1rb8CCpKvGJglg3pEPHRzaw2QygTj5wkzzLC"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a4052d6e8d77169-DUS
expires: Sun, 16 Oct 2022 02:41:05 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 61ms
16ms Script
text/javascript 172.217.18.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-23576931-63

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Oct 2021 16:47:48 GMT
server: Golfe2
age: 2431
date: Tue, 26 Oct 2021 02:00:34 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19887
expires: Tue, 26 Oct 2021 04:00:34 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 44ms
23ms XHR
text/plain 172.217.18.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j94&a=2098582901&t=pageview&_s=1&dl=https%3A%2F%2Fknews.vip%2F&ul=en-us&de=UTF-8&dt=%EC%B5%9C%EC%8B%A0%20%EC%97%B0%EC%98%88%EC%9D%B8%20%EB%B0%8F%20%EC%97%B0%EC%98%88%EA%B3%84%20%EB%89%B4%EC%8A%A4&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1280594293&gjid=876079068&cid=1442706505.1635216065&tid=UA-23576931-63&_gid=379910952.1635216065&_r=1&gtm=2ouak0&z=799606719

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f110.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://knews.vip
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110200101/ 143 KB
52 KB 42ms
41ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202110200101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a92f4e0e6359374bf1da61525973ba062952489af08cc7cb2a32fe693f757d7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 52847
x-xss-protection: 0
server: cafe
etag: 14086096054196716776
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 63ms
32ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=knews.vip

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 74ms
32ms Script
application/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=knews.vip

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame ECB2 110 KB
39 KB 463ms
462ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f549e257f1abbcff1d1a2f87f71ad588b53e5bdbe5e7ad0e54a8f3965d979761

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 40099
x-xss-protection: 0
set-cookie: IDE=AHWqTUnMd7Kr4_UT2n69qA5fIdDhA3o775LRx3k6gOYafjhoESCyB2Vqp8Yxz392nXE; expires=Sun, 20-Nov-2022 02:41:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A1E2 110 KB
39 KB 520ms
520ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2341c0632e0d195a5878872cd95fe2364473cf253bedf6a64a7f3bbc9cc5fb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 40081
x-xss-protection: 0
set-cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; expires=Sun, 20-Nov-2022 02:41:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 069F 111 KB
40 KB 426ms
425ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f6eb2d657cc541fbc992f6317b39fbe8acf93c1372593af0603dd717544b206

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 26 Oct 2021 02:41:05 GMT
server: cafe
content-length: 40658
x-xss-protection: 0
set-cookie: IDE=AHWqTUmEyD10sZrchR8thEgJO8IWq5Ci2YrEhvpmuKBfwNAOFHeFZ_X0mWeYQj7c340; expires=Sun, 20-Nov-2022 02:41:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:05 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B29C 81 KB
29 KB 272ms
272ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13e4f1b3040d61397a7e03832f4c0f36428db2a4db625872145f0ca7104b4ab4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 26 Oct 2021 02:41:05 GMT
server: cafe
content-length: 29975
x-xss-protection: 0
set-cookie: IDE=AHWqTUmdqxr-9DzgO9UVarwE_E3c5MThESMBbWpeQKScI8QbI1zGjWIVHM8Phx-4uSM; expires=Sun, 20-Nov-2022 02:41:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:05 GMT
cache-control: private

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/ Frame 4131 10 KB
5 KB 26ms
26ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 15:13:15 GMT
expires: Mon, 08 Nov 2021 15:13:15 GMT
content-type: text/html; charset=UTF-8
etag: 15765991816257340444
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4703
x-xss-protection: 0
age: 41270
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/ Frame 6A16 10 KB
5 KB 27ms
26ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1437cdd25532919299784f840c613a46dbcf783903d558bcf5386defd7cceb1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 15:13:15 GMT
expires: Mon, 08 Nov 2021 15:13:15 GMT
content-type: text/html; charset=UTF-8
etag: 15765991816257340444
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4703
x-xss-protection: 0
age: 41270
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 css2
fonts.googleapis.com/ Frame 4131 4 KB
635 B 58ms
30ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 01:47:52 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:05 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 4131 205 B
714 B 71ms
20ms Image
image/png 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 22:47:23 GMT
x-content-type-options: nosniff
age: 14022
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 25 Oct 2022 22:47:23 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 4131 604 B
696 B 72ms
21ms Image
image/png 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 15:01:21 GMT
x-content-type-options: nosniff
age: 214784
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 23 Oct 2022 15:01:21 GMT

GET
H2 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/elements/html/ Frame 4131 18 KB
8 KB 73ms
22ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3108a595755e4b68a8c9af8465be4462d8d3479043a586bfd3bc18c97c06fe6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 23:59:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9702
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7873
x-xss-protection: 0
server: cafe
etag: 16040667361225943213
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 08 Nov 2021 23:59:23 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6A16 0
0 42ms
42ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CbJ8hwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuAFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVOq-KxWH4mUb73Mmy2xQdbsqBrgAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItODA3MTk1NDQ2MDEyMjc0MRgA&sigh=JCE11WV8DSU&uach_m=[UACH]&cid=CAQSGwCNIrLM61FH93EYOW6BWhIa83NyiaKtYTn8VBgB

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 26 Oct 2021 02:41:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 6A16 0
0 59ms
15ms Fetch 178.250.0.129
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UKSwEcz6RO0HfJ2DYgICAAAAwm0i0lufaCYQwGp3YcbYhcdm8HwhoFHgABI&wp=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw
Requested by: Host: knews.vip
URL: https://knews.vip/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.129 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Kestrel /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:04 GMT
server: Kestrel
content-length: 0
server-processing-duration-in-ticks: 268020

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 136F 240 KB
62 KB 195ms
157ms Document
text/html 178.250.2.144
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.144 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Kestrel /
Resource Hash: 5f99ca85bc03076f2a7e94069eeb8c66f047c0c3b31ed786fc61a54c03535c92

Request headers

:method: GET
:authority: ads.eu.criteo.com
:scheme: https
:path: /delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=ynToieV4euu7QM8OuwXPIqWMpZ-XYtH8RcGHqGydQ1cEJIm6NKmb8RYHcRrb1XUsKGvA4GoL8rkWeXdLrDZ0htgrVtLp3sBfIYVXHQgIUHPL6POS8I1CSPotSmdY-Db4aWD8THXyuoPOu62diWqrnr8r6FLbiC7p2ISiZL1z-o-EZgto91KiaFXLvQmPt5CnaY9ggGMTkaGxX33vMps9LFxQf0ebVYwV4zeTyslIDdm2456AI6PSSjMpWczlQqEi1an8sQ"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 144283696
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 6A16 3 KB
1 KB 76ms
37ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:11:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:11:40 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6A16 120 KB
37 KB 86ms
33ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eefb74cc5ac64da8206bbf5f929ee9c260d7d6162ec2a799e1fdb6190429bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634750403498492"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 6A16 14 KB
7 KB 58ms
20ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:30:36 GMT

GET
H3 200 301572d769f8f4c170bcd6e84c92088d.js Show response
www.gstatic.com/mysidia/ Frame 2449 7 KB
3 KB 50ms
22ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/301572d769f8f4c170bcd6e84c92088d.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed3d1a7f0e374a479fd9106f6b32ce6062baac77315d4729e3e2c55423ad28c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 15:41:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385189
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3259
x-xss-protection: 0
last-modified: Wed, 20 Oct 2021 09:43:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 19 Jan 2022 15:41:16 GMT

GET
H3 200 c1f2f0fd7b288136cd686041e8761b93.js Show response
www.gstatic.com/mysidia/ Frame 2449 11 KB
5 KB 52ms
25ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c1f2f0fd7b288136cd686041e8761b93.js?tag=pingback

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9ce77ca8907b7d7057eb4ab9a0a9ffdac3e33b1f8131902f5eac1affda9025f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 21:45:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 190517
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4785
x-xss-protection: 0
last-modified: Wed, 20 Oct 2021 09:43:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Fri, 21 Jan 2022 21:45:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 2449 3 KB
580 B 31ms
31ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 01:45:32 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:05 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 2449 2 KB
912 B 59ms
29ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4e852fde612daeb72f1f4cca801a99cc2730875048c5ac3faa9f5ca5854155

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 00:40:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 885
x-xss-protection: 0
server: cafe
etag: 638833322182864030
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 00:40:27 GMT

GET
H3 200 5d8faba72261428c4cab8183d1fbb79d.js Show response
www.gstatic.com/mysidia/ Frame 2449 6 KB
2 KB 49ms
23ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/5d8faba72261428c4cab8183d1fbb79d.js?tag=analytics_pingback_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb41aaaf3b2b96d56a0e7cfbf3496615191a3350e03cd252e41e8e92b9d1666

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 07:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 416038
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2511
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 04:56:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 19 Jan 2022 07:07:07 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame 2449 18 KB
8 KB 53ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7700
x-xss-protection: 0
server: cafe
etag: 14378044041589781240
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:33:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 2449 3 KB
1 KB 58ms
29ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:11:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:11:40 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2449 120 KB
37 KB 47ms
46ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eefb74cc5ac64da8206bbf5f929ee9c260d7d6162ec2a799e1fdb6190429bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634750403498492"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 2449 14 KB
6 KB 52ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:30:36 GMT

GET
H3 200 fc4a425cba241d0dce431f7f76e62919.js Show response
www.gstatic.com/mysidia/ Frame 2449 27 KB
11 KB 46ms
20ms Script
text/javascript 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fc4a425cba241d0dce431f7f76e62919.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

869ace4624ebda5612a7f696ec880c3ccb0d9bc4407d860fb77939bef2c60858

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 21:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 190515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11259
x-xss-protection: 0
last-modified: Wed, 20 Oct 2021 09:43:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Fri, 21 Jan 2022 21:45:50 GMT

