befonts.com Open in urlscan Pro
2606:4700:3037::6815:276d Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://firsturl.de/1zRYNeA
Effective URL:
https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Submission: On December 01 via manual (December 1st 2021, 9:30:42 am UTC) from NL — Scanned from DE

Summary HTTP 171 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 34 IPs in 6 countries across 28 domains to perform 171 HTTP transactions. The main IP is 2606:4700:3037::6815:276d, located in United States and belongs to CLOUDFLARENET, US. The main domain is befonts.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2021. Valid for: a year.

This is the only time befonts.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:303... 2606:4700:3037::ac43:ac1d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
20	2606:4700:303... 2606:4700:3037::6815:276d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
12	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
16	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
3	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2006	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c07::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
2	142.250.74.195 142.250.74.195	15169 (GOOGLE) (GOOGLE)
1 1	18.196.159.27 18.196.159.27	16509 (AMAZON-02) (AMAZON-02)
3 13	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8102:a212:76ab:db1a:a790	16509 (AMAZON-02) (AMAZON-02)
5	2a02:26f0:710... 2a02:26f0:7100:480::4469	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	185.33.220.244 185.33.220.244	29990 (ASN-APPNEX) (ASN-APPNEX)
1	213.254.244.21 213.254.244.21	() ()
1	2620:116:800d... 2620:116:800d:21:3175:5196:e3fd:8c1d	() ()
1	34.98.67.61 34.98.67.61	() ()
1	35.227.252.103 35.227.252.103	() ()
2 2	185.64.190.78 185.64.190.78	() ()
1 1	79.137.68.187 79.137.68.187	() ()
171	34

8 2606:4700:3037::ac43:ac1d (United States)

ASN13335 (CLOUDFLARENET, US)

firsturl.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2606:4700:3037::6815:276d (United States)

ASN13335 (CLOUDFLARENET, US)

befonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.74.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f3.1e100.net

p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.159.27 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-159-27.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 142.250.74.194 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.165 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8102:a212:76ab:db1a:a790 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:7100:480::4469 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.220.244 (Amsterdam, Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.254.244.21 (None, )

ASN- ()

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:3175:5196:e3fd:8c1d (None, )

ASN- ()

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (None, )

ASN- ()

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (None, )

ASN- ()

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (None, ) 2 redirects

ASN- ()

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 79.137.68.187 (None, ) 1 redirects

ASN- ()

googlecm.hit.gemius.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	385 KB
32	doubleclick.net 3 redirects ad.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net	188 KB
20	befonts.com befonts.com	407 KB
14	wp.com c0.wp.com stats.wp.com pixel.wp.com	116 KB
14	gstatic.com www.gstatic.com fonts.gstatic.com p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com	338 KB
9	google.com 2 redirects www.google.com adservice.google.com	2 KB
8	googletagservices.com www.googletagservices.com	188 KB
8	firsturl.de firsturl.de	163 KB
6	doubleverify.com cdn.doubleverify.com rtb0.doubleverify.com tps.doubleverify.com Failed	118 KB
4	googleapis.com fonts.googleapis.com	5 KB
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	casalemedia.com 1 redirects dsum-sec.casalemedia.com	3 KB
3	google.de adservice.google.de www.google.de	1 KB
2	pubmatic.com 2 redirects image6.pubmatic.com	1 KB
2	rubiconproject.com 2 redirects pixel.rubiconproject.com	913 B
2	addthis.com 2 redirects e.dlx.addthis.com	1 KB
2	rlcdn.com 2 redirects id.rlcdn.com	889 B
2	google-analytics.com www.google-analytics.com	20 KB
2	2mdn.net s0.2mdn.net	62 KB
1	gemius.pl 1 redirects googlecm.hit.gemius.pl	337 B
1	openx.net rtb.openx.net	351 B
1	mookie1.com odr.mookie1.com	324 B
1	quantserve.com cms.quantserve.com	463 B
1	innovid.com ag.innovid.com	296 B
1	agkn.com 1 redirects d.agkn.com	767 B
1	gravatar.com secure.gravatar.com	2 KB
1	googleadservices.com partner.googleadservices.com	638 B
1	googletagmanager.com www.googletagmanager.com	36 KB
171	28

	Domain	Requested by
20	befonts.com	firsturl.de befonts.com
17	tpc.googlesyndication.com	ad.doubleclick.net tpc.googlesyndication.com googleads.g.doubleclick.net firsturl.de
16	pagead2.googlesyndication.com	befonts.com pagead2.googlesyndication.com ad.doubleclick.net tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com firsturl.de
13	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net befonts.com
13	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net firsturl.de
12	c0.wp.com	befonts.com
8	fonts.gstatic.com	fonts.googleapis.com
8	www.googletagservices.com	befonts.com www.googletagservices.com ad.doubleclick.net googleads.g.doubleclick.net firsturl.de cdn.doubleverify.com
8	firsturl.de	firsturl.de
7	www.google.com	2 redirects firsturl.de befonts.com googleads.g.doubleclick.net
5	cdn.doubleverify.com	firsturl.de cdn.doubleverify.com ad.doubleclick.net
4	fonts.googleapis.com	befonts.com googleads.g.doubleclick.net
4	www.gstatic.com	www.google.com googleads.g.doubleclick.net
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	dsum-sec.casalemedia.com	1 redirects googleads.g.doubleclick.net
3	googleads4.g.doubleclick.net	ad.doubleclick.net
2	image6.pubmatic.com	2 redirects
2	pixel.rubiconproject.com	2 redirects
2	e.dlx.addthis.com	2 redirects
2	id.rlcdn.com	2 redirects
2	p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	s0.2mdn.net	befonts.com googleads.g.doubleclick.net
2	ad.doubleclick.net	www.googletagservices.com
1	googlecm.hit.gemius.pl	1 redirects
1	rtb.openx.net	googleads.g.doubleclick.net
1	odr.mookie1.com	googleads.g.doubleclick.net
1	cms.quantserve.com	googleads.g.doubleclick.net
1	rtb0.doubleverify.com	cdn.doubleverify.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	d.agkn.com	1 redirects
1	www.google.de	befonts.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	secure.gravatar.com	befonts.com
1	pixel.wp.com	befonts.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	stats.wp.com	befonts.com
1	www.googletagmanager.com	befonts.com
0	tps.doubleverify.com Failed	cdn.doubleverify.com
171	41

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net
www.behance.net
1.envato.market
winvio.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-12` - `2022-07-11`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
www.google.de GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh
*.doubleverify.com DigiCert SHA2 Secure Server CA	`2021-01-10` - `2022-01-17`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh

This page contains 21 frames:

Primary Page: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Frame ID: FEED57D988742E191986BCDD8180DAE1
Requests: 81 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html
Frame ID: A6756E085C3AACD067690CE6CDE8BFBE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&adk=1812271804&adf=3025194257&lmt=1638351039&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039558&bpp=3&bdt=384&idt=348&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3377099533986&frm=20&pv=2&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=378
Frame ID: 5F7B8EBC1333EFBB3189AB5887BD1F9C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240
Frame ID: DA7DEA18D89770D5227438835D531A0D
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: CC0CDC7C15FDD897DF163ECD0EA5F8A6
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: A06DDD7ECB933276DEC7456A22328271
Requests: 2 HTTP requests in this frame

Frame: https://p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 4F484CFF75EE2EEFB820062875DF681A
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E108D33E49807B77581B1DAB22B6ABB2
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=280&adk=326101615&adf=792450558&pi=t.aa~a.4049935982~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1638351041&rafmt=1&to=qs&pwprc=4615830315&psa=1&format=1200x280&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351041047&bpp=2&bdt=1873&idt=2&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd3c09f2daa8752a2-22c9e4241ccc0089%3AT%3D1638351040%3ART%3D1638351040%3AS%3DALNI_MZYWPGjpUgeCuW_BVJH5NXwVWluyQ&prev_fmts=0x0%2C728x90&nras=2&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1413&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&psts=AGkb-H9lRKvgpmIa3CewCI_sjLFyEnhXCJykLBlUgACC7dP19pwLkxkBGxwHhKBFTEO07eDgQH3GyCfn70o&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=lBHXh7toBu&p=https%3A//befonts.com&dtd=33
Frame ID: 7073BE49862064200EDED6082F3630A4
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
Frame ID: ED04F80CBD0EFC4842D3A981D939EA75
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
Frame ID: 1BB9841DF518275D44F69E428009C59F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjX0-alATAB&v=APEucNVPc12Reo7ZJ6OAUfFnNftZDV87YI_VGrskDtBFNzQbXOOqIRrZ4_kL8hykX85pQBCDho1w-NIOzGSXleDdigUMMj9cxKy4I_vS6NzahbbYas91XfofuL02qE_O5RufHpPYZiRoPvdtxPbhqWyaOdXnMeo-V6ctwR7od3dUIoGgokvRJ24
Frame ID: B89E2FCC30161820311AA2D066FD374B
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C8hYksr6YV1trh4F6lomU_J4JADaCvNC8By6VjrPrPQ-skf81Kd7us-Bxbc0gH89I1TW5NBGHsy7mFfUHdB6HzuMWWnHOr7TuJ6-mhSX2aULO4e-om2SPLAdNA3t_XAeJYwDPDGWOui4cbEZcOnyy57neung&cry=1&dbm_d=AKAmf-BYh_HPX6XAITNMPy0GY582Bu9OjmOQcmhHTs04wSgpc5U4Z13ERFku_eIyJhxd_rsMf-YNvOsXESS5rjC-7wAWJ2iWE3s3Sc_1OYibdH74yxIVz5BbVhhsh5aSJlwAzEDi4XtkR3Su5sRdXtBSaqcW7kVqbqowcKo_uept5GIyoamuaD5Y1MESao37ze8354GCmu89kuJYtfNcO26YU6UqzhedVMGuM51SXbG4ZQ5g72tmxT0wSM-3W6OB-f4Le7eSUftDdcebo_acO8dNb8xNfu2SUBW_qutcZQJTRA7mQP6YxcoUuB5FZexKAtf4F5aUHcGYrNgEzk7OzPcZY5G5TLcqDjnajtpV89JCKRhJuGYmJeXw2jxhZZa3m07wYyugDoo5c-qlVTkX2_6hcmUlXgHQBMlEOYttLheucZUttgl8VwnmhUQt7LMVPOqi1261vri71xj_joCj9VEb4PoJBFwV2UL_eoOMr_vM55UnH_OT-hsz-oyQfYhJrAVAXdOJF-dh76_DCnQWgAVkZ81lvAN8ATgX6Yd07eeR6x7Qmlv_wI4ysFzNSFRCdPW0L96CRE7KdJ7XBpAUzMHIItSMjCu8-P32FG0ba9bIDSQqoOCI4aDDPtJq1wugS-7f7_Or51oDJpy_YxBs4zcHXKTpYPAiZgFMkEXisDKxB7YNd53mopBYN77hHKy3NYqJ7w5vDS4gGXkIBswmt0hidXtz9DK-aNdVU4oxxFCnmUflHIe-pkIe-odAAuCJscUNKOFSEiSDX3zOGZdNEM0akrTGd0Vn_VV-uSldLT909HRGXSvssI6MsIlWVvmgxuyiKFpemSszjgGoc7PttvabUeZwpsebRV_GGuemU1ZMofDk-mL03NP_4VIn_uDca0t_z8hKNj5i8uJ1jIQok_rQaruYyHhssoq4y5yfq5Ej-P_9EpcRVEiXoCRbwALdCMc614cfI8HeKVpV7z-aMejbMXeGIJfR82ntaunHaiSkaLw9fIExyQtJcTKNWepNQkiqOGZhOIJ63xiLKznFCp9n6ra9D_L6shNcrkyTss7p1cOfy0kKsyA-KJIfHrUL0qvGXEAdb-tugdsXKh00pFgf4RKLLxPNkafsxG2I9rf8FESamwi1j3aKVciDGyUE2FdvOwUnHxgEOJBBAiwqV4jAzmecjWXMfvPhtjpuMhmsVPTQyN_3Ezm7plgpVScdlbAiZxkEG-MN2PSx_H6F74Nz8v-2qIF6tnkHxI-HkqCP3CxSNxtjmVvfhTs2XkgYxzWMSjdYydaQFm2LSFsJNdzKuxvDth0m3qi44UxMSt9ha-eZJz4wgUD5ITbvmoqPyAUvcfzen1HrIczOX6u23cwO-rnViqkeL5OpNviDzT7FIwrxXa5TpurfUn7cCXNbpPbZXKHKQo_2NgYBXIDBJHKvxeNjwKFnrbNq0tCtQc9JHyAPyfytycHKVXJ83EZBeDebH6BMoP2fHLf1KKtnOlpF1ETJmF1_9kFT_LusOR4hmteLTps6hY2Auwfp1ApBXZAPidgM-GKIsCMzmzttiQhNjtOUl1X0DsOJyIpuPwGLYa80vaXSGmTtgcJj2VjpyLJJFkUzfWlpThmbziT8WspZ0pfYAX1oW_lUaJo1xVg64f6ojBMJSrDbaUrKzVGMMItHI0g2RRakY32EGqGv-hLIBcc9mWewhUhOSpsk8U52Jj-ZdM4EfHzy7kay3ma0EivXMF627nvAMMhdSS7-mx_brMvRdhIvgOH12vOgRIycWXAWOxHFO7sl75bx6rHsWYBPG4rMGnfsV7xTXoPiAu5qBQSTOEfXNYf6ftKdWDFD0ugl2l-rz3ZNsYLLvOn9y5r8ifPHCwrHQxSgKNt1VMPXxQs2BT3pg-DJ9EmbQpjQLMiEe3bpkfIv5Nd47JeADr_ChSZ59VfOmxsJws8tZpxgfdZYEqFdAScK0z4chFzamKC-y4yzvcc91F6CXbeM9vw8yAub5KCwLQMsNKgTKoa8AsEK5u2LEkrAA1IUg2LlU4-fvfy6h6w7l2LU1K3QmCPkvfX61x-i1pgRr7A5MTlF4mAvVJ86qg6Z9z6qHye3_bVw4-4VAsuVe1V_8FbeXpM6uN14u3V-6tN249kX89-ZGw9ht4O98FWAYI_RGCNwOZphBcDnMIY8wPJsPIQGC-2GAXGckrZtvMz43PgyWiUMHysz0o9bYfMgqj65WnsEVJoF6bC_QFnO3QNNOF1UxqaFwi3soqqC9lnYE_fmqbUhAq-sXH43tJemhIedFFefbOUEHnKFx_XxsMwwCoZmLX0qV7lOiPBkUCssdSaPeKHahZa9bsDxLeBTFmt-vde4-rVEc5k7I_JwrgJZWbsxNwNHnDktlF04pLrVP1NW0AYG1wpJK4s_682RjT5l4EbFdVjvLjzNLOXJdZeC6f2Tlp-AGBVK5ixFdLmunI4L-sxZpANxabYdAWdTBopXaPWHNIS49Jre7WEtNn-DeTyxmGmXIO1Q1knDUeZuy9wJ2zjECls4y-nF3jVZ8AQnIEHxnZGfQj5e-aWhsEGqh3Yt15TThGUrw1RdqcSCq7rZeFlfuAhrdQcU1fohHbm9ATdYpt98E0Z1taEZ_d6U9X1vIiWOiWJ7nwexBvi-H56A01EVFt3Zzsyp-mwEzG-SZZTFiy0z0rx_i31-4rl2DH8ZsZ9rX-8vPB_xJ7Oe-Ka8qVJmzGlYxlSp7cN1V-0IMHxw0PP-mdZXfHDRyj-QaaaeyHU6OtVwBsIqR56V-axEXCXv421reCtTPIWoJ0mQULHwSHyDldSg_s65tu2Xj9raAR7Z7usr-FfHs5mCdY8bKcblawaPc3X4AwOB5dqvI7oLCpQ4roS_HLhJYbgUsTpLagJ7w-q7s-Cyx6vnMFWZuK1mohuU-q-f5ut-XJYCCfvbUoJIPKwYehPOqrdEjGoF4brgAbZrtO39jDQ6uk2sUsIV-8NUCJyPegVx84YgECubQzW9sld2q-5F194gsljAAkIPSrNokKIWKUWPSBsSphGt-YVhuMyXmYKAtb_HcGAYgt-OaEyYVmXSgAi48QU9b5TNhK3e65Aea0YlzmsLdXZZ1ubDnCBqoUyi9KcMXzz8Ox00kjHhhcb26WZWkgNgg76xRkcdxvBXB1A-KhDGz2ohsmBR3giezOctmGyrEE31Uck1HR5cMjWTgEu5etQAK_yQZ7TSlk_72Tb6O3GDLFtxz3wPNbiIXGPVvPLoezTHxHyd94fQfWI&cid=CAASEuRovV4a41nUILyScpBq48akEw&rfl=2%2Chttps%253A%252F%252Fbefonts.com%252F%240
Frame ID: 129C8C360B47B6EE9C7BF30FB1D07047
Requests: 20 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 4CDB6205739E1A591D77DAFE59F11963
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js
Frame ID: E1D7DD26BDB761BF8AB26F488EC185D6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 522AA557A3CA1A853D095A6B3D3DD671
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 10EF9E50F4E0B127C90AD2BBC2CAA730
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B2E4F3EEFD302457DBB746C9C75B1737
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements1874.js
Frame ID: BB043E4AC00D5549DB18CC9EAFA25A85
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 582180E4E04C33CE1C12A523D1EE24A0
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 2F90DDFBFF85308A6B4DD82C8C0E6EDB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Download free fonts

Page URL History Show full URLs

https://firsturl.de/1zRYNeA Page URL
https://befonts.com/checkout/redirect?url=https://winvio.com/australia/ Page URL

Page Statistics

171
Requests

87 %
HTTPS

54 %
IPv6

28
Domains

41
Subdomains

34
IPs

6
Countries

2067 kB
Transfer

6346 kB
Size

30
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjssLqYu7NGTTbGBoxf-e0E7KkyDXpEbA5GcQZEwG8m5F-WllpAG8aQa44BbXMwnDA2x3MgTnqqqqYZYHk38IBHaBSZoDuioJHfQ9RYWr4HQV3ad2h5lsT3exjI98F12f&sig=Cg0ArKJSzA3DGDLFkX6Z&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=https://elements.envato.com/fonts%3Futm_source%3Dmedia-buying%26utm_medium%3Dbanner-mb%26utm_campaign%3Delements_mb_befonts.com%26utm_content%3D728x90_fonttiles_fonts%26dclid%3D%25edclid!