GET
DATA 200
OK truncated
/ Frame 6A16 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 887ec61895f6ee164a877e8516daddc4af25cb7cb7e0557b9cc84bf4d00ce13e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 76E8 143 B
163 B 26ms
25ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkJegYgDSl3RKae6AgDCSfa91Z4cmTsn96uLI8vDLtlhkeNf8t7wJt10SYFciU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 26 Oct 2021 01:43:06 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3479
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 136F 2 KB
1 KB 50ms
15ms Image
image/svg+xml 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/flash/icon/privacy_small.svg
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 21 Oct 2022 02:41:05 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 136F 2 KB
1 KB 50ms
16ms Image
image/svg+xml 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/flash/icon/adchoices_de.svg
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 21 Oct 2022 02:41:05 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 136F 308 B
608 B 49ms
15ms Image
image/svg+xml 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/flash/icon/close_button.svg
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 21 Oct 2022 02:41:05 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 136F 507 B
807 B 50ms
15ms Image
image/svg+xml 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/flash/icon/back_button.svg
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Fri, 21 Oct 2022 02:41:05 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 136F 43 B
344 B 57ms
18ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=qWp7kh-vsunNJFuWUgdXapXhHRyTWmQCVQf8r5mFjW5U3WKhIKlxSqIf9nXcK73sjTMWfWRdU7zNNMwCiUJWkkifiGCPYAS-zUVOXL1RI_zWA3RBQxY5JQ3r-Z2oxz1bF3p_4vZTHIRwKE3I8cQ6EXAmQFpnSeLDZSrwpn_WL_OzKf-HmJFcDikMU6RLAO1k87Oq91QUhI4bZejh5nFsjf4j30gyXPqhWaPTertZWyhvTGT5EqNIo7JyYY3SafW6q0RU4nCdX25oimPUXv4qcx-bQfjLKmAs3svQ5a92e64_yRb_jKmwwF8fRBQ960XlyhcskByFsp26s0b1VgFRVwwk0lQ3rdIh3JnacpdqT_ouSx5_UolD74WmyphOXMOkLfJ9vniBW5e4KV2ynVBBovwIg7UWaND1snIAULym5tVnGNq44gZ3ol6qja-SKvtEt-Y1WA
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:05 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 8576
content-type: image/gif
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 848731386569608598
tpc.googlesyndication.com/simgad/ Frame B29C 85 KB
85 KB 26ms
25ms Image
image/gif 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/848731386569608598

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

284c1e4301342cd5ad24f08aff0d06c81d530de3109beb64d46fb45e7b2ac7ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 19:51:49 GMT
x-content-type-options: nosniff
age: 24556
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 87305
x-xss-protection: 0
last-modified: Wed, 21 Jul 2021 06:48:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 25 Oct 2022 19:51:49 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame B29C 18 KB
8 KB 24ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 437
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7700
x-xss-protection: 0
server: cafe
etag: 14378044041589781240
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:33:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame B29C 3 KB
1 KB 33ms
33ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:11:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1765
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:11:40 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B29C 0
0 46ms
46ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CWXPVwWp3YfbSJMi3x_AP4ISLmAOG6qjxY5Cwjaq3Dv_1kOPXAhABIJ7amjFgleKQgqAHoAHs0PbYAsgBA6kCurxVvDlpDT6oAwHIA8kEqgTaAU_QC50Ntsnm9ZW6KBWd08lyRJyxYIfuPwN0z0anbcpKQRWORaZFOFKCXAAX5qgbiDMO086zYkaGoYjQaccm_9XHZKRsZrgivxyL7__ll1cKrdi-jVJzlc6eGegjDNdJ1EC_cvPhmbFv7YCfat71_N0-Y8Zxt72eWvfi7x90bQTHutYHi4P-nke2ZP3bP1P9Ap8tkrPwB3PA4vsg6svRqDVKvySTJqXo0xzJzs0TcWK0UP7dtRUXQ54N1E-BDpMre-q7QGh5bpx5e5d7n5bZfOBZ9hWpzexrzoF6wASYlpqe0wOSBQQIBBgBkgUECAUYBKAGA4AH_K6JpwGoB_DZG6gH8tkbqAeOzhuoB5PYG6gH7paxAqgH1ckbqAemvhvYBwHyBwQQpu8B0ggJCIDhgBAQARhfgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTgwNzE5NTQ0NjAxMjI3NDEYAA&sigh=k6cLWNR27DM&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 26 Oct 2021 02:41:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B29C 120 KB
37 KB 66ms
36ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eefb74cc5ac64da8206bbf5f929ee9c260d7d6162ec2a799e1fdb6190429bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634750403498492"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 26 Oct 2021 02:41:05 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame B29C 14 KB
6 KB 24ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:30:36 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B29C 0
0 77ms
28ms Image
text/html 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSj9ZnojgzA1x2a7_Y5a0XRiA75Ijo-GLpEr0EBZdp-cwHFGzf0hb5_WtbqK8hdYUgQCG8HAqfkAJYo4jdVYwLOtlELQg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.74.196 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s02-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame B29C 27 KB
11 KB 30ms
30ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20731b5cce4398a7bea4b2b919dcab676f481d929c16a12b6a74a19b51e48d01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 12:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 49329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 11249
x-xss-protection: 0
server: cafe
etag: 2407096445939648700
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 08 Nov 2021 12:58:56 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 136F 12 KB
5 KB 28ms
17ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 422541
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXT9g5vjVwlxy7nUDrohjEQAEqCx%2FLUfPucsnuix4uZX0bZo9QUgMLrGgHcYllAnnDcpijCSIDV65AmcWBGBUt6dbm5Aki4atUETJFqd64FxRn6DAs%2FQSddekqaP4UqfIUD828Q6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6a4052dc1fbb219f-DUS
expires: Sun, 16 Oct 2022 02:41:05 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 136F 12 KB
6 KB 18ms
18ms Script
text/javascript 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/animejs/animejs.js
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 21 Oct 2022 02:41:05 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 2 KB
2 KB 53ms
12ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?h=244&m=0&partner=36976&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F25729%2F160111%2Fa02e5ddf7c6745cab10867b1055b3b78_na-kd_logo.jpg&v=3&w=196&s=zqzI2je0eFfh76QqKhMt5VKm
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 527a70ae8d19865842b71de5810c274372ee3252f5537c085cec9a455fdd96f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30881094
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1636
expires: Tue, 18 Oct 2022 12:46:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 10 KB
11 KB 62ms
21ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_recycled_circle_detail_strappy_bikini_panty_1000-100766-0795_01j.jpg%3Fref%3D176E4E28A7&v=3&w=800&s=efLtdo8aiOgsBAB3VpAd_Bgj&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: b1c6279718d25ca90753a29ec0684267fb9052a6c35e2b9bfec8790d64863716

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29950830
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10590
expires: Fri, 07 Oct 2022 18:21:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 8 KB
9 KB 64ms
24ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fhanna_recycled_strap_detail_triangle_bikini_top_1647-000136-9430_01j.jpg%3Fref%3D33709F3FEF&v=3&w=800&s=FyGA78gU0RT-pYbRi-RGAMpW&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 44cbb75f7e333fda601d431649c32c820f40371cf42ecb38a635edd5a7776151

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28740570
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8562
expires: Fri, 23 Sep 2022 18:10:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 6 KB
7 KB 66ms
26ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fhanna_recycled_wide_strap_bikini_top_1647-000170-0001_01j.jpg%3Fref%3D1F98684B69&v=3&w=800&s=BKY99VlYlAF5Mfx5FuPW7H8s&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: a69cdcd1e40bfb61066fbe0690c4e0623e6a5454d19af86173419060664995ba

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29263064
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6428
expires: Thu, 29 Sep 2022 19:18:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 8 KB
9 KB 69ms
29ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fhanna_recycled_bandeau_detail_bikini_top_1647-000160-9363_01c.jpg%3Fref%3DDBCC006141&v=3&w=800&s=GA2wjNsHWvPflXAIALxiNV9F&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 33150969e548f4282e69de81aa4bbcd9d3a43cdc3a85468f582c0f92efaa48b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28666081
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8470
expires: Thu, 22 Sep 2022 21:29:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 10 KB
10 KB 70ms
30ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fsamsoe_samsoe_myrara_bottom_aop_1053-000400-8068_01j.jpg%3Fref%3D7255E51D08&v=3&w=800&s=a4878B25lZCFqSWi8KTxVte0&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 22a2f5884ed18002c9f58e9ba7a79e7ca240d00082eb6f6ed6628098dd008bd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30748132
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10388
expires: Sun, 16 Oct 2022 23:49:58 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 4 KB
5 KB 22ms
20ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_overlap_ls_v_neck_dress_1660-000892-0002_01c.jpg%3Fref%3D7FFAFFBE5A&v=3&w=800&s=tMKUr7N3_qFDy7Vur4BloRX6&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e485fcec599a13e7bf2a416f1b987071561f0ce7cf10ab6b1284f5c429993536

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29949843
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 4572
expires: Fri, 07 Oct 2022 18:05:09 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 11 KB
12 KB 20ms
18ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fpamela_recycled_high_slit_midi_dress_1659-000040-9358_03j.jpg%3Fref%3D2C73DDA111&v=3&w=800&s=vu4xYJf8xZNgNrcK-mh-AcQC&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: fe41bf173b5672173aef74b175e0ec8b6ec910a34a1340542526bc4f4bdf4788