Search URL Search Domain Scan URL

URL: https://www.behance.net/befonts

Search URL Search Domain Scan URL

URL: https://1.envato.market/c/1947176/431866/4662
Title: Unlimited Font Downloads

Search URL Search Domain Scan URL

URL: https://winvio.com/australia/
Title: click here

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://firsturl.de/1zRYNeA Page URL
https://befonts.com/checkout/redirect?url=https://winvio.com/australia/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 94

https://d.agkn.com/pixel/2175/?google_gid=CAESENqvQcb3awd21QgMw7smfSE&google_cver=1&google_push=AYg5qPJnDRWfzhJ-s8vO46UFlURLuq9XLpFI0Qqwhpg9SiZWKffJI2ryR7LCQYdB9inAlqZ9WjAIX9ayXKAl7yuq8_sUBjjgnzDALw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnDRWfzhJ-s8vO46UFlURLuq9XLpFI0Qqwhpg9SiZWKffJI2ryR7LCQYdB9inAlqZ9WjAIX9ayXKAl7yuq8_sUBjjgnzDALw&google_hm=Q0FFU0VOcXZRY2IzYXdkMjFRZ013N3NtZlNF

Request Chain 95

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLrzUp3rivy_JyczoI3M6nXlRtLKr1N1BTHDGutHtnjzABEh1ixoAOpX63D3MvFTV2pOz5Wp8AFIImAC4XBrGafrA3NQqy0GA&google_gid=CAESEGztbc4kLGDy0PmA3qh8XXo&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCMGBnY0GEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBMcnpVcDNyaXZ5X0p5Y3pvSTNNNm5YbFJ0TEtyMU4xQlRIREd1dEh0bmp6QUJFaDFpeG9BT3BYNjNEM012RlRWMnBPejVXcDhBRklJbUFDNFhCckdhZnJBM05RcXkwR0E HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTnRjTGNwNWhTZGk0RzF5dzB5UXVyYU5rVXJXTlh3M21LS1JqWHExVXZNVQ==&google_push

Request Chain 96

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLBQ0AMudiZ0uzTzmNNmbe5bgmal2Pnp1Slhtr-hSuL2oh54wrGLAGo1b3Lxc35OhABksxSwO1OCeerVsGD-2arluLImwEigg&google_gid=CAESEBtStGwRuiSbE11oV7YzMjc&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLBQ0AMudiZ0uzTzmNNmbe5bgmal2Pnp1Slhtr-hSuL2oh54wrGLAGo1b3Lxc35OhABksxSwO1OCeerVsGD-2arluLImwEigg&google_gid=CAESEBtStGwRuiSbE11oV7YzMjc&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwOTMwNDEwMDA3NDMwNzMxNjA4Nw%3D%3D&google_push=AYg5qPLBQ0AMudiZ0uzTzmNNmbe5bgmal2Pnp1Slhtr-hSuL2oh54wrGLAGo1b3Lxc35OhABksxSwO1OCeerVsGD-2arluLImwEigg

Request Chain 97

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEC6pNUYjssMjU1M5ltCZYdE&google_cver=1&google_push=AYg5qPK9U16h6cSYs8-gyV6FAEeDR0onrNr6MshpI-3-4NFm_XtuvrLVBEiH16cqNTwSXZ3qIB6dwZuaoMFe5R0f4ioHlISq9tsN HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldQVlotWC1ESk9C&google_push=AYg5qPK9U16h6cSYs8-gyV6FAEeDR0onrNr6MshpI-3-4NFm_XtuvrLVBEiH16cqNTwSXZ3qIB6dwZuaoMFe5R0f4ioHlISq9tsN

Request Chain 98

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI

Request Chain 101

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1

Request Chain 134

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YadAwYTIqhWjUk.VD1SUUQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1&google_hm=2

Request Chain 135

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEK6Q0JCv_lgvapNJWFnGRAQ&google_cver=1

Request Chain 136

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzMzNjkzNDYwODk4NTUyOTQ0NA%3D%3D

Request Chain 143

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 147

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEKs334b5TRc4KYmF0bT6tbU&google_cver=1&google_push=AYg5qPKrN2w6GD1HYG2NIJYilfrPGv8Jb7LvvTLDNT3aPZZsCp3ZED6GGivg5svvw6gnLOJ_WPVAlTUghqm560OVHw-5__nJWic HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEKs334b5TRc4KYmF0bT6tbU&google_cver=1&google_push=AYg5qPKrN2w6GD1HYG2NIJYilfrPGv8Jb7LvvTLDNT3aPZZsCp3ZED6GGivg5svvw6gnLOJ_WPVAlTUghqm560OVHw-5__nJWic&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RhJDFGxsQxOBNCvq-5y-Vw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKrN2w6GD1HYG2NIJYilfrPGv8Jb7LvvTLDNT3aPZZsCp3ZED6GGivg5svvw6gnLOJ_WPVAlTUghqm560OVHw-5__nJWic

Request Chain 148

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENXiKM7PI_ns_unZ6yocr3I&google_cver=1&google_push=AYg5qPL9xCWRKz1fUmjhMhT1UOWdYCp2vbumx2izXKJzbFMGS1TKlezE_GaVP8n7hDPHq5jQkWy0vto3AyupLE1g7n98bfL9nPw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldRQ0ItOC03VDhB&google_push=AYg5qPL9xCWRKz1fUmjhMhT1UOWdYCp2vbumx2izXKJzbFMGS1TKlezE_GaVP8n7hDPHq5jQkWy0vto3AyupLE1g7n98bfL9nPw

Request Chain 149

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_cver=1&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q&google_cver=1

Request Chain 150

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEFE2rk9XcDBctcJRBNYaQBk&google_cver=1&google_push=AYg5qPIZlbM9A69T8xLqWuHnLjO9aUR72GIr_-jRR751WYv1SMTs8t4U-sC2VN7x9GkrJEYmv0DBMV5L2GnX0NOQBBPeHjEBcCMR HTTP 301
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIZlbM9A69T8xLqWuHnLjO9aUR72GIr_-jRR751WYv1SMTs8t4U-sC2VN7x9GkrJEYmv0DBMV5L2GnX0NOQBBPeHjEBcCMR&google_hm=

171 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 1zRYNeA Show response
firsturl.de/ 9 KB
3 KB 76ms
46ms Document
text/html 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://firsturl.de/1zRYNeA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8f8b54b0fcde65fd8b868b0c8cf4e5337dae1918ac1a24fdc96d2000dda4c73

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I4Rf6ZbEd93fXAiUyP0wbVBIYaqh2TEs4GHhZyIIm3HxnjEFuGmvcsNTYOe1grQdcddnQwqqqATSFKmqH%2F5JsZxC%2FF2cUjoYo9vOi3Cvd3ZRrsWE3U0iMRaT7J5MkP7Fq4fRDAkV1LMPMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6b6b4c411fb24351-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.css
firsturl.de/include/ 2 KB
1 KB 26ms
25ms Stylesheet
text/css 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://firsturl.de/include/style.css
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02fea9181433d073de2c559eeb99b916b4498124c46788b5cb9be0e692251104

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/1zRYNeA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 26 Mar 2015 19:06:44 GMT
server: cloudflare
age: 410
etag: W/"7ec-51235b77ffd60-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FeDMrRFDlkEtYUdN7xUqurwgxPSfTLc%2FF5Cuw1Cyk28uNI0%2BO06DJ2FPevwjqGq30Kd8YzkgxIhwipOErWElTCXD9OzwoW2Bpgy4ZMt1xedCSRZaTRC3yrDTtp4t96R3msbrOzGLYFNSBw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6b6b4c4188a24351-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
968 B 133ms
49ms Script
text/javascript 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fcec8f9f4b2b56dcc746a20c4d2f2992bbefcacc3f2aad7e2b45f1f32da22e67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 1; mode=block
expires: Wed, 01 Dec 2021 09:30:37 GMT

GET
H3 200 de.png
firsturl.de/include/ 612 B
1 KB 27ms
27ms Image
image/png 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firsturl.de/include/de.png
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6b1ee1113df9181d66452fe3899f280e9bd174ba6b3d277d6b93474e867d510

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/1zRYNeA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3146
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 612
last-modified: Thu, 26 Mar 2015 19:06:42 GMT
server: cloudflare
etag: "264-51235b762d09f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h9TrQyGsaUSqZi%2FGVXeVKwmk%2F%2BT5FY4LKEqGl%2BXCl7PR4P9Un%2FRVO1Dxkr%2FVnNk%2Behh9WCgkaqB%2FJQWLFyg3wNe9r5z1GdSj6ql3eSbMWasLCeBIbEg9nAQzn5kbW1RZUp2YHwYJnYQVPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6b6b4c41eefe68f7-FRA

GET
H3 200 en.png
firsturl.de/include/ 602 B
1 KB 16ms
16ms Image
image/png 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firsturl.de/include/en.png
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed6f77c097f0236a46fd7747f6665e7ae54f7ecc95e20f1b16db71affa3799d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/1zRYNeA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3146
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 602
last-modified: Thu, 26 Mar 2015 19:06:43 GMT
server: cloudflare
etag: "25a-51235b765dddf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ytcxTH45uMcsAKZZAvBOZOwtchCavCYh1ifR9QlPE8YvU%2FuhNH8Ct4TirCDj1jaLcU3hqxRJWTImxGwfgwpP8Wgjyc2MtfqVTt9NbETgopDyEuM49t71aBJOBlCz9t5QuLneCfrwVSVCIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6b6b4c421f7768f7-FRA

GET
H3 200 cookie-consent.js Show response
firsturl.de/include/ 108 KB
29 KB 25ms
25ms Script
application/javascript 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://firsturl.de/include/cookie-consent.js
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c36672734eb354012ec579c10e879ecf0e25dbcb2c0281bad87a94ed332698d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/1zRYNeA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 08 Nov 2019 09:47:53 GMT
server: cloudflare
age: 3978
etag: W/"1afe1-596d2ad01c9a8-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TH%2BewyypK23dLSTtAE9cVDhanJpdZXgcZN2UQM73y%2FQnkk%2BJ9Ikau%2BCbCX4v%2FCWpeQ7xOj7IeZcI2FlnhLJwnW2LZdoIL63gsXOFFVea4VgcIUQuTs7DrNbo8ZdiEsTR%2BlHLodxtNSB03w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6b6b4c41ae4968f7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 print.css
firsturl.de/include/ 265 B
746 B 17ms
16ms Stylesheet
text/css 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://firsturl.de/include/print.css
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04c6b2d6f35c6fec594184f59a019a1611c7f179e94abb1535d11e4368ed5f29

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/1zRYNeA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 26 Mar 2015 19:06:44 GMT
server: cloudflare
age: 410
etag: W/"109-51235b77ce080-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gki1ePoFtRZSH7wBCBY5EXR%2BEbdS1VCC0y6hHyL0Q6K6X1iT5uPc582mcgBpZUMwKqeoHDcLp0T3xjVoW9iQWpAbwcnbskAsLQOnYx97f6%2B6pJvT60U%2B%2B2nRiSzS5oAQj4kc18%2FvmdyGtA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6b6b4c423fb768f7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/ 347 KB
136 KB 125ms
39ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/_7Co1fh8iT2hcjvquYJ_3zSP/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a56234241a7dd6d1f2a13b3d521d260c999c9bf50e97f255859649775eec6ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://firsturl.de/
Origin: https://firsturl.de
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 07:38:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6711
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138691
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 05:04:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="recaptcha"
expires: Thu, 01 Dec 2022 07:38:46 GMT

GET
H3 200 bg.png
firsturl.de/include/ 205 B
792 B 22ms
22ms Image
image/png 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firsturl.de/include/bg.png
Requested by: Host: firsturl.de
URL: https://firsturl.de/include/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 196dbd9bbb848910c88bc9a19a3bcc85fb3d97ae6d673a77f37a6ecbf398c868

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/include/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3146
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 205
last-modified: Thu, 26 Mar 2015 19:06:42 GMT
server: cloudflare
etag: "cd-51235b75f753e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2F7QkCdSik5gMVdlBhpvdG3P%2Bw2CAMJ%2BDzBkGzyJOiiasGw0KJppQk5GgVPkBEQyHrDKay0iRL3m5goKif5S8DTbiqaVzX2b3g%2FC3PWMtqrl8OAkncOi8Y9ogHxTKCyMaac2KTeeuv9NRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6b6b4c42784a68f7-FRA

GET
H3 200 header.png
firsturl.de/include/ 126 KB
126 KB 15ms
15ms Image
image/png 2606:4700:3037::ac43:ac1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firsturl.de/include/header.png
Requested by: Host: firsturl.de
URL: https://firsturl.de/include/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:ac1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d81c5fe0ec47980392218e611e2a8aa6f6046554387b40e0096acfad7d544651

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/include/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3146
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 128878
last-modified: Thu, 26 Mar 2015 19:06:43 GMT
server: cloudflare
etag: "1f76e-51235b773c85f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y843jIWNrA5CspxN6ISb%2FjihXoHUCa4DEs2RMv9AjRt2JFg4Fcw1whED%2B3aVttqE007RGBa2ADHjwy2L%2BkC7fGf8C5KpWz4sNZt%2FVONcOqF5t%2B4yRbTZ2NEt3L3pyaoYfq8WX3fgQNvgzA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6b6b4c42785368f7-FRA

GET
H2 200 Primary Request redirect Show response
befonts.com/checkout/ 304 KB
46 KB 1071ms
1038ms Document
text/html 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ae7567b6f24bf762731012db36aac7e182b2fa8f5d9d8674d626c084a619dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://firsturl.de/

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1INUhY%2BumTubbpdU6jTctoIwHUqgtOOLo15NlUzyciflUqRGJoDzXQ78YKoCPoYvBcWdAjOuk8ECU%2BUeA%2B9VTtgi7oJZcN8d3KPg9FR5KzUmBPrXUn6CwIYYAP1%2FTDRzbq43K4ZytQhvqw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6b6b4c445e49699f-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 53 KB
2 KB 146ms
55ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CNoto+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7COswald%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext&ver=1.0.0&display=swap

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8ee71d7e5b73dee27f29df818059ca38d83f4ee6cbe6997d8a026e48df5bdd32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 09:30:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 09:30:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 09:30:39 GMT

GET
H2 200 dashicons.min.css
c0.wp.com/c/5.8.2/wp-includes/css/ 58 KB
35 KB 26ms
7ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/css/dashicons.min.css

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Wed, 03 Mar 2021 21:16:22 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H3 200 extra.min.css
befonts.com/wp-content/plugins/menu-icons/css/ 815 B
952 B 37ms
24ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/menu-icons/css/extra.min.css?ver=0.12.9
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 968ab8ae6f33119ee267a11ce60920934e0d5e9d4714a3eb6b47cb9f05e42a0f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2062183
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Mon, 09 Aug 2021 12:37:27 GMT
server: cloudflare
etag: W/"61112187-32f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dyb2jE46olTxUE8iKR%2B6Rs6iNRDMTLjiSVJYYcVpnrqM3LoQdlmkORcle6ZAwaANP%2B1bAZdjps5vJoOTjfdf7kRTlhHbRm1ibHdU258HE%2BKVh30HzhENTGqtPPrkP6Im36X2iMd%2FgweEiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f3a145a-FRA
expires: Tue, 07 Dec 2021 12:40:56 GMT

GET
H2 200 style.min.css
c0.wp.com/c/5.8.2/wp-includes/css/dist/block-library/ 79 KB
10 KB 27ms
8ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Wed, 01 Sep 2021 04:05:58 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
c0.wp.com/c/5.8.2/wp-includes/js/mediaelement/ 11 KB
2 KB 27ms
8ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 wp-mediaelement.min.css
c0.wp.com/c/5.8.2/wp-includes/js/mediaelement/ 4 KB
1 KB 27ms
9ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/mediaelement/wp-mediaelement.min.css

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H3 200 styles.css
befonts.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
2 KB 39ms
27ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1650211
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Fri, 12 Nov 2021 07:06:21 GMT
server: cloudflare
etag: W/"618e126d-aab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z1wV7lnBiNsfaXhRtB83VrPo6LPsAmMeDcm8sD4ZsWs1Nen2YxXuoxEvappUei6ZeprYXpCePuSRQ8k%2F4Ulr71fPbS040pqCN24gfHFgDPQaTSwEJgh3wqRD0V%2FOM4KLe%2BB162TMDeGN6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f40145a-FRA
expires: Sun, 12 Dec 2021 07:07:08 GMT

GET
H3 200 if-menu-site.css
befonts.com/wp-content/plugins/if-menu/assets/ 929 B
1 KB 37ms
26ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/if-menu/assets/if-menu-site.css?ver=5.8.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a5493a5b3c37e372b6fbad104606ee808ea4ff2f4f9b9f42ab060e20ca78cf84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1748546
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Wed, 03 Feb 2021 12:18:00 GMT
server: cloudflare
etag: W/"601a9478-3a1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bq2bH0AAS6rMhGHuhvD5Jnx9QJ0nFz%2FeEhIOESYqTtIecbkBKTBElVJWjYjhcYNVDCBkYZuo4k2GcfVv9CxQmYKnmunADKfWJ%2Bs%2B4RBaFFSQiHggv6UOOt6zm2lKBadycfN59tJWy48Wcw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f3c145a-FRA
expires: Sat, 11 Dec 2021 03:48:13 GMT

GET
H3 200 custom.css
befonts.com/wp-content/plugins/menu/css/ 56 KB
11 KB 42ms
31ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/menu/css/custom.css?ver=5.8.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c61ca1b95bfd45310fcedcb381ca703605090d7d97f22f84023d93cc2cedebc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1748546
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sun, 18 Jul 2021 10:06:53 GMT
server: cloudflare
etag: W/"60f3fd3d-e064"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzU%2FSsbEc4wnoXZAaWyPYpNnR%2B4mTKZfgpZ8ZT373nOMXzBZgAeCTdjK%2Fpb60EVHEx4CYJD7VMRU0QC%2F8AWxyFuWlLyjKFH4Qqgx2Pd133WWPUKcWmwbJ8JIvsAIv%2BBzNQZSxz3pKsPsQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f3e145a-FRA
expires: Sat, 11 Dec 2021 03:48:13 GMT

GET
H3 200 hocwp-plugin.min.css
befonts.com/wp-content/plugins/menu/font-demo/css/ 7 KB
2 KB 29ms
17ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/menu/font-demo/css/hocwp-plugin.min.css?ver=1.0.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82add349806b9eb46e9bb08a53aaa703f6e0866e5e5bdfa564330c77ca31d194

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 960559
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Mon, 10 Aug 2020 13:50:42 GMT
server: cloudflare
etag: W/"5f3150b2-1af7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Sj48oCT0ZkK8jjZsuYiHH30nbaG%2BKVt%2FPYuyTCvaq7pdcZTbjd0%2Fprl4WOvR%2Ff%2B4raEIMi2BfdsU9KVRCfKjwPq4B0Q%2FPBzymduzo0SJqHOcXPBd%2Bp22WJQk2MYDE2cnOlA8kedrAW8ng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f3f145a-FRA
expires: Mon, 20 Dec 2021 06:41:20 GMT

GET
H3 200 style.css
befonts.com/wp-content/plugins/td-composer/td-multi-purpose/ 68 KB
10 KB 28ms
17ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://befonts.com/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=5a862b9d7c39671de80dd6dee389818b

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59671205ce4d2ec4a037ba18847d2e02fddcce3eaed20a6a731161305b24aada

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 11747315
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 21 Nov 2020 08:40:02 GMT
server: cloudflare
etag: W/"5fb8d262-10ef8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bgzDRoMNV2UP%2FICyk875Ag3fsp15%2FVKKW1gv%2F4DwdiTpDoCXmkLDJ6k7scpyLXuPU%2Bchpseo7gxlb27B3pqK6YduQGdY1Ic6%2FsdyCvzzAQ%2BDdyxMLB2oGz6XfbBnAnC6TT19ksK1ByJwFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 6b6b4c4b0f37145a-FRA
expires: Mon, 18 Jul 2022 10:22:04 GMT

GET
H2 200 css
fonts.googleapis.com/ 32 KB
2 KB 138ms
49ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700%2C300%7CRoboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900&ver=9.8

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b97396e47358ca590fd51a61a7eb915288e944d17221d264fdcba4255be5fa69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 09:30:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 09:30:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 09:30:39 GMT

GET
H3 200 style.css
befonts.com/wp-content/themes/befonts21/ 153 KB
27 KB 51ms
40ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/themes/befonts21/style.css?ver=9.8
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c3099aaf02a8d4741205616f5a21307719bad4803b4ebd3ea329818c90e98d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 802319
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sun, 18 Jul 2021 10:17:41 GMT
server: cloudflare
etag: W/"60f3ffc5-26326"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rg7PljJisM1XU7XKC7y0aTpYXZAR6tierkZFU6AKgyk%2B%2FwUK0lVuIsK%2FbQG6hlGVnECYcTBlVY6fMOpDb%2FosEwq43DzDK2sdFqjCyMFzACL9DI3mCUHTOngEYPmBWgd39mjBb7H5%2BDO0Nw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f45145a-FRA
expires: Wed, 22 Dec 2021 02:38:40 GMT

GET
H3 200 td_legacy_main.css
befonts.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/ 987 KB
96 KB 39ms
28ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://befonts.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=5a862b9d7c39671de80dd6dee389818b

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2780aa038eab0dde91138a411a38c85cdf4fd62adbbda6be24498de25e38c4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 11747315
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sun, 18 Jul 2021 10:04:00 GMT
server: cloudflare
etag: W/"60f3fc90-f6c67"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3lSuPqXO92T9dJ2K5TyDw2QTGuL%2FvJWhLPu2w1m6ejZMtsiHcBJaplhdlV4ndauoyeyIWReRnJTcPyrdNm9lIYhf9y2fUE9ZvCrO39SW7VxB%2F87JmEUdugsjRcsERm2MMXJddzwQ3kh9aA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 6b6b4c4b0f44145a-FRA
expires: Mon, 18 Jul 2022 10:22:04 GMT

GET
H3 200 tdb_less_front.css
befonts.com/wp-content/plugins/td-cloud-library/assets/css/ 102 KB
14 KB 38ms
27ms Stylesheet
text/css 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/td-cloud-library/assets/css/tdb_less_front.css?ver=489325fca4f12cbec6ded350cf173551
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a41621a9b1eea621ef58aa20183231b7afeb29589f8faebd36e0a49a5acdef75

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1664491
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sat, 21 Nov 2020 08:40:10 GMT
server: cloudflare
etag: W/"5fb8d26a-196a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Luww92YaLw0KsQHnzqRj%2BE0yjsLRCjCo4q6RIYgw185Sq0KZf0MDjrfStGNj0NZPDYNczgviOIlE6Bqapem1YvjPaKENi52VfyWyHYdoWBGv4o9wf1iBDu%2Bn5VTDeLWsGAgIY%2Bc4rtm1Pw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4b0f42145a-FRA
expires: Sun, 12 Dec 2021 03:09:08 GMT

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/10.3/css/ 85 KB
16 KB 26ms
9ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/10.3/css/jetpack.css

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

41b60d2262cffca90f6cd644983a2d813336dc959558bdd6ae54b35ef06dd9fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Tue, 28 Sep 2021 19:34:54 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/5.8.2/wp-includes/js/jquery/ 87 KB
30 KB 26ms
9ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/jquery/jquery.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.8.2/wp-includes/js/jquery/ 11 KB
4 KB 26ms
9ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
51 KB 146ms
59ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ca32e4264f8a655533dd1f48e09dba95b08d69e290760f25988a30be23f552d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51315
x-xss-protection: 0
server: cafe
etag: 17666179795494498778
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 09:30:39 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ 9 KB
5 KB 127ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 08:37:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3193
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4486
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 19:29:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 01 Dec 2021 09:37:26 GMT

GET
H3 200 befonts2020.png
befonts.com/wp-content/uploads/2020/07/ 1 KB
2 KB 16ms
16ms Image
image/png 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://befonts.com/wp-content/uploads/2020/07/befonts2020.png

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c6266ddf24176c668193d4f020b0765d1942e4a5d83e004c222f5f503ba741b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 11747314
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1503
last-modified: Wed, 29 Jul 2020 09:39:15 GMT
server: cloudflare
etag: "5f2143c3-5df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tHGz1kJB5YEoyie39PlTkpZmtHMiXfda%2FK81ekVgag5eKMZb4vtorh1SfIqLjpk8smb%2BH4Sj5WjAuLKSL9ZcTfbKaFDp8l3ZMgZWAIHfJEJRrk8%2BkoQadtbFWUfwoeYCXoul0Zqqtwgytg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 6b6b4c4be86a145a-FRA
expires: Mon, 18 Jul 2022 10:22:05 GMT

GET
H3 200 wp-emoji-release.min.js Show response
befonts.com/wp-includes/js/ 18 KB
5 KB 17ms
17ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1748541
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Mon, 26 Jul 2021 08:16:52 GMT
server: cloudflare
etag: W/"60fe6f74-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=60TiMLYA4I0t0UD2QN6sq1NqaBGsyct3XbIh9ow2VVEmh4wOzBDNOSpN3PUBOAgFswzNEuB0sApp50QlJoxj4KDds8%2FBO3JYeGVmkGALKj0mrFMryJVvouB3FtiPyHgVVh03HXVZnEuEnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4c48f1145a-FRA
expires: Sat, 11 Dec 2021 03:48:18 GMT

GET
H3 200 impl_v81.js Show response
www.googletagservices.com/dcm/ 41 KB
17 KB 86ms
40ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v81.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://befonts.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 24 Nov 2021 12:23:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 594459
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17189
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 20:08:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 12:23:00 GMT

GET
H2 200 B10719759.146971922;dc_ver=81.236;sz=728x90;u_sd=1;nel=1;dc_adk=4042925164;ord=c5f7cc;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fbe... Show response
ad.doubleclick.net/ddm/adj/N464220.2664435BEFONTS.COM/ 41 KB
21 KB 168ms
81ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N464220.2664435BEFONTS.COM/B10719759.146971922;dc_ver=81.236;sz=728x90;u_sd=1;nel=1;dc_adk=4042925164;ord=c5f7cc;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F$0;xdt=0;crlt=mJ3tIkPLLf;sttr=105;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

f27bf6fbacf9d4bc21396ea82258b718bb0946c4b590bb40dffedd20c2a11c9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://befonts.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20900
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111160101/ 272 KB
98 KB 117ms
70ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111160101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1300413371050000&plah=befonts.com&bust=31063796

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db35a22a37e4d085378108bb50cd877199b8e5d56a373da285e4b27c5a5230c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100191
x-xss-protection: 0
server: cafe
etag: 13586379416776714816
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 09:30:39 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/ Frame A675 11 KB
5 KB 123ms
38ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 01 Dec 2021 06:55:30 GMT
expires: Wed, 15 Dec 2021 06:55:30 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 9309
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ 119 KB
36 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N464220.2664435BEFONTS.COM/B10719759.146971922;dc_ver=81.236;sz=728x90;u_sd=1;nel=1;dc_adk=4042925164;ord=c5f7cc;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F$0;xdt=0;crlt=mJ3tIkPLLf;sttr=105;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 09:30:39 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:28:48 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ 0
524 B 170ms
74ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssLqYu7NGTTbGBoxf-e0E7KkyDXpEbA5GcQZEwG8m5F-WllpAG8aQa44BbXMwnDA2x3MgTnqqqqYZYHk38IBHaBSZoDuioJHfQ9RYWr4HQV3ad2h5lsT3exjI98F12f&sig=Cg0ArKJSzHLnEzS1rJNIEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211111.21797&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://befonts.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ 41 KB
15 KB 123ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 12:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161159
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 29 Nov 2022 12:44:40 GMT

GET
H2 200 3595402195607349859
s0.2mdn.net/simgad/ 62 KB
62 KB 154ms
40ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3595402195607349859

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d843361c4aeea1a41e0c314e061c78adc0c767ac3bed1d5fad0a8076f4b8bd5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 14:28:59 GMT
x-content-type-options: nosniff
age: 414100
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63246
x-xss-protection: 0
last-modified: Tue, 26 Jan 2021 14:51:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 26 Nov 2022 14:28:59 GMT

GET
DATA 200
OK truncated
/ 121 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 123ms
39ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CNoto+Sans%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7COswald%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&subset=latin%2Clatin-ext&ver=1.0.0&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 13:52:02 GMT
x-content-type-options: nosniff
age: 416317
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 26 Nov 2022 13:52:02 GMT

GET
DATA 200
OK truncated
/ 31 KB
31 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc9c387b513b4d43675910f780fa03e92b9a4b58432b402a8f0a801a0d5ae855

Request headers

Referer
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H3 200 newspaper.woff
befonts.com/wp-content/themes/befonts21/images/icons/ 120 KB
121 KB 22ms
21ms Font
font/woff 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/themes/befonts21/images/icons/newspaper.woff?16
Requested by: Host: befonts.com
URL: https://befonts.com/wp-content/themes/befonts21/style.css?ver=9.8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f74eda5ca917f0146ec28a71e0602f7a3b9dae063acfeecfe6549bdb165d47a

Request headers

Referer: https://befonts.com/wp-content/themes/befonts21/style.css?ver=9.8
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 287777
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 123260
pragma: public
last-modified: Sat, 21 Nov 2020 08:38:46 GMT
server: cloudflare
etag: "5fb8d216-1e17c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zrsQ8g3ixkVqflKm4wguhfYB0zJJAErywpagxFOIjfigP0hyJfzce5k98KjTYgWH0fhfze8qMD3ZeWSC8W8sTWhFHlCkmuZzFjXjlWnyTxuWbQ7k1iHYnZiuQUQ8heEALRifSA74pcatWw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
accept-ranges: bytes
cf-ray: 6b6b4c4e5bcc145a-FRA
expires: Tue, 28 Dec 2021 01:34:22 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 16 KB
16 KB 180ms
96ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700%2C300%7CRoboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900&ver=9.8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 14:02:00 GMT
x-content-type-options: nosniff
age: 70119
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 30 Nov 2022 14:02:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 209ms
126ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 13:39:48 GMT
x-content-type-options: nosniff
age: 417051
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 26 Nov 2022 13:39:48 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v27/ 47 KB
47 KB 221ms
148ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 13:44:20 GMT
x-content-type-options: nosniff
age: 416779
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47836
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:32:23 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 26 Nov 2022 13:44:20 GMT

GET
H2 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 214ms
165ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 13:21:56 GMT
x-content-type-options: nosniff
age: 418123
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17304
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 26 Nov 2022 13:21:56 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 184ms
140ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 17:56:19 GMT
x-content-type-options: nosniff
age: 574460
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 24 Nov 2022 17:56:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 153ms
153ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:54:46 GMT
x-content-type-options: nosniff
age: 59753
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15724
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:37 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 30 Nov 2022 16:54:46 GMT

GET
H2 200 photon.min.js Show response
c0.wp.com/p/jetpack/10.3/_inc/build/photon/ 758 B
425 B 8ms
7ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/10.3/_inc/build/photon/photon.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Tue, 31 Mar 2020 17:26:38 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 regenerator-runtime.min.js Show response
c0.wp.com/c/5.8.2/wp-includes/js/dist/vendor/ 6 KB
2 KB 8ms
7ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/dist/vendor/regenerator-runtime.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Wed, 23 Jun 2021 00:06:13 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 wp-polyfill.min.js Show response
c0.wp.com/c/5.8.2/wp-includes/js/dist/vendor/ 16 KB
6 KB 8ms
7ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/dist/vendor/wp-polyfill.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Mon, 14 Jun 2021 23:18:11 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H3 200 index.js Show response
befonts.com/wp-content/plugins/contact-form-7/includes/js/ 12 KB
4 KB 19ms
18ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0ba7e2275cddbdf3d2473a60565d950efb8474ba7bda393cc64f56ff39d85ce