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28745483
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11538
expires: Fri, 23 Sep 2022 19:32:29 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 8 KB
9 KB 27ms
25ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_v-shaped_front_midi_dress_1690-000044-0031_01g.jpg%3Fref%3D928C4AE520&v=3&w=800&s=zSWuNCdw_a9TWuIPJBxjcc8q&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: b67bae1bf9302992b61b32cd0afeb2ea036627863a586ef4489aa2dd673ea8a7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31466108
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8700
expires: Tue, 25 Oct 2022 07:16:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 7 KB
7 KB 26ms
25ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_one_shoulder_pu_shirt_1018-006442-0002_01a.jpg%3Fref%3D41EEC57291&v=3&w=800&s=QPybS1jAhkjbNWldfT48u0L1&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e76d1434cf74f52a084767fd3f6ffa0eddab1956538ab3e76380d0b13b60e8c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30799569
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7224
expires: Mon, 17 Oct 2022 14:07:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 7 KB
8 KB 24ms
22ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fhanna_knitted_mini_dress_1647-000162-0618_01j.jpg%3Fref%3D426F5E0A96&v=3&w=800&s=lEGWt6gOYyoNfklrky1fHMR-&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 30a1c8360e024083d65fa8d15bf304c97d6cca6ddd524ee0226aabf7ca87d2eb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28745512
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7622
expires: Fri, 23 Sep 2022 19:32:58 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 12 KB
12 KB 28ms
27ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_pu_tied_waist_blouse_1018-004180-0002_01a.jpg%3Fref%3D2A20136BF8&v=3&w=800&s=Et7Oscf8y-RJuhbHO-6zE4z4&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 3e621bf9491eb1daf4c3f47f370c2eb5a792bfad231dd1933365816a816cd869

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31078351
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12536
expires: Thu, 20 Oct 2022 19:33:37 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 7 KB
7 KB 33ms
32ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fpamela_circle_cut_dress_1659-000108-0002_01c-1.jpg%3Fref%3D18104A1958&v=3&w=800&s=C75k5_SHE55HrDiP31qqjMPr&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: c562a51196a745b315b48061b2751d330aaf38a07a2c44969bde26518ef26f43

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29566029
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6752
expires: Mon, 03 Oct 2022 07:28:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 2 KB
2 KB 84ms
82ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fgiftcard-images%2Fvalues%2Feur%2F50%3Fref%3D1D5A058B07&v=3&w=800&s=ZJcfq2LRO7A_atf2AYc0i8gm&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 5d512cad1833af9ab0c13f38b1297beee4b63303687fa09da61fd75bf13b8ea6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2036
expires: Fri, 21 Oct 2022 02:41:06 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 9 KB
9 KB 36ms
34ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fpamela_circle_cut_mini_skirt_1659-000105-0002_01j-1.jpg%3Fref%3D3B3700F309&v=3&w=800&s=j847TVx2FlLU-_7MJcltplij&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: a9b6a6c5eae10a0b060b695193f6fc6277c80eeac1a694ff78c14ad1de8baef8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29566346
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8854
expires: Mon, 03 Oct 2022 07:33:32 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 9 KB
9 KB 36ms
35ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_v-neck_long_sleeve_top_1100-000338-0002_r1.jpg%3Fref%3DD13802B2CB&v=3&w=800&s=fkEhFd0cXqYUs8IMKu1fItZk&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: a028cf09259fe93e9c51e95eb3182e05b5b04559ae5f034a5760fc365ae152a7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29946490
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9024
expires: Fri, 07 Oct 2022 17:09:16 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 6 KB
7 KB 31ms
30ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Frecyled_regular_blazwerr_1660-000664-0617_04j.jpg%3Fref%3DCB835C5A8B&v=3&w=800&s=gzuu_vKKZOdh99ETRSeNk9FB&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 7e273721f206802c9c87095b359ba40bdc056150ceb571797b65c36177150658

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28738574
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6456
expires: Fri, 23 Sep 2022 17:37:20 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 18 KB
18 KB 33ms
31ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_knitted_sweater_1659-000122-0617_01c-1.jpg%3Fref%3D8498EAD318&v=3&w=800&s=6Q_7S6AZx6RSLDWYAzEGmR7Q&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e0bcc4d3ec8c5900eafab7efc36ad4860353bfc3950d080d54a640ac0970d8e1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29566804
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 18638
expires: Mon, 03 Oct 2022 07:41:10 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 136F 6 KB
6 KB 28ms
27ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pix.eu.criteo.net/img/img?cq=256&h=800&m=0&partner=36976&q=80&r=0&u=https%3A%2F%2Fwww.na-kd.com%2Fglobalassets%2Fnakd_quilted_pu_skirt_1100-002311-0010_01j.jpg%3Fref%3D9EEB6B2132&v=3&w=800&s=_r_TVFwtfZIm4M0DsNNGOr3f&b=400
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: pix.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: 6dc9682d58138861d37068ad0a720f3232d8de2d1c6c6e93414e5880a43f988d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:05 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30634615
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5902
expires: Sat, 15 Oct 2022 16:18:02 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 136F 0
99 B 58ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://csm.eu.criteo.net/all?cppv=3&cpp=ynToieV4euu7QM8OuwXPIqWMpZ-XYtH8RcGHqGydQ1cEJIm6NKmb8RYHcRrb1XUsKGvA4GoL8rkWeXdLrDZ0htgrVtLp3sBfIYVXHQgIUHPL6POS8I1CSPotSmdY-Db4aWD8THXyuoPOu62diWqrnr8r6FLbiC7p2ISiZL1z-o-EZgto91KiaFXLvQmPt5CnaY9ggGMTkaGxX33vMps9LFxQf0ebVYwV4zeTyslIDdm2456AI6PSSjMpWczlQqEi1an8sQ&sds=2&rev=79260&sendBeacon=true
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 26 Oct 2021 02:41:05 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 136F 2 KB
1 KB 17ms
16ms Image
image/svg+xml 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/flash/icon/criteo_logo_2021.svg
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 21 Oct 2022 02:41:06 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 136F 2 KB
1 KB 17ms
17ms Image
image/svg+xml 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.criteo.net/flash/icon/privacy.svg
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 21 Oct 2022 02:41:06 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2449 0
20 B 31ms
31ms Ping
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=CgcIByoDd2ViCgcICCoDbHRyChwIASoYbGFyZ2UtYmFubmVyLXJkYS12YW5pbGxhCgoIAioGc2VydmVyChoIBCoWbXlzaWRpYV9hbmFseXRpY3NfZXhwMgoNECshAAAAAAAAEEAwBAoNEAMhAAAAAADAX0AwBAoNEA0hAAAAAAAAAAAwBAoJEB4qAzB4MDAECgkQGSoDMHgwMAQKDRArIQAAAAAAABhAMAQKDRAQIQAAAAAAAAAAMAQKDRARIQAAAABAFtFAMAQKDRASIQAAAAAAACBAMAQKDRATIQAAAAAAABBAMAQKDRAXIQAAADIzg2JAMAQKDRAUIQAAAABAWtJAMAQKDRAVIQAAAAAAACZAMAQKDRAWIQAAAAAAABRAMAQKDRAYIQAAAGZmZnNAMAQSGkNJSEN4c1dHNV9NQ0ZSemJFUWdkWGJVRlRRIhp0ZXh0L3ZhbmlsbGFfdGV4dF9jbG9zZV92MigD

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/c1f2f0fd7b288136cd686041e8761b93.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 76E8
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

46ms
46ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 26-Oct-2021 03:41:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BDA6 143 B
163 B 27ms
26ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmEyD10sZrchR8thEgJO8IWq5Ci2YrEhvpmuKBfwNAOFHeFZ_X0mWeYQj7c340
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 26 Oct 2021 01:43:06 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3480
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 639D 1 KB
749 B 26ms
24ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 08:58:57 GMT
expires: Tue, 26 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 63729
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js Show response
pagead2.googlesyndication.com/bg/ Frame CC64 35 KB
13 KB 24ms
24ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211020/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13325
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 25 Oct 2022 16:43:49 GMT

GET
DATA 200
OK truncated
/ Frame B29C 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8bcc4c85c48642ad95e61bb34f5b62be04a8b9aea3caec5da35079d2d7ccdf4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 136F 5 KB
705 B 31ms
31ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,700%7CCardo:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek,latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bd1d8be8dba0fad311572006ad1ea3e7827f5fcef144929b412665e5d62fd52d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 01:51:19 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 069F 10 KB
866 B 31ms
30ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500|Source+Sans+Pro:300,400&lang=ko

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

65bba70a916fb995824adbf44886c47429cb8e8976936e9f8ac32c1a65c8e41a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:41:06 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 069F 10 KB
866 B 33ms
32ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500|Source+Sans+Pro:300,400&text=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

65bba70a916fb995824adbf44886c47429cb8e8976936e9f8ac32c1a65c8e41a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:41:06 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 069F 32 KB
13 KB 24ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/m_js_controller_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b4550ac1f8a3f589276d0a1a9dddafa7ab37606a2dc52ed59580e776071cbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 00:58:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 12922
x-xss-protection: 0
server: cafe
etag: 10609840481343520096
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 00:58:23 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame 069F 18 KB
8 KB 23ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 438
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7700
x-xss-protection: 0
server: cafe
etag: 14378044041589781240
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:33:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 069F 3 KB
1 KB 25ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:11:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:11:40 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 069F 120 KB
37 KB 32ms
32ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eefb74cc5ac64da8206bbf5f929ee9c260d7d6162ec2a799e1fdb6190429bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634750403498492"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame 069F 14 KB
6 KB 25ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:30:36 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 069F 0
0 31ms
30ms Image
text/html 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQi4BBQhNJ44O2UW4ZOw_bswZ9ZIzSgD-PSQ_CoX7hDYIb-16tSY9McEfXp29sp5d5MCQwQyC05sLuVBprCeqAJuBt8nQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.74.196 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s02-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 css
fonts.googleapis.com/ Frame ECB2 14 KB
962 B 31ms
31ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f35107cfb030849f5f6c9429f659eb4cfe3e8d56cb94e61c8f89b7861c270b50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:41:06 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame ECB2 14 KB
962 B 30ms
30ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&text=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f35107cfb030849f5f6c9429f659eb4cfe3e8d56cb94e61c8f89b7861c270b50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:41:06 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame ECB2 32 KB
13 KB 24ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/m_js_controller_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b4550ac1f8a3f589276d0a1a9dddafa7ab37606a2dc52ed59580e776071cbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 00:58:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 12922
x-xss-protection: 0
server: cafe
etag: 10609840481343520096
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 00:58:23 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame ECB2 18 KB
8 KB 24ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 438
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7700
x-xss-protection: 0
server: cafe
etag: 14378044041589781240
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:33:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame ECB2 3 KB
1 KB 30ms
28ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:11:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:11:40 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ECB2 120 KB
37 KB 30ms
29ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eefb74cc5ac64da8206bbf5f929ee9c260d7d6162ec2a799e1fdb6190429bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634750403498492"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame ECB2 14 KB
6 KB 24ms
24ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:30:36 GMT

GET
H3 200 wlp_gwjKBV1pqhv43IE.woff2
fonts.gstatic.com/s/cardo/v14/ Frame 136F 15 KB
15 KB 54ms
24ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v14/wlp_gwjKBV1pqhv43IE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,700%7CCardo:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek,latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

642d97daf5734304f14a112f401f96397bdd3ff2a828903bc251135ff18e83bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 06:37:02 GMT
x-content-type-options: nosniff
age: 417844
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14864
x-xss-protection: 0
last-modified: Wed, 24 Mar 2021 17:50:49 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 06:37:02 GMT

GET
H3 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame 136F 20 KB
20 KB 49ms
21ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 20 Oct 2021 01:25:05 GMT
x-content-type-options: nosniff
age: 522961
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 20040
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:44 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Oct 2022 01:25:05 GMT

GET
H3 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ Frame 136F 19 KB
19 KB 34ms
34ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v18/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 04:48:55 GMT
x-content-type-options: nosniff
age: 424331
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19844
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 04:48:55 GMT

GET
H3 200 wlpygwjKBV1pqhND-ZQW-WM.woff2
fonts.gstatic.com/s/cardo/v14/ Frame 136F 18 KB
18 KB 50ms
50ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v14/wlpygwjKBV1pqhND-ZQW-WM.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22e7b2a56dd73327ffe57558d0301478738d495a64942f0f91fc18b4de463207

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 01:02:56 GMT
x-content-type-options: nosniff
age: 437890
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18872
x-xss-protection: 0
last-modified: Wed, 24 Mar 2021 17:59:01 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 01:02:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame A1E2 14 KB
962 B 33ms
33ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f35107cfb030849f5f6c9429f659eb4cfe3e8d56cb94e61c8f89b7861c270b50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:41:06 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame A1E2 14 KB
962 B 39ms
39ms Stylesheet
text/css 142.250.185.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&text=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f35107cfb030849f5f6c9429f659eb4cfe3e8d56cb94e61c8f89b7861c270b50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 02:41:06 GMT
server: ESF
date: Tue, 26 Oct 2021 02:41:06 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame A1E2 32 KB
13 KB 23ms
22ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/m_js_controller_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2b4550ac1f8a3f589276d0a1a9dddafa7ab37606a2dc52ed59580e776071cbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 00:58:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 12922
x-xss-protection: 0
server: cafe
etag: 10609840481343520096
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 00:58:23 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/ Frame A1E2 18 KB
8 KB 24ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64f935ff5fca279f250a216623f16404cabd9fb67ed5659f0ac089990652e159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 438
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7700
x-xss-protection: 0
server: cafe
etag: 14378044041589781240
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:33:48 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame A1E2 3 KB
1 KB 23ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bb775e23934c5478dab7517dbf8a614834c96e926c4498b734399eb8a2e640d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:11:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
server: cafe
etag: 18061233391346882222
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:11:40 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A1E2 120 KB
36 KB 32ms
32ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eefb74cc5ac64da8206bbf5f929ee9c260d7d6162ec2a799e1fdb6190429bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 37344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1634750403498492"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/ Frame A1E2 14 KB
6 KB 24ms
23ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211020/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2698e1ed89c87280fe92182e5297140eda834b052703156646719cd5e90fc29a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:30:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6286
x-xss-protection: 0
server: cafe
etag: 17196531676875957370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Nov 2021 02:30:36 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 639D 35 B
462 B 33ms
13ms Image
image/gif 91.228.74.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAVul-S3ljj2P6IxEh2y_m4&google_cver=1&google_push=AYg5qPJoUwQTaBLBB7ByWxYp6N-58TCGnxhcdKzVSCMI2DXE1l_QPgYr7F4MxvX2RUvHymwqbOLC2TGJLbS96mNy448mopm5QXEK

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.133 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 639D
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKqaPeh...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKqaPeh...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA4ODQzNDI4ODE2NQ%3D%3D&google_push=AYg5qPKqaPehE1DSzgLlU3W6bvIDfl3F5FnpTRSEbbbeoJxSTEaYAdMo29qics96ru5lCg...

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA4ODQzNDI4ODE2NQ%3D%3D&google_push=AYg5qPKqaPehE1DSzgLlU3W6bvIDfl3F5FnpTRSEbbbeoJxSTEaYAdMo29qics96ru5lCgV0upjJahBf0HBp-hXihDR2l6-SVNne

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA4ODQzNDI4ODE2NQ%3D%3D&google_push=AYg5qPKqaPehE1DSzgLlU3W6bvIDfl3F5FnpTRSEbbbeoJxSTEaYAdMo29qics96ru5lCgV0upjJahBf0HBp-hXihDR2l6-SVNne
pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 639D
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEG73tk2U1YKJggq2yMFRvXw&google_cver=1&google_push=AYg5qPK52vSRa_-4EwSox8Kb1gcMpc8aErvjwueV4uRrCkVLZSUB_xohTRzjmPFgSW8eX_PX4f_qM0PgvxXRz697DEUk_d_2qOnJ
https://rtb.openx.net/sync/dds?google_gid=CAESEG73tk2U1YKJggq2yMFRvXw&google_cver=1&google_push=AYg5qPK52vSRa_-4EwSox8Kb1gcMpc8aErvjwueV4uRrCkVLZSUB_xohTRzjmPFgSW8eX_PX4f_qM0PgvxXRz697DEUk_d_2qOnJ&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPK52vSRa_-4EwSox8Kb1gcMpc8aErvjwueV4uRrCkVLZSUB_xohTRzjmPFgSW8eX_PX4f_qM0PgvxXRz697DEUk_d_2qOnJ&google_hm=uQEOmUVfz_cJVDhRsvXqew==

170 B
188 B

26ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPK52vSRa_-4EwSox8Kb1gcMpc8aErvjwueV4uRrCkVLZSUB_xohTRzjmPFgSW8eX_PX4f_qM0PgvxXRz697DEUk_d_2qOnJ&google_hm=uQEOmUVfz_cJVDhRsvXqew==

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPK52vSRa_-4EwSox8Kb1gcMpc8aErvjwueV4uRrCkVLZSUB_xohTRzjmPFgSW8eX_PX4f_qM0PgvxXRz697DEUk_d_2qOnJ&google_hm=uQEOmUVfz_cJVDhRsvXqew==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: j3bacmf6pf5u7epkrsv65rg2cjuhuiug

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 639D
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

51ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK_uG9VaTRaplSm0helwilmcFGn2af4G123tRGimmPhPEzOMoJv7qwvhVeLcfRZ-LzBb1zu5WNbdxnRBOE6JxBjj0Im_-MR

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK_uG9VaTRaplSm0helwilmcFGn2af4G123tRGimmPhPEzOMoJv7qwvhVeLcfRZ-LzBb1zu5WNbdxnRBOE6JxBjj0Im_-MR
date: Tue, 26 Oct 2021 02:41:05 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 639D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEADaz0ralgY9ch5_azhl-Fk&google_cver=1&google_push=AYg5qPKBwSYtKGl0eyDTRWAGsnl8ErxMi5qaozEbpSyFb9mnupUbv4BS2Sf31i4bjXcO3ixhx9N...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDM1AtRC1LVUZQ&google_push=AYg5qPKBwSYtKGl0eyDTRWAGsnl8ErxMi5qaozEbpSyFb9mnupUbv4BS2Sf31i4bjXcO3ixhx9NNKx0k5mL23Ui0ow0EUsUKf3so

170 B
188 B

30ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDM1AtRC1LVUZQ&google_push=AYg5qPKBwSYtKGl0eyDTRWAGsnl8ErxMi5qaozEbpSyFb9mnupUbv4BS2Sf31i4bjXcO3ixhx9NNKx0k5mL23Ui0ow0EUsUKf3so