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1650207
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Fri, 12 Nov 2021 07:06:21 GMT
server: cloudflare
etag: W/"618e126d-2e56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FbSRAIp1ser9h694JXdUE7NcNEjEffE9wct0lHsotZ06AwPbZLUMbXYJH1VPrJD%2BvjkxAxZwv60InDdLzWgO%2BCohzY73d2En%2B%2FGahaFR%2FkPPzOwpgf2%2BKmjiwLIZ6MGwLGuayaLhrCdU6A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f5ce8145a-FRA
expires: Sun, 12 Dec 2021 07:07:12 GMT

GET
H3 200 custom.js Show response
befonts.com/wp-content/plugins/menu/js/ 17 KB
4 KB 22ms
22ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/menu/js/custom.js?ver=5.8.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bff9bb8f945de66dabd8b5c43aabf279b91c6033c80def87cb19a46058204bfb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1748542
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Wed, 01 Jul 2020 12:43:48 GMT
server: cloudflare
etag: W/"5efc8504-44d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wg%2F5JqJ7rO8jhYwxOLq%2BgXJVK%2BYljNh8OmH%2FMkL2vJnsTr1%2FzpWAmb3cSDs6DyI4wTnVVfn1f%2B2P3T62hkAleYXZB2HgBssAbfsMPdMHKBGnu3%2B1uEFRGcS%2FfUqAhOttbfzsItXMFYE3%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f5cea145a-FRA
expires: Sat, 11 Dec 2021 03:48:17 GMT

GET
H3 200 hocwp-plugin.min.js Show response
befonts.com/wp-content/plugins/menu/font-demo/js/ 960 B
1 KB 17ms
16ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/menu/font-demo/js/hocwp-plugin.min.js?ver=1.0.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83508e18f3a437cc6dcff25f68ed0cb57f2cbb25a53a40ab4be6ff4265c2e9bb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1664490
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Fri, 31 Jul 2020 15:05:02 GMT
server: cloudflare
etag: W/"5f24331e-3c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E9r3lRXYqagTq5T6gRpvBT%2BPGnGCVa62wjQCfJXngukdbtynAviotyi8qIeT%2FwMWjhsooLEwWFovNoeRswkktLO16xyLf1II42We36dV697ilM4hQauNcsnMNYAxfm81%2BIZ1W6H23NJBYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f5cec145a-FRA
expires: Sun, 12 Dec 2021 03:09:09 GMT

GET
H2 200 underscore.min.js Show response
c0.wp.com/c/5.8.2/wp-includes/js/ 19 KB
7 KB 9ms
5ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/underscore.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5dacc86b8a64742e60d70192353e5643da219a3f84c0b26cf6116b06b67fff32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Thu, 27 May 2021 19:33:19 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H3 200 js_posts_autoload.min.js Show response
befonts.com/wp-content/plugins/td-cloud-library/assets/js/ 5 KB
3 KB 27ms
25ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/td-cloud-library/assets/js/js_posts_autoload.min.js?ver=489325fca4f12cbec6ded350cf173551
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7dadf41d55487432b3b4f5db5e8ed8a757ad7d295b1570567d2d2fc6929bd24f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 362986
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sat, 21 Nov 2020 08:40:10 GMT
server: cloudflare
etag: W/"5fb8d26a-13c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RIhGIFM5W7NQsTNJDaG4SSXCFF96SnM%2B%2FJxLYPBKJ3aGFtOLRyZoM71HaY811s1%2BisKhVMvump3sDZS5xUl1VzkAIAUdN%2Fqe1bbROQjminsfzme4P4ciIF3hUuSL8ueb9%2BrOmXsM6s9%2F%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f6cee145a-FRA
expires: Mon, 27 Dec 2021 04:40:53 GMT

GET
H3 200 tagdiv_theme.min.js Show response
befonts.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 223 KB
53 KB 28ms
26ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=9.8
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e8a9f91efa071fef1ae36b2178873b6c92e16a7d4a1087468e85609c2e68d85

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1664490
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sat, 21 Nov 2020 08:40:00 GMT
server: cloudflare
etag: W/"5fb8d260-37bf7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iXVDc4rKZwE5r3KBC2d6wlCI%2B7S2zhVQ5g3XKdrpkiizteqkY7ZLLsp8%2B7yAQl2s%2FSCBBeRip8k%2FuEYfFDdHs7%2FvXl7dedsi%2FXISTzn509nPAki%2FccrHmOCNF2FaA7PR2Jc%2Bp40mv9h7ig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f6cf0145a-FRA
expires: Sun, 12 Dec 2021 03:09:09 GMT

GET
H3 200 global.js Show response
befonts.com/wp-content/plugins/menu/font-forum/js/ 1 KB
1 KB 15ms
12ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/menu/font-forum/js/global.js?ver=5.8.2
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac5fb0841050b936e4d58316749254173e8015ad96335cf0cf68d597c902ae02

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1748542
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sun, 28 Jun 2020 05:21:26 GMT
server: cloudflare
etag: W/"5ef828d6-459"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fiyTJHdTVSw5%2FrRctFSCNTAfaN9hzwpf3k7z5gPWO2H%2FwfnPXa4K8%2FUo8M5xsEgGwxt%2FrINxY0hVJlDsOOxYMhe3CeRecQ9vwjKS0K6k%2FpQKyatPIuUIk6adRoT4Bkla4xIwyh%2FQw8XxVA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f6cf1145a-FRA
expires: Sat, 11 Dec 2021 03:48:17 GMT

GET
H3 200 js_files_for_front.min.js Show response
befonts.com/wp-content/plugins/td-cloud-library/assets/js/ 13 KB
4 KB 27ms
25ms Script
application/javascript 2606:4700:3037::6815:276d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://befonts.com/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=489325fca4f12cbec6ded350cf173551
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:276d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 280532fe6539a1a9a19081c6e9dca5cc230254656b01c2314ea71472d7e8a89b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 960297
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
pragma: public
last-modified: Sat, 21 Nov 2020 08:40:10 GMT
server: cloudflare
etag: W/"5fb8d26a-3300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CtEcg6EW%2FV6kjDbmwwUimbO1dF2bU7%2FMLhqdCHc2TVsgLVQiDpla9mRyu8wZCbQoLWtg1%2BhTLHlbV4CSRhJa1eIt9ck1O%2Bp9ejKTdM1GcGnkw8cmZHfhqEgGGkESLcr%2Fp9XrihpAtr8wnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=16070400, must-revalidate, proxy-revalidate
cf-ray: 6b6b4c4f6cf3145a-FRA
expires: Mon, 20 Dec 2021 06:45:42 GMT

GET
H2 200 wp-embed.min.js Show response
c0.wp.com/c/5.8.2/wp-includes/js/ 1 KB
719 B 8ms
6ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8.2/wp-includes/js/wp-embed.min.js

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Thu, 01 Dec 2022 09:30:39 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 136ms
52ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-57630082-1

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

90fb70f98dd7b7f011baa9002b340df095db7cb97639e1124f1926a2472dd514

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36130
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 01 Dec 2021 09:30:40 GMT

GET
H2 200 e-202148.js Show response
stats.wp.com/ 9 KB
3 KB 22ms
6ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202148.js
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn
date: Wed, 01 Dec 2021 09:30:39 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 21 Nov 2022 07:46:06 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 201 B
638 B 150ms
54ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=befonts.com&callback=_gfp_s_&client=ca-pub-1300413371050000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111160101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1300413371050000&plah=befonts.com&bust=31063796

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

b1c08ca00d0b9cdc2e67d9d4461dbe17a2e8e0b54ec04903c9f69627de87d2a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 147ms
52ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=befonts.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 140ms
46ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=befonts.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5F7B 214 KB
50 KB 989ms
941ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&adk=1812271804&adf=3025194257&lmt=1638351039&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039558&bpp=3&bdt=384&idt=348&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3377099533986&frm=20&pv=2&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=378

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ce10690714f9021ac0c16a8a43e60f4f00efeff077f83e7b0eff8c9e91e0a13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 09:30:40 GMT
server: cafe
content-length: 50844
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 09:30:40 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DA7D 74 KB
30 KB 819ms
801ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67741332076acce5d1cac66fb622734bf000a22ce0022e056b8d681b8faad4a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 09:30:40 GMT
server: cafe
content-length: 30268
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 09:30:40 GMT
cache-control: private

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CC0C 22 KB
8 KB 90ms
40ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 29 Nov 2021 12:44:40 GMT
expires: Tue, 29 Nov 2022 12:44:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 161160
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ 0
23 B 115ms
71ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://befonts.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:40 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 g.gif
pixel.wp.com/ 50 B
116 B 7ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.3&blog=80792413&post=0&tz=-7&srv=befonts.com&host=befonts.com&ref=https%3A%2F%2Ffirsturl.de%2F&fcp=1762&rand=0.5977613922136698
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 01 Dec 2021 09:30:40 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H3 200 KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2
fonts.gstatic.com/s/roboto/v29/ 17 KB
17 KB 87ms
40ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOjCnqEu92Fr1Mu51S7ACc6CsQ.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a938256d2de59b044f8ca7c7aa0c788ed2ffa9a48bf0e3930a5830c4298f509

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://befonts.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 13:16:23 GMT
x-content-type-options: nosniff
age: 418457
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17380
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:24 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 26 Nov 2022 13:16:23 GMT

GET
H2 200 /
secure.gravatar.com/avatar/ 1 KB
2 KB 26ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/?s=80&d=mm&r=g
Requested by: Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4faa1d5635283a0d49e1933de318b24491751c9a3ccf2fe404b9137929e3eb86

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Wed, 01 Dec 2021 09:30:40 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="none.png"
accept-ranges: bytes
link: <http://www.gravatar.com/avatar/?s=80&d=mm&r=g>; rel="canonical"
content-length: 1323
expires: Wed, 01 Dec 2021 09:35:40 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 123ms
39ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-57630082-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 1773
date: Wed, 01 Dec 2021 09:01:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 01 Dec 2021 11:01:07 GMT

GET
H3 200 IDpL2rJiZrNY3rYqo4eIGDY6phXtx-GzYRENHMIWWlE.js Show response
pagead2.googlesyndication.com/bg/ Frame CC0C 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IDpL2rJiZrNY3rYqo4eIGDY6phXtx-GzYRENHMIWWlE.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

203a4bdab26266b358deb62aa3878818363aa615edc7e1b361110d1cc2165a51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 07:39:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 93091
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13371
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 07:39:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CC0C 0
20 B 75ms
75ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BorV7v0CnYaHsJdWjgAfW5IaYBAAAAAA4AeAEAg&bg=!CQqlCk7NAAZQLpa_UC47ACkAdvg8Wk8G9qYQbELLoR7BMQnpNrr_fymJMU3jjlUGao9PfJXvPs29jwIAAABUUgAAAAtoAQcKALmZnMRKsy8N5G3j4yID7TZpdcXGQrWabgmFDSWd8ix1xpRwTmZ0522n46Z9xzvE4niKYS61gvvJ1kM9LKSPRS21ALRUxy-8Aq50WaXAZpvoPCWh8g21YPUE6hJo-YVOCv3Wpm9pKNpgkXjMWHnlsn398aT3l05iAW6sDZeSvpQ_L-E_vnqHqrUse0w0l6P78IFBL3HLEu8rZRO0Wiyc7u7sWjKChKENjaAu0ppdQvWI_vDV3c2tuMPldJkCiPRY6aEjV4rXTF_E3rURjmCo8X4-LnWQnqUCFS9vmWnjfcOl3l80wnPsEWIPekjhrpU-3oehXlK_nriyF48DeBIuwkIgqS_pP645D40RUbkI8jqKor5EFyGUa5hYQAxonMwbjtZDTPqIPRFya5uQNH_aHvvtcRHYfTRhqu1kWTav4-4CWe1IdPY_0_mHN8i6tnptelE9-TET-e6reKIymY6wV9Ik9Lv-Yzx6axzwEGsBlpb0rV6q0JPAfLpJqUm09ne5GkEtd24VU7FpciFASCN47BzqbFfAKWmgyHxIaeCPRqfc-zfMZelRTs4g5ABozIExbYv52Rc5Zy_gGERqCI9azVDBrBKLNlqXEOKXidPJh5oK30cUabnadgo72LBpTGe7EHt5JEKEMbIyj-yw_amG6bkPCZC7SaZZK7hyW2WDvQoLNxrvAYI7U-d1LkgEn4IIyaeXrhjO36Q-ZGYXzKLQtTCXyNpfgWMNmOkk2JmE8ADAoRWrU_bBxO_vuytthJCfCbSqOTmAgsk4LKQdtmZeY5O0kYugQkgghaihLI8B1rSIt26LDbVHZNKql5BEE3U0oJrbAJEgn7ql33H7D1r15Rv7c-f51s-w5MMN-CFEESmfXR1eacJw1Yl4T4rr-rPNsdHtCRf_E43geHqrPtjawh_kW6rm49--_J3JGJMmEgqvYBuR-ZzW-sZhUJ1jUida4ZYLRC2UUHWKkbQTP8QsS8IrLUgKI5ZBcSTwE-Hgl_7LlfEmZMPj2PRHg4ZJcrFe1Ouwh5OZqQ2nYZcZ619UCIt35nhL8wlBxLsH_z8pBYgFrQF7W5otsibOv_3tIEJj5QTNfYCv7dk6OqzHjJxTd-hfcTMYhQ

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 93ms
46ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1492872379&t=pageview&_s=1&dl=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&dr=https%3A%2F%2Ffirsturl.de%2F&ul=en-us&de=UTF-8&dt=Download%20free%20fonts&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=322555499&gjid=627591681&cid=1308547740.1638351040&tid=UA-57630082-1&_gid=948807512.1638351040&_r=1&gtm=2ouba1&z=1809829719

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://befonts.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://befonts.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
439 B 57ms
19ms XHR
text/plain 2a00:1450:400c:c07::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-57630082-1&cid=1308547740.1638351040&jid=322555499&gjid=627591681&_gid=948807512.1638351040&_u=YAhAAUAAAAAAAC~&z=1511473368

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://befonts.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 01 Dec 2021 09:30:40 GMT
content-type: text/plain
access-control-allow-origin: https://befonts.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 112ms
63ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-57630082-1&cid=1308547740.1638351040&jid=322555499&_u=YAhAAUAAAAAAAC~&z=1869209119

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 149ms
62ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-57630082-1&cid=1308547740.1638351040&jid=322555499&_u=YAhAAUAAAAAAAC~&z=1869209119

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 13924605647384150551
tpc.googlesyndication.com/simgad/ Frame DA7D 22 KB
22 KB 41ms
41ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13924605647384150551?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmw2GILQi2m1qcCzN4JH0iJ_LlUjw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be2e04cecbcfd781b640159d04691b2add96725759f769d0a253727dd74b3c2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 15:50:20 GMT
x-content-type-options: nosniff
age: 582020
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22095
x-xss-protection: 0
last-modified: Mon, 27 Nov 2017 05:43:16 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 15:50:20 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame DA7D 19 KB
8 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:22:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 518
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:22:02 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame DA7D 2 KB
1 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:29:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:29:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DA7D 119 KB
36 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 09:30:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame DA7D 15 KB
6 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:17:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 793
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:17:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DA7D 0
0 47ms
46ms Image
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQyLtI2YMUauUdmALxLSJi1u5vk15agc1YOBDmhxH4ZHBOoxKLqies_anJ32ylrlGjC2QUZg1F4LqgdEXV6sWUm0RE6_Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame DA7D 27 KB
11 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 08:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3502
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11327
x-xss-protection: 0
server: cafe
etag: 10656063359522146397
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 08:32:18 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DA7D 0
0 80ms
79ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CWVHrwECnYdB5lYnuA6zssJgO9ae_9FyM8cHexwvAjbcBEAEg8ezqIWCV4pCCoAegAfmSlbkDyAECqAMByAPJBKoEgQJP0Cde4hTFurUOeXma2ZYxV3PjjSAo9MTR8TBZQV9BNiwAyNnHsYC7VvitNYFVp2dtQXT-2KCj69-EAADzWcEfjyQYq1Ld34eSyze1Xk55qwPNChLL_PB7ND8mKnD6AptgxKB3mjToBtFEvC3ms6A88fr_C5Hm2ZRFMO7EWqU-MWXuJEEXOYpITYN6TPUzFR_BnBykWK167KGXfOQnMljwUUzveSoULWTEZPyQmQV2T3cawZLIm9vY4xcmSUoN4rPHkyO4Xpjiume3b9Sigqe4MfSUax7Jd8zbaOPDeKpDlrOg99geNhY2VNsiIRTHuUzKoiDVirLu5Rw_-3G0uLd93sAE_-TQ39oCkgUECAQYAZIFBAgFGASgBgKAB-_s6kaoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDV-BHSCAkIgOGAEBABGF-ACgHICwHYEwzQFQGYFgGAFwGyFxwKGggAEhRwdWItMTMwMDQxMzM3MTA1MDAwMBgA&sigh=TDneC0nh6Vc&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 01 Dec 2021 09:30:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A06D 143 B
163 B 40ms
39ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 01 Dec 2021 09:02:16 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1704
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 redir.html Show response
p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 4F48 247 B
962 B 177ms
47ms Document
text/html 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

sffe /

Resource Hash

5d5af0ceaded3d0d43f6651503403a2d53942daed04a069bbfcbbf0cd888898e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-VWx0t1UT00w4cpKiFZxIhw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 204
date: Wed, 01 Dec 2021 09:30:41 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E108 1 KB
749 B 40ms
39ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 13:26:12 GMT
expires: Wed, 01 Dec 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72268
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame DA7D 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 70760176d11e5a94c62df4a39140e91f895a0eac3f70ad8807ea60f6314bb857

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E108
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESENqvQcb3awd21QgMw7smfSE&google_cver=1&google_push=AYg5qPJnDRWfzhJ-s8vO46UFlURLuq9XLpFI0Qqwhpg9SiZWKffJI2ryR7LCQYdB9inAlqZ9WjAIX9ayXKAl7yuq8_sUBjjgnzDALw
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnDRWfzhJ-s8vO46UFlURLuq9XLpFI0Qqwhpg9SiZWKffJI2ryR7LCQYdB9inAlqZ9WjAIX9ayXKAl7yuq8_sUBjjgnzDALw&google_hm=Q0FFU0VOcXZRY2IzYXd...