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDM1AtRC1LVUZQ&google_push=AYg5qPKBwSYtKGl0eyDTRWAGsnl8ErxMi5qaozEbpSyFb9mnupUbv4BS2Sf31i4bjXcO3ixhx9NNKx0k5mL23Ui0ow0EUsUKf3so
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 639D
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHDLI1d1xvDgo4HyOL41in0&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEHDLI1d1xvDgo4HyOL41in0&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPIKeiVcvtPxEA6yoj_3_zNPADXxAtgJ-GLY36oFf6hodCwt821Ob_h4OjBxAVmlO_t4yS5IGXD5NZ8N-5o0A_...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 639D 43 B
297 B 184ms
20ms Image
image/gif 18.168.50.255
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEF37IjvTVbFs90K7M6fEZzw&google_cver=1&google_push=AYg5qPJuDpoKLQybhT8hN0A0mWJRRI4r-qY0NRTxl1nEiOE06jj1XnSfINYnc8RWLo5Z5j6K-M3RRoFjFAam3SBYG6raq3avvyjS
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=455&adk=704903456&adf=1704652959&pi=t.aa~a.2885119052~rp.4&w=645&lmt=1635216065&nsk=a0f26e77&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x455&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=0&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810%2C645x753&nras=5&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=3692&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=SvuKbpRgxe&p=https%3A//knews.vip&dtd=24
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.168.50.255 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-168-50-255.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 639D 0
194 B 63ms
26ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JaSsB2mp5-OwDlAX0DFylLZPGjUt2560smIlh9Obx5X76KDqsiDusPqAUjcuU4fLYAO15s

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/15986035550154758006/ Frame 069F 156 KB
156 KB 57ms
57ms Image
image/png 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15986035550154758006/downsize_200k_v1?sqp=4sqPyQSHAUKEAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mgsw8QQ48QRFAACAPw&rs=AOga4qkPxoZ0z5uzVh1MdfC4459MZ60iQQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

582035cba658f71588a45b2d0f448671d2d51b80f7a7c172658467ff45633c28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 159640
x-xss-protection: 0
last-modified: Fri, 07 May 2021 10:03:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 26 Oct 2022 02:41:06 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 069F 0
0 47ms
47ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZEjZwWp3YaCqJMumx_APoceF0A3tqsDjZa3fk-beDeiqtpWLAxABIJ7amjFgleKQgqAHoAHYiNfdAsgBBqkCurxVvDlpDT6oAwHIA8sEqgTaAU_Q2Hs5xdNL_yUqJY4gwCmJmjDgyViWBzaS3HXR0SOmBL32JlK2iGuW9PkCdxY2rg0TZ_-4lEUEymSlik-jybK1nWMEs3jgrt_Y-1NbFN2b56h66M58WTIH3Xx-CQyLLWViuy8PxdxUCBEBzy9F1jYGUmhbcf8x8AzEr-0B2PRFDcbT_gaaRcK6ya-RJZdwWtPHO1DCE-4_2Qnde2ZVcrDysOprvE2WDyhNRyramdMu4RX8CyvF6KjNyDGaCTUIcqanODqZGZiq2-5DzzhJxVG5iFhjdVHTezKIwASmtbqhygOSBQQIBBgBkgUECAUYBKAGN4AHkPeoogGoB_DZG6gH8tkbqAeOzhuoB5PYG6gH7paxAqgH1ckbqAemvhvYBwHyBwQQtPAE0ggJCIDhgBAQARhfgAoByAsB2BMNiBQC0BUBmBYBgBcBshccChoIABIUcHViLTgwNzE5NTQ0NjAxMjI3NDEYAA&sigh=a-X42U48__E&uach_m=[UACH]&template_id=492

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 26 Oct 2021 02:41:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2E3F 143 B
163 B 28ms
28ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=753&adk=1305086994&adf=4156546283&pi=t.aa~a.2831683308~rp.4&w=645&lmt=1635216065&nsk=5e6255&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x753&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486%2C645x810&nras=4&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=2374&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=4GCc6DXDCJ&p=https%3A//knews.vip&dtd=21

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 26 Oct 2021 01:43:06 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3480
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6899 1 KB
749 B 25ms
25ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 08:58:57 GMT
expires: Tue, 26 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 63729
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
DATA 200
OK truncated
/ Frame 069F 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75a2cb7177c13c8b9f72c05ebbaa02e907327f7930418c46be55ad2b51783bb6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 069F 16 KB
16 KB 21ms
20ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500|Source+Sans+Pro:300,400&lang=ko

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 24 Oct 2021 11:16:30 GMT
x-content-type-options: nosniff
age: 141876
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 24 Oct 2022 11:16:30 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 069F 16 KB
16 KB 20ms
20ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500|Source+Sans+Pro:300,400&lang=ko

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 02:46:35 GMT
x-content-type-options: nosniff
age: 345271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 02:46:35 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BDA6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

50ms
50ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 26-Oct-2021 03:41:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js Show response
pagead2.googlesyndication.com/bg/ Frame F734 35 KB
13 KB 24ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13325
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 25 Oct 2022 16:43:49 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13331785150068217634/ Frame ECB2 29 KB
29 KB 76ms
75ms Image
image/jpeg 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13331785150068217634/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI8QQQxwIYASABLQAAAD8w8QQ4xwJFAACAPw&rs=AOga4qkDwXmkcwuTqStQe0IS5odlVzdteQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0528274a42aaac9083956287659c9e70692a7eff3f0f14af619646667aac57f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29671
x-xss-protection: 0
last-modified: Mon, 18 Jan 2021 10:04:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 26 Oct 2022 02:41:06 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame ECB2 0
0 43ms
43ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CjfxMwWp3YdWCJNHigAf9pIigCfDH9JFgxe-Pi_sMt8uivcABEAEgntqaMWCV4pCCoAegAc6-kuUDyAEGqQJpPRyNenuzPqgDAcgDywSqBOoBT9CvZ2ZLt9mo3umdDOwXejEXc5lux9ziDmP9Khrzk-rfdk8iyS758AGF4mLPuG2-8SEhEeiE9r0ad-yMoCFGAEn7RbA8UhwC54pefy0DAaHsaeO8G-A-_2QpLWthQlBY0jXfU9asL8BmuNYr_wQuHcPYdLl1ON1eF1v2IZ2mbGqnVhaDmv3lgQUHoiezL8cNh0gwbyOEDeyJq8_urDyFXbzUXEgLwbj415iuofWyrcLO3ugb2D90Cge-D-MbpP8jUafTADtv55YEe1zGzMVo4QTMcInBa6seKvQpYnROuHYw3_W5RuHJ0JHtwATF37zDpAOSBQQIBBgBkgUECAUYBKAGN4AHmsHtGqgH8NkbqAfy2RuoB47OG6gHk9gbqAfulrECqAfVyRuoB6a-G9gHAfIHBBDw-RLSCAkIgOGAEBABGF-ACgHICwHYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItODA3MTk1NDQ2MDEyMjc0MRgA&sigh=KUgYR-Z7LUw&uach_m=[UACH]&template_id=492

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 26 Oct 2021 02:41:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5FC7 143 B
163 B 26ms
26ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 26 Oct 2021 01:43:06 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3480
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C230 1 KB
749 B 23ms
23ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 08:58:57 GMT
expires: Tue, 26 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 63729
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
DATA 200
OK truncated
/ Frame ECB2 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 15f1aa355342435f453c0580ba4126c1a34c34a7304a4a47d1eb05e893ae6ffd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame ECB2 15 KB
15 KB 21ms
21ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 04:16:28 GMT
x-content-type-options: nosniff
age: 339878
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15764
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 04:16:28 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame ECB2 16 KB
16 KB 20ms
20ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 24 Oct 2021 11:16:30 GMT
x-content-type-options: nosniff
age: 141876
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 24 Oct 2022 11:16:30 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame ECB2 16 KB
16 KB 21ms
20ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 02:46:35 GMT
x-content-type-options: nosniff
age: 345271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 02:46:35 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13604693895970062560/ Frame A1E2 74 KB
74 KB 141ms
141ms Image
image/jpeg 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13604693895970062560/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI8QQQ8QQYASABLQAAAD8w8QQ48QRFAACAPw&rs=AOga4qkzz7LUXO7UHZ8dcydpEsv5zjcJtQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5afdfc6128677a36233a4dc89d11d20c34a384e95e1c304d67a411201737ca11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 76105
x-xss-protection: 0
last-modified: Fri, 14 May 2021 06:08:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 26 Oct 2022 02:41:06 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A1E2 0
0 43ms
43ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CMCFfwWp3Yc2hJM6ngQf9jI24CcKlyZtinIXMr4oNwI23ARABIJ7amjFgleKQgqAHoAG-lqPjA8gBBqkCaT0cjXp7sz6oAwHIA8sEqgTtAU_QNtF51DNwwfnaKe_D9ovnT10RIjeP_8HH-BLucxbjCa9HihIJqEB8CNZLp82Y9PuKxdmqnR7-tqbI1yEDkSxZkMV_GmVYash96-VVLdgfPJbMQvKmLN7SoKB2xeuD1Zg9gAq47kINi390N_DhEha7D8cf_uW9rFPq_2TkA2YaFGb2d6dGG0fU56_QXbt8iLGGQO0ws7FJ_95N_ZZq8X0fEzaWiaoPw6DGjVcjiSCbGJzORCTWTVoj1lSnhPlN7ff2LcoHnF0bqVMY8S2GBGh-JdTDEE_esDLYbr91KkARIRiG_gX61Z_EIQQVaMAEyuPR588CkgUECAQYAZIFBAgFGASgBjeAB6rp3ByoB_DZG6gH8tkbqAeOzhuoB5PYG6gH7paxAqgH1ckbqAemvhvYBwHyBwQQjt4E0ggJCIDhgBAQARhfgAoByAsB2BMNiBQE0BUBgBcBshccChoIABIUcHViLTgwNzE5NTQ0NjAxMjI3NDEYAA&sigh=bJjK2xbQTuc&uach_m=[UACH]&template_id=492

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 26 Oct 2021 02:41:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9BAD 143 B
163 B 26ms
26ms Document
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 26 Oct 2021 01:43:06 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3480
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5CF5 1 KB
749 B 23ms
23ms Document
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 25 Oct 2021 08:58:57 GMT
expires: Tue, 26 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 63729
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame A1E2 15 KB
15 KB 21ms
20ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 04:16:28 GMT
x-content-type-options: nosniff
age: 339878
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15764
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 04:16:28 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame A1E2 16 KB
16 KB 22ms
21ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 24 Oct 2021 11:16:30 GMT
x-content-type-options: nosniff
age: 141876
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 24 Oct 2022 11:16:30 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame A1E2 16 KB
16 KB 24ms
23ms Font
font/woff2 142.250.186.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Source+Sans+Pro:300,400,700&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 02:46:35 GMT
x-content-type-options: nosniff
age: 345271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 02:46:35 GMT

GET
DATA 200
OK truncated
/ Frame A1E2 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: deec48ce5215ee4ba2b44b12b9f356cd26ea1793a6fe71bb1bcf6fff55435d90

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJfahcUBCY2DaOQbMiTJ5T_s2Ssl4s6wbULGuFCBEtFz3-2izaAxj85MyIoq8ocA9Rs23dWTsfaM33dmk_LMJSv3dBZvzjA&google_gid=CAESEMppVSlTVOIWCadB0rM9NWM&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCMLV3YsGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBKZmFoY1VCQ1kyRGFPUWJNaVRKNVRfczJTc2w0czZ3YlVMR3VGQ0JFdEZ6My0yaXphQXhqODVNeUlvcThvY0E5UnMyM2RXVHNmYU0zM2Rta1...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwdHVRajJPRHZhSVUyMldfdHVidTVyejJ6MHJ6SEQ4dU9TblZGbWd1RDlmbw==&google_push

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwdHVRajJPRHZhSVUyMldfdHVidTVyejJ6MHJ6SEQ4dU9TblZGbWd1RDlmbw==&google_push

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 26 Oct 2021 02:41:06 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwdHVRajJPRHZhSVUyMldfdHVidTVyejJ6MHJ6SEQ4dU9TblZGbWd1RDlmbw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJ_CMuN...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA2MzQyNjI2Nzk2Nw%3D%3D&google_push=AYg5qPJ_CMuN3P0Er_E0rMV3YuRJmgAI3i2EiMxGzbHk0z-ACBjgvftZrgK_3mNwiHa64J...

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA2MzQyNjI2Nzk2Nw%3D%3D&google_push=AYg5qPJ_CMuN3P0Er_E0rMV3YuRJmgAI3i2EiMxGzbHk0z-ACBjgvftZrgK_3mNwiHa64JBm9TK3QQme4F0qTb5Tte5NR-iLj7_zCQ

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA2MzQyNjI2Nzk2Nw%3D%3D&google_push=AYg5qPJ_CMuN3P0Er_E0rMV3YuRJmgAI3i2EiMxGzbHk0z-ACBjgvftZrgK_3mNwiHa64JBm9TK3QQme4F0qTb5Tte5NR-iLj7_zCQ
pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEISY4yMmVINO2dYepiXwpM0&google_cver=1&google_push=AYg5qPIp2zV-Ai4M9_u1fgBBY72xcP9KSDsGurcW50pa1Q4cxdAZCCZV5dTdjzUOlmibnPUm7JRA7qkvkLxODDqwMLL1mjwdb7lW
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIp2zV-Ai4M9_u1fgBBY72xcP9KSDsGurcW50pa1Q4cxdAZCCZV5dTdjzUOlmibnPUm7JRA7qkvkLxODDqwMLL1mjwdb7lW&google_hm=uQEOmUVfz_cJVDhRsvXqew==

170 B
188 B

29ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIp2zV-Ai4M9_u1fgBBY72xcP9KSDsGurcW50pa1Q4cxdAZCCZV5dTdjzUOlmibnPUm7JRA7qkvkLxODDqwMLL1mjwdb7lW&google_hm=uQEOmUVfz_cJVDhRsvXqew==

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:05 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIp2zV-Ai4M9_u1fgBBY72xcP9KSDsGurcW50pa1Q4cxdAZCCZV5dTdjzUOlmibnPUm7JRA7qkvkLxODDqwMLL1mjwdb7lW&google_hm=uQEOmUVfz_cJVDhRsvXqew==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: c8ec9l5fpf970nabma4vb4fegvv96gkh

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

29ms
28ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLXs1OsYwDiAIBCTfbIg08z7WJzjWsmPF4z5jq4kxibmF8hpupZ9_4TtChmZ8qkglD7x4ZpoybkSHPp1Gj4iNhlW7sq-T7B

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLXs1OsYwDiAIBCTfbIg08z7WJzjWsmPF4z5jq4kxibmF8hpupZ9_4TtChmZ8qkglD7x4ZpoybkSHPp1Gj4iNhlW7sq-T7B
date: Tue, 26 Oct 2021 02:41:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEELhNZrZMBahrANZSes70i4&google_cver=1&google_push=AYg5qPJfcthPloyQy7JAXtRCEOuySWfs69Vp27Gm1jbvXxsLSINHCV_ux3QCApuMliPlpT0Bn4l...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDNlgtNy02RDYz&google_push=AYg5qPJfcthPloyQy7JAXtRCEOuySWfs69Vp27Gm1jbvXxsLSINHCV_ux3QCApuMliPlpT0Bn4lRpbJI4Z_YCCtZNNHGUBLegT2zYA

170 B
188 B

29ms
28ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDNlgtNy02RDYz&google_push=AYg5qPJfcthPloyQy7JAXtRCEOuySWfs69Vp27Gm1jbvXxsLSINHCV_ux3QCApuMliPlpT0Bn4lRpbJI4Z_YCCtZNNHGUBLegT2zYA

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDNlgtNy02RDYz&google_push=AYg5qPJfcthPloyQy7JAXtRCEOuySWfs69Vp27Gm1jbvXxsLSINHCV_ux3QCApuMliPlpT0Bn4lRpbJI4Z_YCCtZNNHGUBLegT2zYA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHavIDuR_bknmdxHj2cwd6c&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_push=AYg5qPLfVzkYCTROaOITOXa96ZdLBfQc3Nnbku2kzMEDWPEzlwNlvIzbdU9o6ev_g-0xXVN2j7Zq8AZDJDmuVcTszt...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6899
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEK6pc5ptHpeuGdL1gm_p78E&google_cver=1&google_push=AYg5qPLQ9_Q9R6oTVXbk1Qat...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLQ9_Q9R6oTVXbk1QatoZzg24GI0gscRw_W0nQWnFXbG6GsJKV2zV-0Nm144j-g-inF1HIWCvn0tqaboN5VXXL8aPUeQumcdg&google_hm=

170 B
188 B

28ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLQ9_Q9R6oTVXbk1QatoZzg24GI0gscRw_W0nQWnFXbG6GsJKV2zV-0Nm144j-g-inF1HIWCvn0tqaboN5VXXL8aPUeQumcdg&google_hm=

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLQ9_Q9R6oTVXbk1QatoZzg24GI0gscRw_W0nQWnFXbG6GsJKV2zV-0Nm144j-g-inF1HIWCvn0tqaboN5VXXL8aPUeQumcdg&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Mon, 25 Oct 2021 02:41:06 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6899 0
12 B 24ms
24ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JXdGS3ofrL8CqeZnTxomQbDTG7APWBCHVD34-P5pJ0tCFkscX9nfcAFcaTl9Kk8pkPP_govA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C230
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMV1apWd56gfFkZ_8R5OpoQ&google_cver=1&google_push=AYg5qPL-wnBjR8r_NmZP-mPsrLgYtUnW4UAf-n5TUPdmZcf6wfFnrcr8iv...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL-wnBjR8r_NmZP-mPsrLgYtUnW4UAf-n5TUPdmZcf6wfFnrcr8iv6kLMBVyQURHBrF_gx_XZOJALjRafvAwi09ekacyD36vw&google_hm=WICi...

170 B
188 B

28ms
28ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL-wnBjR8r_NmZP-mPsrLgYtUnW4UAf-n5TUPdmZcf6wfFnrcr8iv6kLMBVyQURHBrF_gx_XZOJALjRafvAwi09ekacyD36vw&google_hm=WICigTqGdYr8T_SXxx0E2A

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL-wnBjR8r_NmZP-mPsrLgYtUnW4UAf-n5TUPdmZcf6wfFnrcr8iv6kLMBVyQURHBrF_gx_XZOJALjRafvAwi09ekacyD36vw&google_hm=WICigTqGdYr8T_SXxx0E2A
pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C230
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKMlq2oMZpYz3lEX69w8bIoBvc25dRuQsjeM84...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVhkcXdnQUFBTWNKNkZFNw&google_push=AYg5qPKMlq2oMZpYz3lEX69w8bIoBvc25dRuQsjeM84ZKDyvTURpAm073Cr4Bw2b5OWeVIWB9TULP4rfp1nO4MUE85COjEhIlN...