170 B
232 B

60ms
59ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnDRWfzhJ-s8vO46UFlURLuq9XLpFI0Qqwhpg9SiZWKffJI2ryR7LCQYdB9inAlqZ9WjAIX9ayXKAl7yuq8_sUBjjgnzDALw&google_hm=Q0FFU0VOcXZRY2IzYXdkMjFRZ013N3NtZlNF

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 09:30:41 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPJnDRWfzhJ-s8vO46UFlURLuq9XLpFI0Qqwhpg9SiZWKffJI2ryR7LCQYdB9inAlqZ9WjAIX9ayXKAl7yuq8_sUBjjgnzDALw&google_hm=Q0FFU0VOcXZRY2IzYXdkMjFRZ013N3NtZlNF
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E108
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLrzUp3rivy_JyczoI3M6nXlRtLKr1N1BTHDGutHtnjzABEh1ixoAOpX63D3MvFTV2pOz5Wp8AFIImAC4XBrGafrA3NQqy0GA&google_gid=CAESEGztbc4kLGDy0PmA3qh8XXo&g...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCMGBnY0GEgUI6AcQAEIASnJnb29nbGVfcHVzaD1BWWc1cVBMcnpVcDNyaXZ5X0p5Y3pvSTNNNm5YbFJ0TEtyMU4xQlRIREd1dEh0bmp6QUJFaDFpeG9BT3BYNjNEM012RlRWMnBPejVXcDhBRklJbUFDNF...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTnRjTGNwNWhTZGk0RzF5dzB5UXVyYU5rVXJXTlh3M21LS1JqWHExVXZNVQ==&google_push

170 B
232 B

113ms
62ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTnRjTGNwNWhTZGk0RzF5dzB5UXVyYU5rVXJXTlh3M21LS1JqWHExVXZNVQ==&google_push

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 01 Dec 2021 09:30:41 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwTnRjTGNwNWhTZGk0RzF5dzB5UXVyYU5rVXJXTlh3M21LS1JqWHExVXZNVQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E108
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLBQ0AM...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLBQ0AM...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwOTMwNDEwMDA3NDMwNzMxNjA4Nw%3D%3D&google_push=AYg5qPLBQ0AMudiZ0uzTzmNNmbe5bgmal2Pnp1Slhtr-hSuL2oh54wrGLAGo1b3Lxc35Oh...

170 B
188 B

50ms
49ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwOTMwNDEwMDA3NDMwNzMxNjA4Nw%3D%3D&google_push=AYg5qPLBQ0AMudiZ0uzTzmNNmbe5bgmal2Pnp1Slhtr-hSuL2oh54wrGLAGo1b3Lxc35OhABksxSwO1OCeerVsGD-2arluLImwEigg

Requested by

Host: befonts.com
URL: https://befonts.com/checkout/redirect?url=https://winvio.com/australia/

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTEyMDEwOTMwNDEwMDA3NDMwNzMxNjA4Nw%3D%3D&google_push=AYg5qPLBQ0AMudiZ0uzTzmNNmbe5bgmal2Pnp1Slhtr-hSuL2oh54wrGLAGo1b3Lxc35OhABksxSwO1OCeerVsGD-2arluLImwEigg
pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 01 Dec 2021 09:30:41 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E108
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEC6pNUYjssMjU1M5ltCZYdE&google_cver=1&google_push=AYg5qPK9U16h6cSYs8-gyV6FAEeDR0onrNr6MshpI-3-4NFm_XtuvrLVBEiH16cqNTwSXZ3qIB6...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldQVlotWC1ESk9C&google_push=AYg5qPK9U16h6cSYs8-gyV6FAEeDR0onrNr6MshpI-3-4NFm_XtuvrLVBEiH16cqNTwSXZ3qIB6dwZuaoMFe5R0f4ioHlISq9tsN

170 B
329 B

158ms
59ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldQVlotWC1ESk9C&google_push=AYg5qPK9U16h6cSYs8-gyV6FAEeDR0onrNr6MshpI-3-4NFm_XtuvrLVBEiH16cqNTwSXZ3qIB6dwZuaoMFe5R0f4ioHlISq9tsN

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldQVlotWC1ESk9C&google_push=AYg5qPK9U16h6cSYs8-gyV6FAEeDR0onrNr6MshpI-3-4NFm_XtuvrLVBEiH16cqNTwSXZ3qIB6dwZuaoMFe5R0f4ioHlISq9tsN
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame E108
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGe...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame E108 43 B
296 B 200ms
19ms Image
image/gif 2a05:d01c:1d8:8102:a212:76ab:db1a:a790
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEITtEPrDiuYnN5iWOf2PLbg&google_cver=1&google_push=AYg5qPJ_h1kLIWpg7ZlcVr6p90MZhxs_zibHCvnTMv0RXIuWOQ1Uf8bcINjsvxzet2yNQcBXf7hVppZZW6sfHrKIVV92V9r4MXmw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=90&slotname=3384284819&adk=1499220787&adf=4081780680&pi=t.ma~as.3384284819&w=728&lmt=1638351039&psa=0&format=728x90&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351039727&bpp=100&bdt=553&idt=231&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1445&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=eT4AZBkTS9&p=https%3A//befonts.com&dtd=240
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:a212:76ab:db1a:a790 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame E108 0
223 B 241ms
59ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LrEIl9qu3HyHLPlrceza-CkWM-eWFXXpWO56QkfsLe0Cfd9M1VdHr_LSspPkJlUw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A06D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

106ms
104ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 09:30:41 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 09:30:41 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 09:30:41 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111160101/ 149 KB
53 KB 55ms
55ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111160101/reactive_library_fy2019.js?bust=31063796

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e6c8f949e02661b3f68f275b35ceef2012156821fcb84be814aee31665159d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54173
x-xss-protection: 0
server: cafe
etag: 17092756603932881105
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Dec 2021 09:30:41 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 96ms
49ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=befonts.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 97ms
49ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=befonts.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7073 94 KB
33 KB 661ms
658ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1300413371050000&output=html&h=280&adk=326101615&adf=792450558&pi=t.aa~a.4049935982~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1638351041&rafmt=1&to=qs&pwprc=4615830315&psa=1&format=1200x280&url=https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638351041047&bpp=2&bdt=1873&idt=2&shv=r20211111&mjsv=m202111160101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dd3c09f2daa8752a2-22c9e4241ccc0089%3AT%3D1638351040%3ART%3D1638351040%3AS%3DALNI_MZYWPGjpUgeCuW_BVJH5NXwVWluyQ&prev_fmts=0x0%2C728x90&nras=2&correlator=3377099533986&frm=20&pv=1&ga_vid=1308547740.1638351040&ga_sid=1638351040&ga_hid=1492872379&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1413&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063796&oid=2&psts=AGkb-H9lRKvgpmIa3CewCI_sjLFyEnhXCJykLBlUgACC7dP19pwLkxkBGxwHhKBFTEO07eDgQH3GyCfn70o&pvsid=1643903243423631&pem=779&tmod=339189260&ref=https%3A%2F%2Ffirsturl.de%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=lBHXh7toBu&p=https%3A//befonts.com&dtd=33

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

afa84bd950052260a86f737044431ba572f65ca46a9b96a074fbb0755019cc13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 01 Dec 2021 09:30:41 GMT
server: cafe
content-length: 33631
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ 42 B
64 B 122ms
74ms Fetch
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsseNkn_r8bVZVFl8BDHGXeLWGMrsANZ_RBLJxGyZALsZikE5hUz2dMEpNc5e2h64EZClG0z2CH9GvmsM0pp5MA&sig=Cg0ArKJSzMzhxRP_FnUXEAE&id=lidar2&mcvt=1065&p=0,436,90,1164&mtos=1065,1065,1065,1065,1065&tos=1065,0,0,0,0&v=20211110&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=32&adk=4042925164&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638351038099&rpt=1916&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/ Frame ED04 11 KB
5 KB 41ms
39ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 11:15:29 GMT
expires: Tue, 14 Dec 2021 11:15:29 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 80112
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/ Frame 1BB9 11 KB
5 KB 41ms
39ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://befonts.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 11:15:29 GMT
expires: Tue, 14 Dec 2021 11:15:29 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 80112
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 iframe.html Show response
p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 4F48 4 KB
2 KB 89ms
44ms Document
text/html 142.250.74.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f3.1e100.net

Software

sffe /

Resource Hash

05d92881b407753e93199f39ecd666b60607b063499e08abba008563ac34193f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
content-security-policy-report-only: script-src 'nonce-PMDSofFB4QtHbg47ie9Bug' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-length: 1861
date: Wed, 01 Dec 2021 09:30:41 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
last-modified: Thu, 29 Apr 2021 21:38:00 GMT
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css2
fonts.googleapis.com/ Frame ED04 4 KB
634 B 93ms
47ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 07:44:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 09:30:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 09:30:41 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame ED04 205 B
229 B 86ms
39ms Image
image/png 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 09:43:30 GMT
x-content-type-options: nosniff
age: 85631
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 30 Nov 2022 09:43:30 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame ED04 604 B
628 B 85ms
39ms Image
image/png 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:02:01 GMT
x-content-type-options: nosniff
age: 1720
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 01 Dec 2022 09:02:01 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame ED04 18 KB
8 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:26:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8141
x-xss-protection: 0
server: cafe
etag: 15959965552278146708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:26:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B89E 624 B
297 B 51ms
50ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjX0-alATAB&v=APEucNVPc12Reo7ZJ6OAUfFnNftZDV87YI_VGrskDtBFNzQbXOOqIRrZ4_kL8hykX85pQBCDho1w-NIOzGSXleDdigUMMj9cxKy4I_vS6NzahbbYas91XfofuL02qE_O5RufHpPYZiRoPvdtxPbhqWyaOdXnMeo-V6ctwR7od3dUIoGgokvRJ24

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 01 Dec 2021 09:30:41 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 129C 25 KB
14 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C8hYksr6YV1trh4F6lomU_J4JADaCvNC8By6VjrPrPQ-skf81Kd7us-Bxbc0gH89I1TW5NBGHsy7mFfUHdB6HzuMWWnHOr7TuJ6-mhSX2aULO4e-om2SPLAdNA3t_XAeJYwDPDGWOui4cbEZcOnyy57neung&cry=1&dbm_d=AKAmf-BYh_HPX6XAITNMPy0GY582Bu9OjmOQcmhHTs04wSgpc5U4Z13ERFku_eIyJhxd_rsMf-YNvOsXESS5rjC-7wAWJ2iWE3s3Sc_1OYibdH74yxIVz5BbVhhsh5aSJlwAzEDi4XtkR3Su5sRdXtBSaqcW7kVqbqowcKo_uept5GIyoamuaD5Y1MESao37ze8354GCmu89kuJYtfNcO26YU6UqzhedVMGuM51SXbG4ZQ5g72tmxT0wSM-3W6OB-f4Le7eSUftDdcebo_acO8dNb8xNfu2SUBW_qutcZQJTRA7mQP6YxcoUuB5FZexKAtf4F5aUHcGYrNgEzk7OzPcZY5G5TLcqDjnajtpV89JCKRhJuGYmJeXw2jxhZZa3m07wYyugDoo5c-qlVTkX2_6hcmUlXgHQBMlEOYttLheucZUttgl8VwnmhUQt7LMVPOqi1261vri71xj_joCj9VEb4PoJBFwV2UL_eoOMr_vM55UnH_OT-hsz-oyQfYhJrAVAXdOJF-dh76_DCnQWgAVkZ81lvAN8ATgX6Yd07eeR6x7Qmlv_wI4ysFzNSFRCdPW0L96CRE7KdJ7XBpAUzMHIItSMjCu8-P32FG0ba9bIDSQqoOCI4aDDPtJq1wugS-7f7_Or51oDJpy_YxBs4zcHXKTpYPAiZgFMkEXisDKxB7YNd53mopBYN77hHKy3NYqJ7w5vDS4gGXkIBswmt0hidXtz9DK-aNdVU4oxxFCnmUflHIe-pkIe-odAAuCJscUNKOFSEiSDX3zOGZdNEM0akrTGd0Vn_VV-uSldLT909HRGXSvssI6MsIlWVvmgxuyiKFpemSszjgGoc7PttvabUeZwpsebRV_GGuemU1ZMofDk-mL03NP_4VIn_uDca0t_z8hKNj5i8uJ1jIQok_rQaruYyHhssoq4y5yfq5Ej-P_9EpcRVEiXoCRbwALdCMc614cfI8HeKVpV7z-aMejbMXeGIJfR82ntaunHaiSkaLw9fIExyQtJcTKNWepNQkiqOGZhOIJ63xiLKznFCp9n6ra9D_L6shNcrkyTss7p1cOfy0kKsyA-KJIfHrUL0qvGXEAdb-tugdsXKh00pFgf4RKLLxPNkafsxG2I9rf8FESamwi1j3aKVciDGyUE2FdvOwUnHxgEOJBBAiwqV4jAzmecjWXMfvPhtjpuMhmsVPTQyN_3Ezm7plgpVScdlbAiZxkEG-MN2PSx_H6F74Nz8v-2qIF6tnkHxI-HkqCP3CxSNxtjmVvfhTs2XkgYxzWMSjdYydaQFm2LSFsJNdzKuxvDth0m3qi44UxMSt9ha-eZJz4wgUD5ITbvmoqPyAUvcfzen1HrIczOX6u23cwO-rnViqkeL5OpNviDzT7FIwrxXa5TpurfUn7cCXNbpPbZXKHKQo_2NgYBXIDBJHKvxeNjwKFnrbNq0tCtQc9JHyAPyfytycHKVXJ83EZBeDebH6BMoP2fHLf1KKtnOlpF1ETJmF1_9kFT_LusOR4hmteLTps6hY2Auwfp1ApBXZAPidgM-GKIsCMzmzttiQhNjtOUl1X0DsOJyIpuPwGLYa80vaXSGmTtgcJj2VjpyLJJFkUzfWlpThmbziT8WspZ0pfYAX1oW_lUaJo1xVg64f6ojBMJSrDbaUrKzVGMMItHI0g2RRakY32EGqGv-hLIBcc9mWewhUhOSpsk8U52Jj-ZdM4EfHzy7kay3ma0EivXMF627nvAMMhdSS7-mx_brMvRdhIvgOH12vOgRIycWXAWOxHFO7sl75bx6rHsWYBPG4rMGnfsV7xTXoPiAu5qBQSTOEfXNYf6ftKdWDFD0ugl2l-rz3ZNsYLLvOn9y5r8ifPHCwrHQxSgKNt1VMPXxQs2BT3pg-DJ9EmbQpjQLMiEe3bpkfIv5Nd47JeADr_ChSZ59VfOmxsJws8tZpxgfdZYEqFdAScK0z4chFzamKC-y4yzvcc91F6CXbeM9vw8yAub5KCwLQMsNKgTKoa8AsEK5u2LEkrAA1IUg2LlU4-fvfy6h6w7l2LU1K3QmCPkvfX61x-i1pgRr7A5MTlF4mAvVJ86qg6Z9z6qHye3_bVw4-4VAsuVe1V_8FbeXpM6uN14u3V-6tN249kX89-ZGw9ht4O98FWAYI_RGCNwOZphBcDnMIY8wPJsPIQGC-2GAXGckrZtvMz43PgyWiUMHysz0o9bYfMgqj65WnsEVJoF6bC_QFnO3QNNOF1UxqaFwi3soqqC9lnYE_fmqbUhAq-sXH43tJemhIedFFefbOUEHnKFx_XxsMwwCoZmLX0qV7lOiPBkUCssdSaPeKHahZa9bsDxLeBTFmt-vde4-rVEc5k7I_JwrgJZWbsxNwNHnDktlF04pLrVP1NW0AYG1wpJK4s_682RjT5l4EbFdVjvLjzNLOXJdZeC6f2Tlp-AGBVK5ixFdLmunI4L-sxZpANxabYdAWdTBopXaPWHNIS49Jre7WEtNn-DeTyxmGmXIO1Q1knDUeZuy9wJ2zjECls4y-nF3jVZ8AQnIEHxnZGfQj5e-aWhsEGqh3Yt15TThGUrw1RdqcSCq7rZeFlfuAhrdQcU1fohHbm9ATdYpt98E0Z1taEZ_d6U9X1vIiWOiWJ7nwexBvi-H56A01EVFt3Zzsyp-mwEzG-SZZTFiy0z0rx_i31-4rl2DH8ZsZ9rX-8vPB_xJ7Oe-Ka8qVJmzGlYxlSp7cN1V-0IMHxw0PP-mdZXfHDRyj-QaaaeyHU6OtVwBsIqR56V-axEXCXv421reCtTPIWoJ0mQULHwSHyDldSg_s65tu2Xj9raAR7Z7usr-FfHs5mCdY8bKcblawaPc3X4AwOB5dqvI7oLCpQ4roS_HLhJYbgUsTpLagJ7w-q7s-Cyx6vnMFWZuK1mohuU-q-f5ut-XJYCCfvbUoJIPKwYehPOqrdEjGoF4brgAbZrtO39jDQ6uk2sUsIV-8NUCJyPegVx84YgECubQzW9sld2q-5F194gsljAAkIPSrNokKIWKUWPSBsSphGt-YVhuMyXmYKAtb_HcGAYgt-OaEyYVmXSgAi48QU9b5TNhK3e65Aea0YlzmsLdXZZ1ubDnCBqoUyi9KcMXzz8Ox00kjHhhcb26WZWkgNgg76xRkcdxvBXB1A-KhDGz2ohsmBR3giezOctmGyrEE31Uck1HR5cMjWTgEu5etQAK_yQZ7TSlk_72Tb6O3GDLFtxz3wPNbiIXGPVvPLoezTHxHyd94fQfWI&cid=CAASEuRovV4a41nUILyScpBq48akEw&rfl=2%2Chttps%253A%252F%252Fbefonts.com%252F%240

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0a825c68a5174d54ddb3579743a0574c6ee6f569f0016a8b7fd431061dcf91c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14775
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 129C 2 KB
1 KB 161ms
6ms Script
application/javascript 2a02:26f0:7100:480::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115739&plc=4253581&sid=18330&dvregion=0&unit=728x90&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jw6vG1CMlUGDgeWFMNcZ1M&DVP_DBM_1=3060631&DVP_DBM_2=11796640&DVP_DBM_3=32180595&DVP_DBM_4=347711959&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=101946468970&turl=https://befonts.com/checkout/redirect&DVP_PP_BUNDLE_ID=
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:480::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 44216edbcf372158d065f2c7062712c9c829648c355066e7cd14242843005d81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:30:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Nov 2021 13:07:12 GMT
Server: Microsoft-IIS/10.0
ETag: "e066f48b4dbd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1168

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 129C 8 KB
4 KB 161ms
7ms Script
application/javascript 2a02:26f0:7100:480::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0jw6vG1CMlUGDgeWFMNcZ1M&DVP_DBM_1=3060631&DVP_DBM_2=11796640&DVP_DBM_3=32180595&DVP_DBM_4=347711959&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=101946468970&turl=https://befonts.com/checkout/redirect&DVP_PP_BUNDLE_ID=
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:480::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 8b94cbe5296254e6bc2199c7099b21f9308583e421f3b5204166eb9bbf19cc58

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:30:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 Nov 2021 12:39:48 GMT
Server: Microsoft-IIS/10.0
ETag: "0424488f9e1d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3291

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 129C 2 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:29:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:29:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 129C 119 KB
36 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 09:30:41 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 129C 15 KB
6 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:17:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 794
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:17:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 129C 0
0 47ms
47ms Image
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSKNbS6Nnau_W4iHmeYkxBSjozQijsJkEBnGrAkcKRXrOVYjT4iCO1jdY7HNNNryhZeQ4aKmlJ3cvL-GD-GcTNbbD0Kkg
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 129C 42 B
63 B 73ms
73ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BNkUJgim_yCsqGV9zGFYLNif_6y4EVPbMPngsae4PHuK_nndjDh-h7nHrmWYqDTQoV697ul2xzz5pIVWZkIbPNp-uS5sETXjddtGGK5v7x4bhxb7o

Requested by

Host: firsturl.de
URL: https://firsturl.de/1zRYNeA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4CDB 3 KB
579 B 48ms
48ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 01 Dec 2021 07:46:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 01 Dec 2021 09:30:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 Dec 2021 09:30:41 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4CDB 1 KB
880 B 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:25:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:25:41 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 4CDB 19 KB
8 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:22:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 519
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:22:02 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4CDB 2 KB
1 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:29:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 88
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:29:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4CDB 119 KB
36 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 01 Dec 2021 09:30:41 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 4CDB 15 KB
6 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:17:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 794
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:17:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4CDB 0
0 47ms
46ms Image
text/html 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaStz6EFxpZK8QX3zw75tx13jtQSXQcHFcrWNTbmHd14zIB8MsVtFYAnXMDrhG7oVB3qKssWNSJZjMGl9e8FeEAd2gzu4Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame 4CDB 27 KB
11 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 16:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 28 Feb 2022 16:53:57 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 129C 24 KB
9 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C8hYksr6YV1trh4F6lomU_J4JADaCvNC8By6VjrPrPQ-skf81Kd7us-Bxbc0gH89I1TW5NBGHsy7mFfUHdB6HzuMWWnHOr7TuJ6-mhSX2aULO4e-om2SPLAdNA3t_XAeJYwDPDGWOui4cbEZcOnyy57neung&cry=1&dbm_d=AKAmf-BYh_HPX6XAITNMPy0GY582Bu9OjmOQcmhHTs04wSgpc5U4Z13ERFku_eIyJhxd_rsMf-YNvOsXESS5rjC-7wAWJ2iWE3s3Sc_1OYibdH74yxIVz5BbVhhsh5aSJlwAzEDi4XtkR3Su5sRdXtBSaqcW7kVqbqowcKo_uept5GIyoamuaD5Y1MESao37ze8354GCmu89kuJYtfNcO26YU6UqzhedVMGuM51SXbG4ZQ5g72tmxT0wSM-3W6OB-f4Le7eSUftDdcebo_acO8dNb8xNfu2SUBW_qutcZQJTRA7mQP6YxcoUuB5FZexKAtf4F5aUHcGYrNgEzk7OzPcZY5G5TLcqDjnajtpV89JCKRhJuGYmJeXw2jxhZZa3m07wYyugDoo5c-qlVTkX2_6hcmUlXgHQBMlEOYttLheucZUttgl8VwnmhUQt7LMVPOqi1261vri71xj_joCj9VEb4PoJBFwV2UL_eoOMr_vM55UnH_OT-hsz-oyQfYhJrAVAXdOJF-dh76_DCnQWgAVkZ81lvAN8ATgX6Yd07eeR6x7Qmlv_wI4ysFzNSFRCdPW0L96CRE7KdJ7XBpAUzMHIItSMjCu8-P32FG0ba9bIDSQqoOCI4aDDPtJq1wugS-7f7_Or51oDJpy_YxBs4zcHXKTpYPAiZgFMkEXisDKxB7YNd53mopBYN77hHKy3NYqJ7w5vDS4gGXkIBswmt0hidXtz9DK-aNdVU4oxxFCnmUflHIe-pkIe-odAAuCJscUNKOFSEiSDX3zOGZdNEM0akrTGd0Vn_VV-uSldLT909HRGXSvssI6MsIlWVvmgxuyiKFpemSszjgGoc7PttvabUeZwpsebRV_GGuemU1ZMofDk-mL03NP_4VIn_uDca0t_z8hKNj5i8uJ1jIQok_rQaruYyHhssoq4y5yfq5Ej-P_9EpcRVEiXoCRbwALdCMc614cfI8HeKVpV7z-aMejbMXeGIJfR82ntaunHaiSkaLw9fIExyQtJcTKNWepNQkiqOGZhOIJ63xiLKznFCp9n6ra9D_L6shNcrkyTss7p1cOfy0kKsyA-KJIfHrUL0qvGXEAdb-tugdsXKh00pFgf4RKLLxPNkafsxG2I9rf8FESamwi1j3aKVciDGyUE2FdvOwUnHxgEOJBBAiwqV4jAzmecjWXMfvPhtjpuMhmsVPTQyN_3Ezm7plgpVScdlbAiZxkEG-MN2PSx_H6F74Nz8v-2qIF6tnkHxI-HkqCP3CxSNxtjmVvfhTs2XkgYxzWMSjdYydaQFm2LSFsJNdzKuxvDth0m3qi44UxMSt9ha-eZJz4wgUD5ITbvmoqPyAUvcfzen1HrIczOX6u23cwO-rnViqkeL5OpNviDzT7FIwrxXa5TpurfUn7cCXNbpPbZXKHKQo_2NgYBXIDBJHKvxeNjwKFnrbNq0tCtQc9JHyAPyfytycHKVXJ83EZBeDebH6BMoP2fHLf1KKtnOlpF1ETJmF1_9kFT_LusOR4hmteLTps6hY2Auwfp1ApBXZAPidgM-GKIsCMzmzttiQhNjtOUl1X0DsOJyIpuPwGLYa80vaXSGmTtgcJj2VjpyLJJFkUzfWlpThmbziT8WspZ0pfYAX1oW_lUaJo1xVg64f6ojBMJSrDbaUrKzVGMMItHI0g2RRakY32EGqGv-hLIBcc9mWewhUhOSpsk8U52Jj-ZdM4EfHzy7kay3ma0EivXMF627nvAMMhdSS7-mx_brMvRdhIvgOH12vOgRIycWXAWOxHFO7sl75bx6rHsWYBPG4rMGnfsV7xTXoPiAu5qBQSTOEfXNYf6ftKdWDFD0ugl2l-rz3ZNsYLLvOn9y5r8ifPHCwrHQxSgKNt1VMPXxQs2BT3pg-DJ9EmbQpjQLMiEe3bpkfIv5Nd47JeADr_ChSZ59VfOmxsJws8tZpxgfdZYEqFdAScK0z4chFzamKC-y4yzvcc91F6CXbeM9vw8yAub5KCwLQMsNKgTKoa8AsEK5u2LEkrAA1IUg2LlU4-fvfy6h6w7l2LU1K3QmCPkvfX61x-i1pgRr7A5MTlF4mAvVJ86qg6Z9z6qHye3_bVw4-4VAsuVe1V_8FbeXpM6uN14u3V-6tN249kX89-ZGw9ht4O98FWAYI_RGCNwOZphBcDnMIY8wPJsPIQGC-2GAXGckrZtvMz43PgyWiUMHysz0o9bYfMgqj65WnsEVJoF6bC_QFnO3QNNOF1UxqaFwi3soqqC9lnYE_fmqbUhAq-sXH43tJemhIedFFefbOUEHnKFx_XxsMwwCoZmLX0qV7lOiPBkUCssdSaPeKHahZa9bsDxLeBTFmt-vde4-rVEc5k7I_JwrgJZWbsxNwNHnDktlF04pLrVP1NW0AYG1wpJK4s_682RjT5l4EbFdVjvLjzNLOXJdZeC6f2Tlp-AGBVK5ixFdLmunI4L-sxZpANxabYdAWdTBopXaPWHNIS49Jre7WEtNn-DeTyxmGmXIO1Q1knDUeZuy9wJ2zjECls4y-nF3jVZ8AQnIEHxnZGfQj5e-aWhsEGqh3Yt15TThGUrw1RdqcSCq7rZeFlfuAhrdQcU1fohHbm9ATdYpt98E0Z1taEZ_d6U9X1vIiWOiWJ7nwexBvi-H56A01EVFt3Zzsyp-mwEzG-SZZTFiy0z0rx_i31-4rl2DH8ZsZ9rX-8vPB_xJ7Oe-Ka8qVJmzGlYxlSp7cN1V-0IMHxw0PP-mdZXfHDRyj-QaaaeyHU6OtVwBsIqR56V-axEXCXv421reCtTPIWoJ0mQULHwSHyDldSg_s65tu2Xj9raAR7Z7usr-FfHs5mCdY8bKcblawaPc3X4AwOB5dqvI7oLCpQ4roS_HLhJYbgUsTpLagJ7w-q7s-Cyx6vnMFWZuK1mohuU-q-f5ut-XJYCCfvbUoJIPKwYehPOqrdEjGoF4brgAbZrtO39jDQ6uk2sUsIV-8NUCJyPegVx84YgECubQzW9sld2q-5F194gsljAAkIPSrNokKIWKUWPSBsSphGt-YVhuMyXmYKAtb_HcGAYgt-OaEyYVmXSgAi48QU9b5TNhK3e65Aea0YlzmsLdXZZ1ubDnCBqoUyi9KcMXzz8Ox00kjHhhcb26WZWkgNgg76xRkcdxvBXB1A-KhDGz2ohsmBR3giezOctmGyrEE31Uck1HR5cMjWTgEu5etQAK_yQZ7TSlk_72Tb6O3GDLFtxz3wPNbiIXGPVvPLoezTHxHyd94fQfWI&cid=CAASEuRovV4a41nUILyScpBq48akEw&rfl=2%2Chttps%253A%252F%252Fbefonts.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:23:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 422
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9475
x-xss-protection: 0
server: cafe
etag: 15988442915344899701
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:23:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 129C 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 12:44:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161161
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 29 Nov 2022 12:44:40 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B89E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1

43 B
894 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjX0-alATAB&v=APEucNVPc12Reo7ZJ6OAUfFnNftZDV87YI_VGrskDtBFNzQbXOOqIRrZ4_kL8hykX85pQBCDho1w-NIOzGSXleDdigUMMj9cxKy4I_vS6NzahbbYas91XfofuL02qE_O5RufHpPYZiRoPvdtxPbhqWyaOdXnMeo-V6ctwR7od3dUIoGgokvRJ24
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 09:30:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 01 Dec 2021 09:30:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B89E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YadAwYTIqhWjUk.VD1SUUQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1&google_hm=2

43 B
894 B

21ms
21ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjX0-alATAB&v=APEucNVPc12Reo7ZJ6OAUfFnNftZDV87YI_VGrskDtBFNzQbXOOqIRrZ4_kL8hykX85pQBCDho1w-NIOzGSXleDdigUMMj9cxKy4I_vS6NzahbbYas91XfofuL02qE_O5RufHpPYZiRoPvdtxPbhqWyaOdXnMeo-V6ctwR7od3dUIoGgokvRJ24
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 09:30:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 01 Dec 2021 09:30:41 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBjxCbAKQ6LG33EiSyYeWdI&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame B89E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEK6Q0JCv_lgvapNJWFnGRAQ&google_cver=1

43 B
1008 B

64ms
37ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEK6Q0JCv_lgvapNJWFnGRAQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARjX0-alATAB&v=APEucNVPc12Reo7ZJ6OAUfFnNftZDV87YI_VGrskDtBFNzQbXOOqIRrZ4_kL8hykX85pQBCDho1w-NIOzGSXleDdigUMMj9cxKy4I_vS6NzahbbYas91XfofuL02qE_O5RufHpPYZiRoPvdtxPbhqWyaOdXnMeo-V6ctwR7od3dUIoGgokvRJ24

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 09:30:41 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 0f549e88-0458-45de-b5b0-90d77adcacf9
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEK6Q0JCv_lgvapNJWFnGRAQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B89E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzMzNjkzNDYwODk4NTUyOTQ0NA%3D%3D

170 B
188 B

63ms
62ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzMzNjkzNDYwODk4NTUyOTQ0NA%3D%3D

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 01 Dec 2021 09:30:41 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e2a0cd07-c0bb-4725-bab9-9ef5ac5bb68d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzMzNjkzNDYwODk4NTUyOTQ0NA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK dvbs_src_internal100.js Show response
cdn.doubleverify.com/ Frame 129C 56 KB
18 KB 7ms
7ms Script
application/javascript 2a02:26f0:7100:480::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal100.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=1828362&cmp=115739&plc=4253581&sid=18330&dvregion=0&unit=728x90&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&prr=1&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jw6vG1CMlUGDgeWFMNcZ1M&DVP_DBM_1=3060631&DVP_DBM_2=11796640&DVP_DBM_3=32180595&DVP_DBM_4=347711959&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=101946468970&turl=https://befonts.com/checkout/redirect&DVP_PP_BUNDLE_ID=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:480::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 49a070133915e05e9b7723d25d8f07b12dda78f7d89c5334176329b5dc8019a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:30:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Nov 2021 13:07:26 GMT
Server: Microsoft-IIS/10.0
ETag: "0fb3411b4dbd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18242

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame E1D7 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 15:56:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 63242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 15:56:39 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 522A 143 B
163 B 40ms
39ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 01 Dec 2021 09:02:16 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1705
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 10EF 1 KB
749 B 41ms
40ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 13:26:12 GMT
expires: Wed, 01 Dec 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72269
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B2E4 22 KB
8 KB 40ms
40ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 29 Nov 2021 12:44:40 GMT
expires: Tue, 29 Nov 2022 12:44:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 161161
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 129C 3 KB
2 KB 125ms
12ms Script
text/javascript 213.254.244.21

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_63961628385&jsTagObjCallback=__tagObject_callback_63961628385&num=6&ctx=1828362&cmp=115739&plc=4253581&sid=18330&advid=&adsrv=&unit=728x90&isdvvid=&uid=63961628385&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&dvp_strhd=0.50&dvpx_strhd=0.50&brid=3&brver=96&bridua=3&dup=null&turl=https://befonts.com/checkout/redirect&chro=1&hist=2&winh=90&winw=1005&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVP_PP_IMP_ID=ABAjH0jw6vG1CMlUGDgeWFMNcZ1M&DVP_DBM_1=3060631&DVP_DBM_2=11796640&DVP_DBM_3=32180595&DVP_DBM_4=347711959&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=101946468970&DVP_PP_BUNDLE_ID=&prr=1&aUrlD=-1&m1=13&noc=4&fcifrms=7&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=148&eparams=DC4FC%3Dl9EEADTbpTauTau367%40%3FED%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau367%40%3FED%5D4%40%3ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6EU2%26C%3Dl9EEADTbpTauTau367%40%3FED%5D4%40%3ETau4964%3C%40FETauC65%3AC64E&dvp_exetime=6.90&callbackName=__verify_callback_63961628385
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal100.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 213.254.244.21 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 616b426fedbb68ddc48c6e23e641ba3cc29b396e764a68a31fb6160f5f9475d1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
X-DV-Response: 1
Content-Encoding: gzip
Date: Wed, 01 Dec 2021 09:30:41 GMT
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Expires: 11/30/2021 9:30:41 AM

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 522A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

194ms
189ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 09:30:42 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 01 Dec 2021 09:30:42 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 01 Dec 2021 09:30:41 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 10EF 35 B
463 B 35ms
9ms Image
image/gif 2620:116:800d:21:3175:5196:e3fd:8c1d

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKd_7t2mGKj0YR21aH6pwxM&google_cver=1&google_push=AYg5qPIF5FupVxSJPw_48ozRmDxsDAQ4PsFHdLX3QMpWHurzXFTNuToPJbbTfiMQfp-4IDCsd6dfJo9xwCnBHzE1-ECd3e9vFuE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:3175:5196:e3fd:8c1d -, , ASN (),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 10EF 43 B
324 B 50ms
19ms Image
image/gif 34.98.67.61

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEE3PIj73JtCUAPyRCgov70Q&google_push=AYg5qPKK6Ku4zk2JpRi1ENssd4qcY1FCDNQ0n8R-cUhG0E-SiDIAINWPxEvDoNzXiyZfSo-nGLNZAVaI2PKHOtM0vY_MP9pSBEI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 10EF 43 B
351 B 59ms
22ms Image
image/gif 35.227.252.103

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELJ8IALbLUNu-AtNRCdk0G4&google_cver=1&google_push=AYg5qPJWYQMu5CjhCb6x98JBBn9TzNyBhg060cnBW-WztaC4dgLgOexRCRJm_0l4_WMdSQ5vPKEC8KFsvGZVjU4oZOGSv3niqw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 -, , ASN (),
Reverse DNS
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: db3lhd7e8147aau6rv91kd73lpt4s6mf

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 10EF
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RhJDFGxsQxOBNCvq-5y-Vw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

67ms
67ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RhJDFGxsQxOBNCvq-5y-Vw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKrN2w6GD1HYG2NIJYilfrPGv8Jb7LvvTLDNT3aPZZsCp3ZED6GGivg5svvw6gnLOJ_WPVAlTUghqm560OVHw-5__nJWic

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=RhJDFGxsQxOBNCvq-5y-Vw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKrN2w6GD1HYG2NIJYilfrPGv8Jb7LvvTLDNT3aPZZsCp3ZED6GGivg5svvw6gnLOJ_WPVAlTUghqm560OVHw-5__nJWic
date: Wed, 01 Dec 2021 09:30:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 10EF
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENXiKM7PI_ns_unZ6yocr3I&google_cver=1&google_push=AYg5qPL9xCWRKz1fUmjhMhT1UOWdYCp2vbumx2izXKJzbFMGS1TKlezE_GaVP8n7hDPHq5jQkWy...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldRQ0ItOC03VDhB&google_push=AYg5qPL9xCWRKz1fUmjhMhT1UOWdYCp2vbumx2izXKJzbFMGS1TKlezE_GaVP8n7hDPHq5jQkWy0vto3AyupLE1g7n98bfL9nPw

170 B
188 B

52ms
52ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldRQ0ItOC03VDhB&google_push=AYg5qPL9xCWRKz1fUmjhMhT1UOWdYCp2vbumx2izXKJzbFMGS1TKlezE_GaVP8n7hDPHq5jQkWy0vto3AyupLE1g7n98bfL9nPw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dOQldRQ0ItOC03VDhB&google_push=AYg5qPL9xCWRKz1fUmjhMhT1UOWdYCp2vbumx2izXKJzbFMGS1TKlezE_GaVP8n7hDPHq5jQkWy0vto3AyupLE1g7n98bfL9nPw
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 10EF
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJps...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJps...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJps...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJps...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJps...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 10EF
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEFE2rk9XcDBctcJRBNYaQBk&google_cver=1&google_push=AYg5qPIZlbM9A69T8xLqWuHn...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIZlbM9A69T8xLqWuHnLjO9aUR72GIr_-jRR751WYv1SMTs8t4U-sC2VN7x9GkrJEYmv0DBMV5L2GnX0NOQBBPeHjEBcCMR&google_hm=

170 B
188 B

63ms
62ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIZlbM9A69T8xLqWuHnLjO9aUR72GIr_-jRR751WYv1SMTs8t4U-sC2VN7x9GkrJEYmv0DBMV5L2GnX0NOQBBPeHjEBcCMR&google_hm=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPIZlbM9A69T8xLqWuHnLjO9aUR72GIr_-jRR751WYv1SMTs8t4U-sC2VN7x9GkrJEYmv0DBMV5L2GnX0NOQBBPeHjEBcCMR&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Tue, 30 Nov 2021 09:30:41 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 10EF 0
12 B 63ms
62ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I7AaOISO_NZxBzOuWO2cQA3vhamGoEQ0KyJIVuvvQVwIyZNNy0Yz1ueUmlrAxU9OChF4EfzA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:30:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js Show response
pagead2.googlesyndication.com/bg/ Frame B2E4 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lK7Pd7B-H_9yBaI_NSshU4OXimYezFu1HmFuNXULOe8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 15:56:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 63242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13508
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 15:56:39 GMT

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 129C 9 KB
4 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal100.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 08:37:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3195
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4486
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 19:29:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 01 Dec 2021 09:37:26 GMT

GET
H3 200 impl_v81.js Show response
www.googletagservices.com/dcm/ Frame 129C 41 KB
17 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v81.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 12:23:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 594461
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17189
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 20:08:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Nov 2022 12:23:00 GMT

GET
H3 200 B9689862.280630144;dc_ver=81.236;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3653120127;ord=tyk8jw;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame 129C 45 KB
22 KB 119ms
74ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280630144;dc_ver=81.236;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3653120127;ord=tyk8jw;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3A%2F%2Fbefonts.com%2F$0;xdt=1;crlt=7OQXgjsPKD;sttr=52;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v81.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

987ba625d20c87662552b4bb891ada66d1378fc0e6f8eab88dbec192a57e6960

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22312
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B2E4 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B8V4GwUCnYYjLEZWPrASTvYGgCQAAAAA4AeAEAg&bg=!z8ylzIjNAAZQLpa_UC47ACkAdvg8Wv64piGAkCdfRX7EZDqBST1YCkphxfIhXwlR_RZgSUcEUAO9GAIAAABvUgAAAAloAQcKAGMD6mZchTz6aqC7c9fOJ2-bTToC2YgOzy6LCEbMjYlfgtrE9zF4ZxUTVY7BOrysk3uq5UnkWk7MG4eBXMwynNWAIy98KE9xhFir2R7gxe0r_kzSIDZRvqGlzPl3DIMLy6n7YbuZAtQA_cNHyiSuL8N_dn4HmM0j5_0nuS6WL94_V_9J-7yj956HttoLPOSH74OsZHDmJ2HrK-iDNTN0x20XDugE7Mlq38FSVASJflKv3odl7cntrtb4fcVfCn5x6nVyf1MJlTTYdFtVkgIN4x4V-hciWt3W03BuBks2i0NIwhsdZ5BIsT8Ik2RQ5YwuDU1Rr8_lRg0h4qH06xl9riBkrC2Hc9AqURuAQ67SifpGj4R5YTbHkUn2BbCjORO6fhhTlAoeYUqw36AHFBX1ObkqUuEy8rOqzM32oTgtnCzZ3wlWcGCm6hgZr1zKQwX8_mI3C8odQbQ5GpMSE9umkOq12UhJdTwwbNyXw5yFY-7JCJEAgwa3t32ijWaVu52d_P55QeSXlkQOwMQ1WBRdMvyz2pC7wahp6ghrkSYpBM9VJqPF5p3OG7TQziFXvcPTtbndE_lBDp2_0TmYSChKCgO06CdOC7Up2-yGCXI7AlgQipWrfI1Ae80x0f-99x30tzh4N9ZRdecd-evFuJUvutJBGxfJjDEPPIlIdbFeXMTI2RtGpovTMGUWPgYT001-XvY0yayI8r9ekSA6BHyAceiCArkWm56VGTBEuovfxibe9en5MA4rbr_R1DGj_RagNs9QITtM-H4gZTKbjS2XW3B5R8no6TqDQ-PsvMyZSxKxE-WrDkUYz3e2NrHGs8_af3z2NB4g1-MvMVG74npazubSMwIW4sA-C030TEtVfOpeT6RW1OONd53lbopQZFm3EaZTiIh3q0uBOtew7KDgGrL6cHcd0XBmsWPJjurssabdc4rFkY9eT25-l5Hld3U8ixndSoDm7rktsD_baXUASqR_WHP1seeJLTemyRX_B8whL6OzLiVwbcliaxjTxDvRaOwXmYDAd6bouRZGhTlmWhkbaVxOH8BjC-A_2se9iXKRRsPX_FSLXl3SNdLF63rEDNWHDuWEM3C_nP1L

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Dec 2021 09:30:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 129C 8 KB
3 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280630144;dc_ver=81.236;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3653120127;ord=tyk8jw;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3A%2F%2Fbefonts.com%2F$0;xdt=1;crlt=7OQXgjsPKD;sttr=52;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 09:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Dec 2021 09:28:48 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 129C 0
23 B 72ms
71ms Ping
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv9ZvFL8G1COMXRkeLLVNArZ6s76RiQIndz70x8icHG97mqtKZPGZbYeTof2WoB3_huJseHqpr6REvEYOerCIHpTawjFrhO_sFJegJ6RTi0FUipQKrwzP_Ap7R8fqtjDRScX0os899rJq1VC78&sig=Cg0ArKJSzBQlt2Wo9KMFEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20211111.89648&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 01 Dec 2021 09:30:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK dvtp_src.js
cdn.doubleverify.com/ Frame 129C 8 KB
4 KB 7ms
7ms Script
application/javascript 2a02:26f0:7100:480::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=13311291&cmp=9689862&sid=2641434&plc=280630144&num=&adid=&advid=2276943&adsrv=1&btreg=505362318&btadsrv=doubleclick&crt=156804616&crtname=&chnl=&unit=&pid=&uid=&tagtype=&dvtagver=6.1.src
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280630144;dc_ver=81.236;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3653120127;ord=tyk8jw;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3A%2F%2Fbefonts.com%2F$0;xdt=1;crlt=7OQXgjsPKD;sttr=52;prcl=s
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:480::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:30:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 Nov 2021 12:39:48 GMT
Server: Microsoft-IIS/10.0
ETag: "0424488f9e1d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3291

GET
H3 200 17721130591974731406
s0.2mdn.net/simgad/ Frame 129C 64 KB
0 97ms
50ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17721130591974731406

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 23:06:58 GMT
x-content-type-options: nosniff
age: 37423
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 71148
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 22:07:40 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Nov 2022 23:06:58 GMT

GET
H/1.1 200
OK dv-measurements1874.js Show response
cdn.doubleverify.com/ Frame BB04 490 KB
89 KB 19ms
19ms Script
application/javascript 2a02:26f0:7100:480::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1874.js
Requested by: Host: firsturl.de
URL: https://firsturl.de/1zRYNeA
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:480::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 9d37d1712b2be6bd01460ea30ab676c8baa512d5f1de5d608511a4403bea72dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Wed, 01 Dec 2021 09:30:41 GMT
Content-Encoding: gzip
Last-Modified: Tue, 16 Nov 2021 11:10:53 GMT
Server: Microsoft-IIS/10.0
ETag: "801ca49edadad71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91038

GET
H3 200 cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 5821 1 KB
749 B 39ms
38ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 30 Nov 2021 13:26:12 GMT
expires: Wed, 01 Dec 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 72269
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 129C 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 76ea3f7d9b01a0f04912d8339e2148eec60c462d11a076d33c8cf0f74665ac3a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 2F90 0
0 39ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 29 Nov 2021 12:44:40 GMT
expires: Tue, 29 Nov 2022 12:44:40 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 161161
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET css
fonts.googleapis.com/ Frame 7073 0
0

GET load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 7073 0
0

GET abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 7073 0
0

GET window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 7073 0
0

GET rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7073 0
0

GET qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 7073 0
0

GET 163b3e9c260ab6fd774ac5b5c6fd1d76.js
www.gstatic.com/mysidia/ Frame 7073 0
0

GET adview
googleads.g.doubleclick.net/pagead/ Frame 7073 0
0

GET
DATA 200
OK truncated
/ Frame 7073 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET visit.js
tps.doubleverify.com/ Frame BB04 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_cver=1&google_push=AYg5qPIv6L1thqyiCS0V50NpwblnFzQUCeqFEVX06DqK8v9ikmzFodM5JRCqGv9hzXyYTvPSRRGewJpo2bOqKOR3SFndXAgvhWWNdA&google_gid=CAESEKp20Jnaw4SIbQ6GDv2xgoI

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YadAwYTIqhWjUk-VD1SUUQAABIIAAAIB&google_gid=CAESEPAeMA19Tff7zaCt3bAy76k&google_push=AYg5qPI-rQAi03IrOrJmr_08YawyH869xUZLmFPAwl-EjwOZJpsuHLG-uxJXYZ0wJDW2WPsbCKweH6PRBImscoVBZv_roBBQ9Q&google_cver=1

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Domain: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Domain: www.gstatic.com
URL: https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/adview?ai=CqFF0wUCnYZi1DbaJx_APnpqvSN_d2LdmleimteEOvs6zsZcOEAEg8ezqIWCV4pCCoAegAdG1gKEDyAEJqQLx-EQiKgGzPqgDAcgDywSqBKACT9BS1Vdce2kEd91zOFrlV4Kzy5zE64yj20ivJbvYK-NpVhEdkoMCOIf_0hRxg7ccW1XRNt0Wyurju7tpcOR5gRBeGqfE9CrZRjQ3ctVPdua_qvchEFPvzBoO4ArEufivltRx1MVqPlb4Ob_SEdkPjtGvI4v6bh8yu-S8TB407ympxsu_V_7T8OsFBJ916TzAO45BRHEM5e7PI98cKybut_f-DTw_-wUA_bd20rGZhb41b8oBCMtk4zGXiMBhlIM76qWQJkP_rAys84czWEMnQ7wceLD-EMZS-KYsig7hXMhzw3rDKTCMgh2oT0xaOwApuyJ8eN1ZJPUrpFz89bfQptHJTgSgP1GJiggrhH0i7vTFyz7p1GkBxpG1ivFIHpuLwASltLCs4QOSBQQIBBgBkgUECAUYBKAGLoAHl8r_XqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEKDBDtIICQiA4YAQEAEYX4AKAcgLAbgTiCfYEw2IFALQFQGAFwGyFxwKGggAEhRwdWItMTMwMDQxMzM3MTA1MDAwMBgA&sigh=qV3xUZA5y-M&uach_m=[UACH]&template_id=5000

Domain: tps.doubleverify.com
URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&ttmms=117&ttfrms=28&brid=3&brver=96.0.4664.45&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau367%40%3FED%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTau367%40%3FED%5D4%40%3ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6EU2%26C%3Dl9EEADTbpTauTau367%40%3FED%5D4%40%3ETau4964%3C%40FETauC65%3AC64E&srcurlD=0&aUrlD=-1&ssl=https:&dfs=641&ddur=8&uid=1638351042037177&jsCallback=dvCallback_1638351042037192&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F96.0.4664.45%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=1874&tgjsver=1874&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20211111%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&fcifrms=7&brh=2&sdf=2&dvp_epl=307&noc=4&ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&adsrv=0&advid=3398311&turl=https://befonts.com/checkout/redirect&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_PP_ID=3&DVP_DV_CT=1&DVPX_PP_IMP_ID=ABAjH0jw6vG1CMlUGDgeWFMNcZ1M&DVP_DBM_1=3060631&DVP_DBM_2=11796640&DVP_DBM_3=32180595&DVP_DBM_4=347711959&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=101946468970&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=396334542.1807318&dvp_tukv=20911345331.01895&dvp_uuid=376204322.37825245&dvp_strhd=0.40000057220458984&dvpx_strhd=0.40000057220458984&dvp_tuid=732746713225

Verdicts & Comments Add Verdict or Comment

186 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

30 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
firsturl.de/	1970-01-20 00:35:07	Name: cookie_consent_level Value: %7B%22strictly-necessary%22%3Atrue%2C%22functionality%22%3Afalse%2C%22tracking%22%3Afalse%2C%22targeting%22%3Afalse%7D
.befonts.com/	1970-01-20 08:27:27	Name: __gads Value: ID=d3c09f2daa8752a2-22c9e4241ccc0089:T=1638351040:RT=1638351040:S=ALNI_MZYWPGjpUgeCuW_BVJH5NXwVWluyQ
.befonts.com/	1970-01-20 16:37:03	Name: _ga Value: GA1.2.1308547740.1638351040
.befonts.com/	1970-01-19 23:07:17	Name: _gid Value: GA1.2.948807512.1638351040
.befonts.com/	1970-01-19 23:05:51	Name: _gat_gtag_UA_57630082_1 Value: 1
.doubleclick.net/	1970-01-20 08:27:27	Name: IDE Value: AHWqTUnykJl_zSlOV-sfpRDkmxUf0AaW9kzfHfdac3aBSNLeAOKdLkBs9_XjIR-TCys
.casalemedia.com/	1970-01-20 07:51:27	Name: CMID Value: YadAwYTIqhWjUk.VD1SUUQAA
.casalemedia.com/	1970-01-20 01:15:27	Name: CMPS Value: 3270
.rlcdn.com/	1970-01-20 07:51:27	Name: rlas3 Value: 4Bm0RgDpJ80uXszIpT6Vnk3H5HgKmrkppa2N73472ys=
.casalemedia.com/	1970-01-20 01:15:27	Name: CMPRO Value: 1154
.casalemedia.com/	1970-01-19 23:07:17	Name: CMST Value: YadAwWGnQMEA
.rlcdn.com/	1970-01-20 00:32:15	Name: pxrc Value: CMGBnY0GEgUI6AcQABIGCOndKhAA
.agkn.com/	1970-01-20 07:51:27	Name: ab Value: 0001%3AimoEvLc73QNCf9JMhH801%2FOGA%2BNh1%2BRU
.agkn.com/	1970-01-20 07:51:27	Name: u Value: C\|0CEApOf1BKTn9QQAAAAAAAQ13AQCAAQpAAAAAAA
.innovid.com/	1970-01-20 01:15:27	Name: uuid Value: 0905c85c-d629-4765-a9ef-3125d0b76f5b-20211201 04:30:41
.doubleclick.net/	1970-01-19 23:05:54	Name: DSID Value: NO_DATA
.e.dlx.addthis.com/	1970-01-20 08:36:05	Name: na_tc Value: Y
.addthis.com/	1970-01-20 08:36:05	Name: na_id Value: 2021120109304100074307316087
.addthis.com/	1970-01-20 08:36:05	Name: na_tc Value: Y
.addthis.com/	1970-01-20 08:36:05	Name: uid Value: 61a740c11fb808d2
.addthis.com/	1970-01-20 08:36:05	Name: ouid Value: 61a740c10001e361431c7b066e1654d837fc36735c49b509434e
.dlx.addthis.com/	1970-01-19 23:49:03	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-19 23:49:03	Name: na_sr Value: 20211201
.dlx.addthis.com/	1970-01-19 23:05:51	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-19 23:49:03	Name: na_sc_e Value: 0
.adnxs.com/	1970-01-20 01:15:27	Name: uuid2 Value: 7336934608985529444
.casalemedia.com/	1970-01-20 07:51:27	Name: CMRUM3 Value: 2d61a740c12760CAESEBjxCbAKQ6LG33EiSyYeWdI
.adnxs.com/	1970-01-20 01:15:27	Name: anj Value: dTM7k!M41.D>6NRF']wIg2Hb[bTE>H!1yIE`fS1ueD1W-044)d+]Uf.*55]kBWewvCG#cSp<!IRp<wa%0zhH4HH1Mc9RFMZ9T5_m!x'i3)Wqdm
.quantserve.com/	1970-01-20 01:15:27	Name: d Value: EFEBCQHtJIEA
.quantserve.com/	1970-01-20 08:36:05	Name: mc Value: 61a740c1-9f4c1-6eee9-6ad31

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.googletagservices.com/dcm/dcmads.js(Line 14) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v81.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/dcmads.js(Line 14) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v81.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/impl_v81.js(Line 35) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N464220.2664435BEFONTS.COM/B10719759.146971922;dc_ver=81.236;sz=728x90;u_sd=1;nel=1;dc_adk=4042925164;ord=c5f7cc;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F$0;xdt=0;crlt=mJ3tIkPLLf;sttr=105;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.googletagservices.com/dcm/impl_v81.js(Line 35) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N464220.2664435BEFONTS.COM/B10719759.146971922;dc_ver=81.236;sz=728x90;u_sd=1;nel=1;dc_adk=4042925164;ord=c5f7cc;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=0,https%3A%2F%2Fbefonts.com%2Fcheckout%2Fredirect%3Furl%3Dhttps%3A%2F%2Fwinvio.com%2Faustralia%2F$0;xdt=0;crlt=mJ3tIkPLLf;sttr=105;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
adservice.google.de
ag.innovid.com
befonts.com
c0.wp.com
cdn.doubleverify.com
cm.g.doubleclick.net
cms.quantserve.com
d.agkn.com
dsum-sec.casalemedia.com
e.dlx.addthis.com
firsturl.de
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
googlecm.hit.gemius.pl
ib.adnxs.com
id.rlcdn.com
image6.pubmatic.com
odr.mookie1.com
p4-bdtnbtbpsee36-vocxrdslivfxwnki-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.rubiconproject.com
pixel.wp.com
rtb.openx.net
rtb0.doubleverify.com
s0.2mdn.net
secure.gravatar.com
stats.g.doubleclick.net
stats.wp.com
tpc.googlesyndication.com
tps.doubleverify.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
cm.g.doubleclick.net
fonts.googleapis.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
tps.doubleverify.com
www.googletagservices.com
www.gstatic.com
104.111.215.191
142.250.185.162
142.250.186.70
142.250.186.98
142.250.74.194
142.250.74.195
18.196.159.27
185.33.220.244
185.64.190.78
192.0.76.3
192.0.77.37
2.18.234.21
213.254.244.21
2606:4700:3037::6815:276d
2606:4700:3037::ac43:ac1d
2620:116:800d:21:3175:5196:e3fd:8c1d
2a00:1450:4001:801::2006
2a00:1450:4001:803::2004
2a00:1450:4001:808::2003
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2002
2a00:1450:4001:811::200a
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:831::2002
2a00:1450:400c:c07::9c
2a02:26f0:7100:480::4469
2a04:fa87:fffe::c000:4902
2a05:d01c:1d8:8102:a212:76ab:db1a:a790
34.98.67.61
35.227.252.103
35.244.174.68
69.173.144.165
79.137.68.187
0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
02fea9181433d073de2c559eeb99b916b4498124c46788b5cb9be0e692251104
04c6b2d6f35c6fec594184f59a019a1611c7f179e94abb1535d11e4368ed5f29
05d92881b407753e93199f39ecd666b60607b063499e08abba008563ac34193f
0a56234241a7dd6d1f2a13b3d521d260c999c9bf50e97f255859649775eec6ee
0a938256d2de59b044f8ca7c7aa0c788ed2ffa9a48bf0e3930a5830c4298f509
0ae7567b6f24bf762731012db36aac7e182b2fa8f5d9d8674d626c084a619dd7
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f74eda5ca917f0146ec28a71e0602f7a3b9dae063acfeecfe6549bdb165d47a
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
196dbd9bbb848910c88bc9a19a3bcc85fb3d97ae6d673a77f37a6ecbf398c868
203a4bdab26266b358deb62aa3878818363aa615edc7e1b361110d1cc2165a51
280532fe6539a1a9a19081c6e9dca5cc230254656b01c2314ea71472d7e8a89b
293913879d30bab7499013e935009f5183facbddd63bfc9656a859622590b80b
2ca32e4264f8a655533dd1f48e09dba95b08d69e290760f25988a30be23f552d
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
3c6266ddf24176c668193d4f020b0765d1942e4a5d83e004c222f5f503ba741b
41b60d2262cffca90f6cd644983a2d813336dc959558bdd6ae54b35ef06dd9fb
44216edbcf372158d065f2c7062712c9c829648c355066e7cd14242843005d81
46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd
49a070133915e05e9b7723d25d8f07b12dda78f7d89c5334176329b5dc8019a6
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e8a9f91efa071fef1ae36b2178873b6c92e16a7d4a1087468e85609c2e68d85
4faa1d5635283a0d49e1933de318b24491751c9a3ccf2fe404b9137929e3eb86
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
59671205ce4d2ec4a037ba18847d2e02fddcce3eaed20a6a731161305b24aada
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c61ca1b95bfd45310fcedcb381ca703605090d7d97f22f84023d93cc2cedebc
5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274
5d5af0ceaded3d0d43f6651503403a2d53942daed04a069bbfcbbf0cd888898e
5dacc86b8a64742e60d70192353e5643da219a3f84c0b26cf6116b06b67fff32
616b426fedbb68ddc48c6e23e641ba3cc29b396e764a68a31fb6160f5f9475d1
65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e
67741332076acce5d1cac66fb622734bf000a22ce0022e056b8d681b8faad4a8
70760176d11e5a94c62df4a39140e91f895a0eac3f70ad8807ea60f6314bb857
76ea3f7d9b01a0f04912d8339e2148eec60c462d11a076d33c8cf0f74665ac3a
7ce10690714f9021ac0c16a8a43e60f4f00efeff077f83e7b0eff8c9e91e0a13
7dadf41d55487432b3b4f5db5e8ed8a757ad7d295b1570567d2d2fc6929bd24f
82add349806b9eb46e9bb08a53aaa703f6e0866e5e5bdfa564330c77ca31d194
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
83508e18f3a437cc6dcff25f68ed0cb57f2cbb25a53a40ab4be6ff4265c2e9bb
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8b94cbe5296254e6bc2199c7099b21f9308583e421f3b5204166eb9bbf19cc58
8ee71d7e5b73dee27f29df818059ca38d83f4ee6cbe6997d8a026e48df5bdd32
90fb70f98dd7b7f011baa9002b340df095db7cb97639e1124f1926a2472dd514
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
94aecf77b07e1fff7205a23f352b215383978a661ecc5bb51e616e35750b39ef
968ab8ae6f33119ee267a11ce60920934e0d5e9d4714a3eb6b47cb9f05e42a0f
987ba625d20c87662552b4bb891ada66d1378fc0e6f8eab88dbec192a57e6960
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9c3099aaf02a8d4741205616f5a21307719bad4803b4ebd3ea329818c90e98d5
9d37d1712b2be6bd01460ea30ab676c8baa512d5f1de5d608511a4403bea72dc
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a41621a9b1eea621ef58aa20183231b7afeb29589f8faebd36e0a49a5acdef75
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76
a5493a5b3c37e372b6fbad104606ee808ea4ff2f4f9b9f42ab060e20ca78cf84
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
ac5fb0841050b936e4d58316749254173e8015ad96335cf0cf68d597c902ae02
afa84bd950052260a86f737044431ba572f65ca46a9b96a074fbb0755019cc13
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1c08ca00d0b9cdc2e67d9d4461dbe17a2e8e0b54ec04903c9f69627de87d2a3
b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b97396e47358ca590fd51a61a7eb915288e944d17221d264fdcba4255be5fa69
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc9c387b513b4d43675910f780fa03e92b9a4b58432b402a8f0a801a0d5ae855
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be2e04cecbcfd781b640159d04691b2add96725759f769d0a253727dd74b3c2d
bff9bb8f945de66dabd8b5c43aabf279b91c6033c80def87cb19a46058204bfb
c0a825c68a5174d54ddb3579743a0574c6ee6f569f0016a8b7fd431061dcf91c
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2780aa038eab0dde91138a411a38c85cdf4fd62adbbda6be24498de25e38c4b
c36672734eb354012ec579c10e879ecf0e25dbcb2c0281bad87a94ed332698d4
c45a7b49c14477cd160a83d4ee1fb8c311e12314e042d0647c68bec62f16fe29
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d0ba7e2275cddbdf3d2473a60565d950efb8474ba7bda393cc64f56ff39d85ce
d6b1ee1113df9181d66452fe3899f280e9bd174ba6b3d277d6b93474e867d510
d81c5fe0ec47980392218e611e2a8aa6f6046554387b40e0096acfad7d544651
d843361c4aeea1a41e0c314e061c78adc0c767ac3bed1d5fad0a8076f4b8bd5b
d8f8b54b0fcde65fd8b868b0c8cf4e5337dae1918ac1a24fdc96d2000dda4c73
db35a22a37e4d085378108bb50cd877199b8e5d56a373da285e4b27c5a5230c5
db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e6c8f949e02661b3f68f275b35ceef2012156821fcb84be814aee31665159d3d
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
e87a1c5e24f9a7c7dcb437417f0b05b0a3c12947ce32d65c990c988a8b5ed4d7
ed6f77c097f0236a46fd7747f6665e7ae54f7ecc95e20f1b16db71affa3799d9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f27bf6fbacf9d4bc21396ea82258b718bb0946c4b590bb40dffedd20c2a11c9f
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a
f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23
f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a
fcec8f9f4b2b56dcc746a20c4d2f2992bbefcacc3f2aad7e2b45f1f32da22e67

befonts.com Open in urlscan Pro 2606:4700:3037::6815:276d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

171 Requests

87 %HTTPS

54 %IPv6

28 Domains

41 Subdomains

34 IPs

6 Countries

2067 kBTransfer

6346 kBSize

30 Cookies

4 Outgoing links

Page URL History

Redirected requests

171 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

befonts.com Open in urlscan Pro
2606:4700:3037::6815:276d Public Scan

Screenshot
Live screenshot

Full Image

171
Requests

87 %
HTTPS

54 %
IPv6

28
Domains

41
Subdomains

34
IPs

6
Countries

2067 kB
Transfer

6346 kB
Size

30
Cookies

171 HTTP transactions
5 data transactions