170 B
188 B

28ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVhkcXdnQUFBTWNKNkZFNw&google_push=AYg5qPKMlq2oMZpYz3lEX69w8bIoBvc25dRuQsjeM84ZKDyvTURpAm073Cr4Bw2b5OWeVIWB9TULP4rfp1nO4MUE85COjEhIlN_d-A

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVhkcXdnQUFBTWNKNkZFNw&google_push=AYg5qPKMlq2oMZpYz3lEX69w8bIoBvc25dRuQsjeM84ZKDyvTURpAm073Cr4Bw2b5OWeVIWB9TULP4rfp1nO4MUE85COjEhIlN_d-A
Date: Tue, 26 Oct 2021 02:41:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 466606.gif
id.rlcdn.com/ Frame C230 42 B
188 B 63ms
29ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPKjUvTYNrxibA1AicjjH-nQ7pDpCTsjhsGy2OnEixe5xs1JRJ5_-OtWhZuZxX7AwH3ZIZ51AQxTHfc6iJxZR1GpwNPSvwFZPA&google_gid=CAESECAPJhADd5S3DsSV96RcrHQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=486&adk=4257108277&adf=4197682584&pi=t.aa~a.2831682293~rp.4&w=645&lmt=1635216065&nsk=5be26d9b&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x486&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0&nras=2&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=150&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=9BOXptBgVw&p=https%3A//knews.vip&dtd=14
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 26 Oct 2021 02:41:06 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C230
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEKHLkQiTyk6ERlSqbJke-18&google_cver=1&google_push=AYg5qPKKELhC_crP0vWZCyZ6FHhiivzAj7L6dhZrYhwlWQgnB9EPFP_IvM6zyZUoCYstIui0ghYFpqxIYICcx5A7jNnkN6fPoqhe
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKKELhC_crP0vWZCyZ6FHhiivzAj7L6dhZrYhwlWQgnB9EPFP_IvM6zyZUoCYstIui0ghYFpqxIYICcx5A7jNnkN6fPoqhe&google_hm=uQEOmUVfz_cJVDhRsvXqew==

170 B
188 B

26ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKKELhC_crP0vWZCyZ6FHhiivzAj7L6dhZrYhwlWQgnB9EPFP_IvM6zyZUoCYstIui0ghYFpqxIYICcx5A7jNnkN6fPoqhe&google_hm=uQEOmUVfz_cJVDhRsvXqew==

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKKELhC_crP0vWZCyZ6FHhiivzAj7L6dhZrYhwlWQgnB9EPFP_IvM6zyZUoCYstIui0ghYFpqxIYICcx5A7jNnkN6fPoqhe&google_hm=uQEOmUVfz_cJVDhRsvXqew==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: ja949dv7fv8br1ka0ie3sufv7urf5ju4

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C230
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJz8uOXaMgpdOVFiCVi1x4-rlQ2eZim9BOKdEkhV-_yjyH08k1zflggqCTgsW-q4HXExsvNzY0GJAl4bd_9f96VAvYUfzaVZw

Requested by

Host: knews.vip
URL: https://knews.vip/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJz8uOXaMgpdOVFiCVi1x4-rlQ2eZim9BOKdEkhV-_yjyH08k1zflggqCTgsW-q4HXExsvNzY0GJAl4bd_9f96VAvYUfzaVZw
date: Tue, 26 Oct 2021 02:41:05 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C230
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEIRpUHJzc5IwBsD52SbOjPk&google_cver=1&google_push=AYg5qPKw2-k5dF0262yEvmbQ_Cf67QkFkOVfNFahTvQAiHERC9RFSibMTn8SotcmU6Z4A-ZNYqM...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDOUwtMjQtTDRYRw==&google_push=AYg5qPKw2-k5dF0262yEvmbQ_Cf67QkFkOVfNFahTvQAiHERC9RFSibMTn8SotcmU6Z4A-ZNYqMiIxiLSlHtuQJzvUO79_GQreQi

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDOUwtMjQtTDRYRw==&google_push=AYg5qPKw2-k5dF0262yEvmbQ_Cf67QkFkOVfNFahTvQAiHERC9RFSibMTn8SotcmU6Z4A-ZNYqMiIxiLSlHtuQJzvUO79_GQreQi

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDOUwtMjQtTDRYRw==&google_push=AYg5qPKw2-k5dF0262yEvmbQ_Cf67QkFkOVfNFahTvQAiHERC9RFSibMTn8SotcmU6Z4A-ZNYqMiIxiLSlHtuQJzvUO79_GQreQi
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame C230
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_gid=CAESEHWwKCKWRYDW7lzQddJAz5M&google_push=AYg5qPI8MQpJmSqg_rB0r8BNEJSmTp-1q-BDJ...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C230 0
12 B 24ms
24ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IVWQT77fPJLa4FuSPnKmB4hWLyYLh--Y2ZLyUu5djzcZoRszP7RY8ep8kS1HtNsWWLY0TN

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2E3F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

49ms
49ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 26-Oct-2021 03:41:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js Show response
pagead2.googlesyndication.com/bg/ Frame F54B 35 KB
13 KB 23ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13325
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 25 Oct 2022 16:43:49 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5FC7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

51ms
51ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 26-Oct-2021 03:41:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js Show response
pagead2.googlesyndication.com/bg/ Frame BB02 35 KB
13 KB 23ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13325
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 25 Oct 2022 16:43:49 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 5CF5 35 B
210 B 9ms
8ms Image
image/gif 91.228.74.133
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEHstEVl22b6vB9N3Vtc2W3U&google_cver=1&google_push=AYg5qPJn0tvxmKwlO_G9xTpK5mr0xO3NzzUA7INW_6u55XK4TIxF2DXR1ap5ZG_Ijx4fKD6ENiwUl-3YAsLVoNtmqu9LgE4NLJA

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.133 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CF5
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJnbqXG...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA3Njc4MjczNDAxNA%3D%3D&google_push=AYg5qPJnbqXGTZqY_meqUMvYlQNLns4hjIAJj3eqU0jPLczxmTG9rJNaQBI8ei6WI-y1YH...

170 B
188 B

29ms
28ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA3Njc4MjczNDAxNA%3D%3D&google_push=AYg5qPJnbqXGTZqY_meqUMvYlQNLns4hjIAJj3eqU0jPLczxmTG9rJNaQBI8ei6WI-y1YHr0R1IB3UODWd0-7jC1UHp5mi7Oll6o

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEwMjYwMjQxMDYwMDA3Njc4MjczNDAxNA%3D%3D&google_push=AYg5qPJnbqXGTZqY_meqUMvYlQNLns4hjIAJj3eqU0jPLczxmTG9rJNaQBI8ei6WI-y1YHr0R1IB3UODWd0-7jC1UHp5mi7Oll6o
pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 5CF5 43 B
608 B 53ms
22ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEIF-Ek6tHYpGX3Ol3Ah2c90&google_push=AYg5qPKYRg5yPy0H02Dl5V8ivPe5ekjy67q_N0Mbx2I7Z3KJ1GjFuQoGsPphw8XqjS3mnefACF0PvZoM34TkLR9fnhEJ919iueWn&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8071954460122741&output=html&h=810&adk=672092169&adf=3386289904&pi=t.aa~a.2885118021~rp.4&w=645&lmt=1635216065&nsk=9b297bdb&rafmt=11&pwprc=7429562901&psa=0&ad_type=text_image&format=645x810&url=https%3A%2F%2Fknews.vip%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1635216065548&bpp=1&bdt=811&idt=-M&shv=r20211020&mjsv=m202110200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D6b0d64ee76fa613a-22198b6a00cb00bd%3AT%3D1635216065%3ART%3D1635216065%3AS%3DALNI_Mb3Ajqr1ctF9khmoIb14aYwLnpOAg&prev_fmts=0x0%2C645x486&nras=3&correlator=1867538364568&frm=20&pv=1&ga_vid=1442706505.1635216065&ga_sid=1635216065&ga_hid=2098582901&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=805&ady=2249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062938%2C31062944&oid=2&pvsid=3749086392360909&pem=501&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=M5GewNEvyp&p=https%3A//knews.vip&dtd=18
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CF5
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEK75sixJqkFNLV1mAeAmCHs&google_cver=1&google_push=AYg5qPJpu_pNxxuMKvZOmNmj8150i0uKTtnz9tBSbAKe9aDzexuvJhhWmCEUpV6h-0tOedInTR4p-5e9P8MkGxOVdIOnCcJWRRTJ
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJpu_pNxxuMKvZOmNmj8150i0uKTtnz9tBSbAKe9aDzexuvJhhWmCEUpV6h-0tOedInTR4p-5e9P8MkGxOVdIOnCcJWRRTJ&google_hm=uQEOmUVfz_cJVDhRsvXqew==

170 B
188 B

27ms
27ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJpu_pNxxuMKvZOmNmj8150i0uKTtnz9tBSbAKe9aDzexuvJhhWmCEUpV6h-0tOedInTR4p-5e9P8MkGxOVdIOnCcJWRRTJ&google_hm=uQEOmUVfz_cJVDhRsvXqew==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:05 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJpu_pNxxuMKvZOmNmj8150i0uKTtnz9tBSbAKe9aDzexuvJhhWmCEUpV6h-0tOedInTR4p-5e9P8MkGxOVdIOnCcJWRRTJ&google_hm=uQEOmUVfz_cJVDhRsvXqew==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 2qv396v2uhal9k1oqi0a21u616hbn7sm

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CF5
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

30ms
29ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPL__yUU9UCzxT2CyrjKEteSDeCEdhBF1OImN-mJBgT7WRFnen-JtQq8UfSpJKBZEegu7S7VB87vvGViF6uA_s1h96PL7-4x

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=99UOmzvpR7mUsm7YYKPxig%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPL__yUU9UCzxT2CyrjKEteSDeCEdhBF1OImN-mJBgT7WRFnen-JtQq8UfSpJKBZEegu7S7VB87vvGViF6uA_s1h96PL7-4x
date: Tue, 26 Oct 2021 02:41:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5CF5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAbWtOW1B7qcSuIxiQMU4vg&google_cver=1&google_push=AYg5qPKmUwvj-WYN5s56Dw8uSZRtlb1SJcHzWSNpKqdoSmvPOdu-ueNSqt52u-fb_IkJdkfJ07L...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDQjItWi1CR1U5&google_push=AYg5qPKmUwvj-WYN5s56Dw8uSZRtlb1SJcHzWSNpKqdoSmvPOdu-ueNSqt52u-fb_IkJdkfJ07LA7vZwc3YlQvywWaOAXbDIXjk

170 B
188 B

27ms
26ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDQjItWi1CR1U5&google_push=AYg5qPKmUwvj-WYN5s56Dw8uSZRtlb1SJcHzWSNpKqdoSmvPOdu-ueNSqt52u-fb_IkJdkfJ07LA7vZwc3YlQvywWaOAXbDIXjk

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1Y3SEZDQjItWi1CR1U5&google_push=AYg5qPKmUwvj-WYN5s56Dw8uSZRtlb1SJcHzWSNpKqdoSmvPOdu-ueNSqt52u-fb_IkJdkfJ07LA7vZwc3YlQvywWaOAXbDIXjk
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 19ea072139d67f7022c6e463249c998e
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 5CF5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHAY0BxfNoNxObj9lVKc1H8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YXdqwkPeBth_ThInNot4UwAABI4AAAAB&google_cver=1&google_push=AYg5qPKIpCUtOPuUMDv2vozd2zNM0tDVzMHjZY8CJiq-j7lfx3jHFhd5Y9TknCHSHA-7U8VF6NjG...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5CF5 0
12 B 27ms
26ms Image
text/html 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JOT9XkJxoeKcm9JUHH4KE1sg3Z4Q8K560s6RdrQEHsIy9tOpv3ZRYDh7nJ7Mn6HDUOQTL8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9BAD
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

59ms
59ms

Document
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si?st=NO_DATA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUmt1pqF-nHVSn9hDxI5HYOGQJeCzAQyM4ezZsJG954Llqvszsssqf7XZq7j2Cs; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Tue, 26-Oct-2021 03:41:06 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
expires: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 26 Oct 2021 02:41:06 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 69ms
36ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211020&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecb942cc7282a320b26605238a3153554a2c7be61b62f30c743849311189931e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 8453
x-xss-protection: 0

GET
H3 200 Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js Show response
pagead2.googlesyndication.com/bg/ Frame D811 35 KB
13 KB 24ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13325
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 25 Oct 2022 16:43:49 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 49ms
49ms Script
text/javascript 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 26 Oct 2021 02:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 26 Oct 2021 02:41:06 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 78DD 12 KB
5 KB 23ms
23ms Document
text/html 142.250.184.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Mon, 25 Oct 2021 17:55:00 GMT
expires: Tue, 25 Oct 2022 17:55:00 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 31566
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame DDF5 783 B
536 B 32ms
32ms Document
text/html 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f4.1e100.net

Software

GSE /

Resource Hash

0348ab6aa2cb9e9c9a89855acd1f334fce5bb3050eddf0672f2dd78a0e466485

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-J1hUXmrxlT3XYG0J4AUzDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 26 Oct 2021 02:41:06 GMT
date: Tue, 26 Oct 2021 02:41:06 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-J1hUXmrxlT3XYG0J4AUzDA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H3 200 Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js Show response
pagead2.googlesyndication.com/bg/ Frame 78DD 35 KB
13 KB 23ms
23ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Zz7DT35LXmuokobBJJC8eUu-TFeGwi-w65YEXeY0QRI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

673ec34f7e4b5e6ba89286c12490bc794bbe4c5786c22fb0eb96045de6344112

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 16:43:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35837
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13325
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 25 Oct 2022 16:43:49 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame DDF5 0
0 47ms
47ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211020&jk=3749086392360909&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6A16 42 B
64 B 32ms
32ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstO4-5vHsHXkYzFzhZBjzPZ-ZNKxi9z0skBp9EFwX519H47Pmo2AZuE01mZw1vsbP_Y2JGT3pI1rQjg60ALKB_Q&sig=Cg0ArKJSzBwYr4-UylGMEAE&id=lidar2&mcvt=1007&p=0,0,124,1005&mtos=133,752,1007,1153,1230&tos=133,619,255,146,77&v=20211020&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1635216065606&rpt=204&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Oct 2021 02:41:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 136F 0
99 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://csm.eu.criteo.net/all?cppv=3&cpp=ynToieV4euu7QM8OuwXPIqWMpZ-XYtH8RcGHqGydQ1cEJIm6NKmb8RYHcRrb1XUsKGvA4GoL8rkWeXdLrDZ0htgrVtLp3sBfIYVXHQgIUHPL6POS8I1CSPotSmdY-Db4aWD8THXyuoPOu62diWqrnr8r6FLbiC7p2ISiZL1z-o-EZgto91KiaFXLvQmPt5CnaY9ggGMTkaGxX33vMps9LFxQf0ebVYwV4zeTyslIDdm2456AI6PSSjMpWczlQqEi1an8sQ&sds=2&rev=79260&sendBeacon=true
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YXdqwQACLsIIEdscAAW1XahQ3OCrD48934G0Fw&u=%7C4D79O6qxKuPK5cjmUQ7wWal8WsGkciVMTK%2F92LCXjZQ%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ6ciC3rnAoG72_3BFDfZ8qj0n6FwJ08Cvv5nzGVva1W-zUAePSJrzYf0UPD4OsnAPYWY7vQTI9r4Aca-0R1zpnUXz1Jc-tICneLuj1MppELADhGd3fFCABJ7oFZ1vW3OJpvuWuCSNWBvILKDO4-NWEdVwWQhZUGOKIXpuu2xrlV-SiLJ-TWHsbvd-Lm6CgOEoibMOfWFyuOtSOqzS9MBgQ8qkjto1RFm70YKdDkWpD2VrJvO-egdxtRNBiZdZwVh_ZiZyOUJIx138j69llNlDACheEetm34Edt-MoXkACuPZCqhpw1YLRf409Eb3VdCcr52HqQTy-6q9P2UimSab8S6kZNZYYMQgqu9JbXcdZXtJXbOwN5A1lNWxtjwlqzEUseXbBQLiqqH5_E2fOWT03xOgnxDzouNMs8tSB4vuzn3Ietg0n7g_J2PgzAyKcwng7m8NQiSnw1iCtfZlLbA9eZIQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIPpqwWp3YcLdCJy2x_AP3eqW6ATJntKxXPWdmPdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTgwNzE5NTQ0NjAxMjI3NDGgAdW20uoDyAEJqQL0g_3CKXmzPqgDAaoEuwFP0DhK_a-Wu6MNBucGrNIoXT3e_TeVUi2PWMBrqZo9B_mlS49iduf43ox0rkbCAwMSMVSygx2H-gj_g8jMldPcu-MuAIw9PMmVv5YUeFA_gaYCqHbFu0Vh7PkknV66s3dowrehX_13fW3qY6Fo_59cGvrmD8hhxfQzZFkC2LAv1h_5Rz3P0tZHIHinb4n85gLxxcqTW9Mz5UVitMtmSSPmRClUyFVO6eC8yvmFza1IrngVFTr9Sql_iJqogAaCi4HAg4PFgIoBoAYhqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2a67W1e0e-d6ITa9Dvv9ZnYIxVKQ%26client%3Dca-pub-8071954460122741%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 26 Oct 2021 02:41:06 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 33ms
33ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211020&jk=3749086392360909&bg=!z8ylzIjNAAbUs_yW1LM7ACkAdvg8WrfldjRO-0IeRkYpi43n9G82kamVfVkER5Jag-scCh1da6h6PgIAAABmUgAAAAxoAQcKADZEiUnEDII5XXae1eDR2FncOjGGdvUWh8n4MHCEy5EL8md0nhBOTmDsCpH1sw9o3vkpnujtkRCZAsKfcvUgsgsYrWWnJIUplKzKG-aaGYcrflsdNw3iQs-oTSEj5hDQvvXRxTjGOs-q8_g41HOZEeEhuER1IUY4lX8nGK2-uhwOEGdBl8pSph1YDJhFrd7cxNssenFWm1Kai0nfaxhlMs3fgNZFWRgHoyw4e1w4PHaQQxOxTVr2RQy5Sff-FOUAssIqCHXyftD8BcAPZyYEgngM4jTOS1XVSbY2VQfI5SrUaaz3E67zfuGi9OfVw7eEQJi5Rk_iYIVnFi8lwgSuEYc3FwKVrgjec1tTAsYtbsLoDr6bENatDNscsG4Tfaj_Ds-cTWWf-eEiX0gCSlY2JzCj2sKEy5bjqb8rkUdq8ogbxyviBPM_AMANaS4di1onWV3l7BnrE9HHn6apao84v8mbHttO6kMQ5PybULAkv_gzbX5LcIOndPCsP6jBf1N_RVjhDFMlDRCgqmDuSdwTl55WI4TdXlS4snhdQDKbwQ0x7PWjsSfqJR-398syvT1E1qUNoqhCYSguo-JgmeAHYBh8RxpN8P3YSeC-PamrQhHYIkOgLQOeE1ETuTR7fZmpuDoVrL7kdfJzJ_lGuoQIbgEGEfkcWDyON19uON9hhm2Xn9OCauZEoKrmUbBZdKLf3GcZKAimJ_nhgGOMJw4WBYLpGoEyZnFaFk2kn_YI8mh4HU8ZB5m8BZKNB7uz01pA--sFoKrLSHL1-Xgww9Zm0O5WWl33lMuW6c7vOh9YRb3YjMirwaAI178-dEru70G960mf0_DFXKOqfdjkSvvfqKZr9tK6X7Mx4V1f6sZ5EFIHm8HzoH1Sk2hbhQ0RkIDa_9hKK9dmX17JT-ylE78tOXtPaE0hPgyC0PV8aaBmIzmobvmbOwuaT34U3sK2v3zp83Psk0mNfnJrtggNooOHhNWcRXivYu-iQuwON8NR6VRnLJzbR0ebrKawkx98

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS