ja.nex-software.com Open in urlscan Pro
2606:4700:3034::ac43:cc49 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ja.nex-software.com/
Submission Tags: falconsandbox
Submission: On August 17 via api (August 17th 2021, 6:46:33 am UTC) from US

Summary HTTP 170 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 42 IPs in 7 countries across 28 domains to perform 170 HTTP transactions. The main IP is 2606:4700:3034::ac43:cc49, located in United States and belongs to CLOUDFLARENET, US. The main domain is ja.nex-software.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 11th 2021. Valid for: a year.

This is the only time ja.nex-software.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
33	2606:4700:303... 2606:4700:3034::ac43:cc49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.177.94.108 185.177.94.108	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
3	151.101.65.195 151.101.65.195	54113 (FASTLY) (FASTLY)
1 1	46.4.91.20 46.4.91.20	24940 (HETZNER-AS) (HETZNER-AS)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
2	2600:9000:21f... 2600:9000:21f3:b200:11:a4de:2580:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3035::ac43:89ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.73.65 65.9.73.65	16509 (AMAZON-02) (AMAZON-02)
2	213.174.135.25 213.174.135.25	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1 2	88.212.201.198 88.212.201.198	39134 (UNITEDNET) (UNITEDNET)
1	2600:9000:219... 2600:9000:2190:b400:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.196.233.38 18.196.233.38	16509 (AMAZON-02) (AMAZON-02)
14	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	213.174.135.24 213.174.135.24	39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS)
1	2600:9000:20e... 2600:9000:20eb:3400:c:a9b7:ddc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:3::485 2a04:4e42:3::485	54113 (FASTLY) (FASTLY)
1	3.124.181.115 3.124.181.115	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400f:80a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
25	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:32::3	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1	142.251.5.155 142.251.5.155	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
8 11	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
4 8	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
3 5	185.33.220.240 185.33.220.240	29990 (ASN-APPNEX) (ASN-APPNEX)
5	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2006	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:5e::8	15169 (GOOGLE) (GOOGLE)
1	178.63.52.121 178.63.52.121	24940 (HETZNER-AS) (HETZNER-AS)
3 4	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
2	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1 5	138.201.63.145 138.201.63.145	24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	145.239.2.103 145.239.2.103	16276 (OVH) (OVH)
170	42

33 2606:4700:3034::ac43:cc49 (United States)

ASN13335 (CLOUDFLARENET, US)

ja.nex-software.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
nex-software.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pic.nex-software.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.177.94.108 (United Kingdom)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-94-108.ah-server.com

load5.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.195 (United States)

ASN54113 (FASTLY, US)

cdn.zx-adnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.4.91.20 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.20.91.4.46.clients.your-server.de

cst.wpu.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

cst.cstwpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21f3:b200:11:a4de:2580:93a1 (United States)

ASN16509 (AMAZON-02, US)

get.optad360.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:89ba (United States)

ASN13335 (CLOUDFLARENET, US)

www.cookieconsent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.73.65 (United States)

ASN16509 (AMAZON-02, US)

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.174.135.25 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

na.nawpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vasgenerete.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.198 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host198.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:b400:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.233.38 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-233-38.eu-central-1.compute.amazonaws.com

stat.optad360.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.174.135.24 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)

js.wpushsdk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:3400:c:a9b7:ddc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.181.115 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-181-115.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400f:80a::2002 (Ireland)

ASN15169 (GOOGLE, US)

adservice.google.se	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:32::3 (United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.5.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wg-in-f155.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.186.66 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.18.234.21 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.33.220.240 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

gcdn.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:5e::8 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

r3---sn-4g5e6nss.c.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.63.52.121 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.121.52.63.178.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.64.218 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 138.201.63.145 (Lingenfeld, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.145.63.201.138.clients.your-server.de

hal900010.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.239.2.103 (France)

ASN16276 (OVH, FR)
PTR: ns3082036.ip-145-239-2.eu

cdn.contentspread.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	googlesyndication.com caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com ade.googlesyndication.com	265 KB
37	doubleclick.net 8 redirects securepubads.g.doubleclick.net bid.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	264 KB
33	nex-software.com ja.nex-software.com nex-software.com pic.nex-software.com	2 MB
8	casalemedia.com 4 redirects dsum-sec.casalemedia.com	7 KB
6	redintelligence.net 1 redirects hal9000.redintelligence.net hal900010.redintelligence.net	10 KB
6	gstatic.com csi.gstatic.com fonts.gstatic.com	32 KB
5	2mdn.net 1 redirects s0.2mdn.net gcdn.2mdn.net r3---sn-4g5e6nss.c.2mdn.net	3 MB
5	adnxs.com 3 redirects ib.adnxs.com	5 KB
4	openx.net 3 redirects us-u.openx.net	1 KB
4	googleapis.com fonts.googleapis.com imasdk.googleapis.com ajax.googleapis.com	159 KB
4	googletagservices.com www.googletagservices.com	140 KB
3	google.com adservice.google.com www.google.com	1 KB
3	sharethis.com platform-api.sharethis.com buttons-config.sharethis.com l.sharethis.com	43 KB
3	zx-adnet.com cdn.zx-adnet.com	20 KB
2	teads.tv sync.teads.tv	344 B
2	consensu.org stat.optad360.mgr.consensu.org c.sharethis.mgr.consensu.org	2 KB
2	yadro.ru 1 redirects counter.yadro.ru	1 KB
2	optad360.io get.optad360.io	484 KB
1	contentspread.net cdn.contentspread.net	41 KB
1	google.se adservice.google.se	853 B
1	jsdelivr.net cdn.jsdelivr.net	1 KB
1	wpushsdk.com js.wpushsdk.com	3 KB
1	vasgenerete.site vasgenerete.site	239 B
1	nawpush.com na.nawpush.com	355 B
1	cookieconsent.com www.cookieconsent.com	47 KB
1	cstwpush.com cst.cstwpush.com	60 KB
1	wpu.sh 1 redirects cst.wpu.sh	97 B
1	load5.biz load5.biz	20 KB
170	28

	Domain	Requested by
25	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
20	pic.nex-software.com	ja.nex-software.com
18	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com googleads.g.doubleclick.net imasdk.googleapis.com
12	nex-software.com	ja.nex-software.com nex-software.com
11	cm.g.doubleclick.net	8 redirects googleads.g.doubleclick.net
11	googleads.g.doubleclick.net	caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com ja.nex-software.com
9	securepubads.g.doubleclick.net	get.optad360.io securepubads.g.doubleclick.net caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
5	hal900010.redintelligence.net	1 redirects caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com hal900010.redintelligence.net
5	ade.googlesyndication.com
5	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
5	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
5	caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	us-u.openx.net	3 redirects googleads.g.doubleclick.net
4	csi.gstatic.com	imasdk.googleapis.com
4	www.googletagservices.com	securepubads.g.doubleclick.net caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
3	cdn.zx-adnet.com	ja.nex-software.com cdn.zx-adnet.com
2	sync.teads.tv	googleads.g.doubleclick.net
2	r3---sn-4g5e6nss.c.2mdn.net
2	s0.2mdn.net	caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
2	fonts.gstatic.com	fonts.googleapis.com
2	imasdk.googleapis.com	caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
2	www.google.com	tpc.googlesyndication.com caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
2	counter.yadro.ru	1 redirects ja.nex-software.com
2	get.optad360.io	ja.nex-software.com get.optad360.io
1	cdn.contentspread.net	hal900010.redintelligence.net
1	ajax.googleapis.com	hal900010.redintelligence.net
1	hal9000.redintelligence.net	caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
1	gcdn.2mdn.net	1 redirects
1	bid.g.doubleclick.net	imasdk.googleapis.com
1	fonts.googleapis.com	caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.se	securepubads.g.doubleclick.net
1	l.sharethis.com	platform-api.sharethis.com
1	cdn.jsdelivr.net	get.optad360.io
1	c.sharethis.mgr.consensu.org	platform-api.sharethis.com
1	js.wpushsdk.com	cst.wpu.sh
1	stat.optad360.mgr.consensu.org	get.optad360.io
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	vasgenerete.site	cst.wpu.sh
1	na.nawpush.com	cst.wpu.sh
1	platform-api.sharethis.com	ja.nex-software.com
1	www.cookieconsent.com	ja.nex-software.com
1	cst.cstwpush.com	ja.nex-software.com
1	cst.wpu.sh	1 redirects
1	load5.biz	ja.nex-software.com
1	ja.nex-software.com
170	47

This site contains links to these domains. Also see Links.

Domain
th.nex-software.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-05-11` - `2022-05-10`	a year	crt.sh
load4.biz R3	`2021-06-29` - `2021-09-27`	3 months	crt.sh
blog.ippachi.com GTS CA 1D4	`2021-07-13` - `2021-10-11`	3 months	crt.sh
cstwpush.com R3	`2021-07-21` - `2021-10-19`	3 months	crt.sh
*.optad360.io Amazon	`2020-12-17` - `2022-01-15`	a year	crt.sh
sharethis.com Amazon	`2021-07-19` - `2022-08-17`	a year	crt.sh
na.nawpush.com R3	`2021-08-16` - `2021-11-14`	3 months	crt.sh
vasgenerete.site R3	`2021-06-26` - `2021-09-24`	3 months	crt.sh
counter.yadro.ru GoGetSSL ECC DV CA	`2020-02-02` - `2022-05-02`	2 years	crt.sh
stat.optad360.mgr.consensu.org R3	`2021-08-07` - `2021-11-05`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
js.wpushsdk.com R3	`2021-07-05` - `2021-10-03`	3 months	crt.sh
sharethis.mgr.consensu.org Amazon	`2021-04-07` - `2022-05-06`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
*.google.se GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.c.docs.google.com GTS CA 1C3	`2021-08-10` - `2021-10-19`	2 months	crt.sh
redintelligence.net R3	`2021-06-21` - `2021-09-19`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
teads.tv R3	`2021-06-14` - `2021-09-12`	3 months	crt.sh
contentspread.net R3	`2021-08-03` - `2021-11-01`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://ja.nex-software.com/
Frame ID: 60F81E10543E450DE8DF487F1222D203
Requests: 64 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/portal-v2.html
Frame ID: E4989185D7999C627B72C66C9688B67F
Requests: 1 HTTP requests in this frame

Frame: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: F8E05CA825AE932C102D18E97EB683CA
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 0AF9BEED40668D1C1D14DE070E0EAE0E
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 87C835031204DA23C1C1C276B4D46A34
Requests: 1 HTTP requests in this frame

Frame: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 18BD606813FC562E9F16FE20C0B31324
Requests: 34 HTTP requests in this frame

Frame: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: F3F07404B8AD6CF913B1D63BB9533A63
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COf3vwIQzILFAhj29qSvATAB&v=APEucNUSK-HrTrXBOC5vglC2S0hPn3ttBAQ22N7i4kjOeoioE9OwNi2EQX4QganyDY4O_hSnO3PVbqFMMg6H4BC8gtncz11raZ9gdSI1Wylou6wAjgIh7i3pgPKs_C07nKEv6REDDN3Xd7Jyg7eOzGrSv6uzUAJeDwf66WiMiWRcQY8Yth2nf985wK56Ew8hvWRvN_lvoAtt4XebtgUjMHLvBCqu1OKcfg
Frame ID: 382264F60BD184751D28875A58DE94A5
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4DC66E0C964BAADF8D948DA396F6EFDB
Requests: 3 HTTP requests in this frame

Frame: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 4B34026098598684FE80ED0A37733129
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html
Frame ID: AC53EB40E7EA894A1DE9DE7583FE7F1F
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY0o_tSTAB&v=APEucNVZqAtpNXm70ajWVR3-_efXi3J956ys5LWQojpjCItx2Y3mdJj4IHIVsx1uJAvk3OfJsUmLeL2GJ9tzVIc3kC6_N7C0FoASs8j4eDOryLLdpEaAYMSkXgf6-V59Vgn3T3lD2L68NoXXOGYMYBFRAHr2MOjb-UXVRh7nhL-vFgNrBe7uTjEN5J_XE1IDqHJAUbW9ue0IjzWsGAEbFH75WAL55S5Zxw
Frame ID: D59FA4210B63DF5462E1FABCDD6E953F
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 2C798E38089C9F93F660FB694FBCF09E
Requests: 3 HTTP requests in this frame

Frame: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: A4C10BDA7A99D69D1232307170F3D7B1
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg
Frame ID: A6D0FA83098922D04F405764DB2F51CA
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 223AD58A738A0E5CE1DE0ECE5D87C989
Requests: 3 HTTP requests in this frame

Frame: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
Frame ID: 6863117DB95267502747D7979DAEE8A0
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

170
Requests

100 %
HTTPS

51 %
IPv6

28
Domains

47
Subdomains

42
IPs

7
Countries

5981 kB
Transfer

8244 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://th.nex-software.com/
Title: ja.nex-software.com - 2021

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://cst.wpu.sh/static/adManager.js HTTP 301
https://cst.cstwpush.com/static/adManager.js

Request Chain 42

https://counter.yadro.ru/hit?r;s1600*1200*24;uhttps%3A//ja.nex-software.com/;0.910337494940566 HTTP 302
https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//ja.nex-software.com/;0.910337494940566

Request Chain 89

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP4r2fNFronh1vt-diy0x6w&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP4r2fNFronh1vt-diy0x6w&google_cver=1&C=1

Request Chain 90

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRtbNysSqO--rr0FzYBocQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1

Request Chain 91

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECrkfTrEICpZAFPkEyLGxWg&google_cver=1

Request Chain 92

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1

Request Chain 103

https://gcdn.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signature/7D36C3F075FA493F91103D898635EA3B955D1A8B.A683453404B8371A46FD1AE551AB60773947AAFB/key/ck2/file/file.mp4 HTTP 302
https://r3---sn-4g5e6nss.c.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/167A878390E5C6C654B64A877763F50EE5AC44A6.23890DC50B33AB609131223BCBEF10E387972CD0/key/cms1/cms_redirect/yes/mh/EV/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5e6nss/ms/onc/mt/1629182421/mv/m/mvi/3/pl/49/file/file.mp4

Request Chain 118

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1

Request Chain 119

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRtbNysSqO--rr0FzYBocQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1

Request Chain 120

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEPW7R3ebVlb6NO0nnQAS64o&google_cver=1

Request Chain 121

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1

Request Chain 142

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIRVMvcM4s4TcIImnldSCqA&google_cver=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIRVMvcM4s4TcIImnldSCqA&google_cver=1

Request Chain 143

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTUxZmE5MTEtMzlmYS0yYmQxLWMzYWQtODQ5OWU2OGUxMzVi

Request Chain 144

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEJ54M53CJ2UNCktgyo5YHEc&google_cver=1

Request Chain 151

https://hal900010.redintelligence.net/request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7HpiN1sbYaSEHa_P7_UP-q6U2AeBiOHUYMaU1_aFCvAuEAEgqoDDImDxrfyFpB_IAQmpAnxNTQfFwLM-qAMBqgTSAU_QWfx7CrtmPXFd11JA44mTzdPA1c6O8-3iW0XRvQu8kyQe6BxHhxRbMYvZux8c944O-IB_3as3SxybegIDxxlLYIgGoXtjZkW2kGYFMF5zxF5jr0R9qq0Lbw9rngcKY2olDWSa8HXmQVd_OS4qA8lHl5fTRtl92CRUBAJN7KD150ZChVPM4TRPFVn2sWNS-i3QAtBj7eZTzqXc_ef6ait-27iiTpO8APFcwgSdr8B--o71UmMGauZkmBamJH0kgKd_pKJJYR59_-3ROzX006CpDcAEgqXhs2vgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5HlsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw%26sig%3DAOD64_3ftxOerSYII9SttCEc3jQS4vI_nw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-CZpfks_bsOwdGk0w0zmMoCWKnLfGB44Bwffpde9Fk0mKNpMaNO9t9lvB2KtocRVVoTa88-cHSDlr_KigxRYVS8sSopWvSncZcUySXdbgloxE5AV5BR2CmIppOIj04fhzJRLYHyMbM1j-Z4JpeHabQjdDA36Q%26cry%3D1%26dbm_d%3DAKAmf-B771GI6DyT2qylZWLwjz9D0M0bo92q9WcagyLqZ7vUriiV4-ld_y5I3BFYg6UAAGlMbAPp31LX_M-d3t6zCnccqpb5LLvfeUX2VH-tZQmRXbpWss45KGu5GY0pYz_2A48yKcusOljz8fqo185_nfpON3Cdtr_2GDOmTW9QoQ8jxv9dww7ZFqwHqwIYlFsojpDiA-qKrRSLoeLUm62CS-pnvTeheFuxlczL3-FaIY_JEiq1trbn6QlyTY_A3H8OjE0OP8wfBTPuxWhWtUTR1JOuXQwDADOZMcYfMwciufWq679zRSOVVVUUyOvtUdBS_GeAqABmbb75qaAQ7CRH_PIXhZFSZzAEYERIpmJIXxJspBvscah5DMuTQAlI_XOGtkS-OgdUrRyK5oBUYhMHe9NuXm-VnjGtWn8cNQrxirzPsLxkIhP63yTazTkjfexkHYhU40NH%26adurl%3D&documentReferer=https%3A%2F%2Fja.nex-software.com%2F&ancestorOrigins=https%3A%2F%2Fja.nex-software.com&random=7248249264890&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900010.redintelligence.net/request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7HpiN1sbYaSEHa_P7_UP-q6U2AeBiOHUYMaU1_aFCvAuEAEgqoDDImDxrfyFpB_IAQmpAnxNTQfFwLM-qAMBqgTSAU_QWfx7CrtmPXFd11JA44mTzdPA1c6O8-3iW0XRvQu8kyQe6BxHhxRbMYvZux8c944O-IB_3as3SxybegIDxxlLYIgGoXtjZkW2kGYFMF5zxF5jr0R9qq0Lbw9rngcKY2olDWSa8HXmQVd_OS4qA8lHl5fTRtl92CRUBAJN7KD150ZChVPM4TRPFVn2sWNS-i3QAtBj7eZTzqXc_ef6ait-27iiTpO8APFcwgSdr8B--o71UmMGauZkmBamJH0kgKd_pKJJYR59_-3ROzX006CpDcAEgqXhs2vgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5HlsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw%26sig%3DAOD64_3ftxOerSYII9SttCEc3jQS4vI_nw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-CZpfks_bsOwdGk0w0zmMoCWKnLfGB44Bwffpde9Fk0mKNpMaNO9t9lvB2KtocRVVoTa88-cHSDlr_KigxRYVS8sSopWvSncZcUySXdbgloxE5AV5BR2CmIppOIj04fhzJRLYHyMbM1j-Z4JpeHabQjdDA36Q%26cry%3D1%26dbm_d%3DAKAmf-B771GI6DyT2qylZWLwjz9D0M0bo92q9WcagyLqZ7vUriiV4-ld_y5I3BFYg6UAAGlMbAPp31LX_M-d3t6zCnccqpb5LLvfeUX2VH-tZQmRXbpWss45KGu5GY0pYz_2A48yKcusOljz8fqo185_nfpON3Cdtr_2GDOmTW9QoQ8jxv9dww7ZFqwHqwIYlFsojpDiA-qKrRSLoeLUm62CS-pnvTeheFuxlczL3-FaIY_JEiq1trbn6QlyTY_A3H8OjE0OP8wfBTPuxWhWtUTR1JOuXQwDADOZMcYfMwciufWq679zRSOVVVUUyOvtUdBS_GeAqABmbb75qaAQ7CRH_PIXhZFSZzAEYERIpmJIXxJspBvscah5DMuTQAlI_XOGtkS-OgdUrRyK5oBUYhMHe9NuXm-VnjGtWn8cNQrxirzPsLxkIhP63yTazTkjfexkHYhU40NH%26adurl%3D&documentReferer=https%3A%2F%2Fja.nex-software.com%2F&ancestorOrigins=https%3A%2F%2Fja.nex-software.com&random=7248249264890&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

170 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ja.nex-software.com/ 43 KB
8 KB 62ms
33ms Document
text/html 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9165ad714c4df111cdcb043ff64633a24905fcf9069ad9c860a7bad72023e6c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: ja.nex-software.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=74iYKp5uhfAyoKfiMlpZFj6XSDEP70RObBOE%2BUpUmy2jBcVjB0UiuCzAwX8HVbrhxINOsnRUjvEEzMvaS4Dgv6MNaTbCklsKu0zN2iv%2F4RhcaWNCIHSvpJpTc0WRzV0CwPf6ohW7jTIRZUQdAU0G9RwI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6800f1ae8eb10eb7-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 / Show response
load5.biz/ 20 KB
20 KB 175ms
52ms Script
application/javascript 185.177.94.108
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://load5.biz/?pu=mztdqolemm5ha3ddf4ztooju

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.177.94.108 , United Kingdom, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

ip-185-177-94-108.ah-server.com

Software

nginx /

Resource Hash

06e7f2917b7c8a36d7c170a4b80213b9d6f1a4bf266494aa083c5207ca286259

Security Headers

Name	Value
Content-Security-Policy	img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 17 Aug 2021 06:46:12 GMT
server: nginx
content-security-policy: img-src https: data:; upgrade-insecure-requests
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=UTF-8

GET
H2 200 css.css
nex-software.com/template/css/ 6 KB
882 B 32ms
19ms Stylesheet
text/css 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/css.css

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ede999c022b04dae8bed4c7898eb9c23794c70cbd07d4569dd72e43e195c66ed

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 215
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"180a-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JP8B73Ri3xKlwQmrNrPZDHpF4LQEgTpNaqKXSrbr1oeovlJ9l6kWYcTUedAcAV1gqT3E6u%2F7SLMQjSw6SZHKKo4IeIm38B0s5xSiEcOO9slOaFMjoiiiaJy01IFl9nNicMjvpm5KymGy1HBMb2Ij"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1aedf270eb7-FRA

GET
H2 200 bootstrap.min.css
nex-software.com/template/css/ 132 KB
20 KB 37ms
24ms Stylesheet
text/css 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/bootstrap.min.css

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

43677abbcc50b9f3d621c9134d28237cfa6d66c61bf970cdfcf2a3ec31928ed2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4115
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"211f6-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGdVBJfRBClb7nTqTgRVelSRBHlxKZQkSPk5t4XUyx9LpENvYRSCAXSepi2LeRlSMVsjQWk9sUHFBGPKqnSu4E%2Ftta8G%2BHGgxl%2BXGOiYDAVzfEL%2Bf7fGNCKJebmARE8dv462K%2B79nhl1fKVPbPOt"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1aedf260eb7-FRA

GET
H2 200 jquery.bxslider.css
nex-software.com/template/css/ 3 KB
1 KB 29ms
17ms Stylesheet
text/css 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/jquery.bxslider.css

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56b14b6ad7538ba37b7398ef0cfc7bcbf42fd723a943e72ab746a42dc15fb91f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 215
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"dfd-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UNSoEKHCOfOt1MGdVE0PnK8vJbbe0Fvg%2Bv66%2Fv2lgIl8kMs9tOOdDrFvSc%2F1HVUmSKFRnR6TYjf9wIeFZwL8UBo%2FtX%2FoIei%2ByiDzQTrLf2oGtNEggh5O0%2FZlR5%2FEOXsgs%2BMNXh5yM21h7YW4vmha"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1aedf210eb7-FRA

GET
H2 200 style.min.css
nex-software.com/template/css/ 30 KB
5 KB 34ms
22ms Stylesheet
text/css 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/style.min.css

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af371cb0526d291c2821ffb5a63fb1c3969c3ebb22781c08032226c75ea2ab40

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1653
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Thu, 25 Feb 2021 19:47:49 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"7999-5bc2e6d21c340-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D8RP1Fc43QrVVRpE2JMXGb15jjsPRKusNuJlWKWM7bN5ufbMKTFnPVmzJagHXgURsvSQg68lolIxqeKN51FjFZEyE8UK9z%2FAUVhgmjSPi1XUNbUWoWx2%2FY1PYMO9AExW3288fSCJA6vJFYrNOsTb"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1aedf280eb7-FRA

GET
H2 200 lang.min.css
nex-software.com/template/css/ 30 KB
20 KB 40ms
28ms Stylesheet
text/css 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/lang.min.css

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e503441024b68c5ac145c5580cd7b4c1dcd9dd71eb9814b5292ca1bc719af273

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 215
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Mon, 24 Feb 2020 17:08:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"76b8-59f556d479e80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0zVykAhgpAqPht8khVbs07XdcURugRw7sYhNlnmY8NHimHomlP0ISdJhI5qTwIntSL6wxj31FsCdRW2b7TP7umrypzhbAARqODp9KHUsQJZVp%2FbFLj%2FThB1cuR0Rma718a5hMy2HNOtteTI7z2ES"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1aedf250eb7-FRA

GET
H2 200 brmsl_19102402.js Show response
cdn.zx-adnet.com/adx/ 145 KB
19 KB 141ms
23ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/adx/brmsl_19102402.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

dcbbbdae7b45de58a813dfb53f18f037e156c3359555e3922d1eeb9b6f4eb063

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Wed, 28 Jul 2021 19:40:29 GMT
x-timer: S1629182774.687778,VS0,VE1
etag: "e7092a49da41c66a6052dee2ef78d95b28e7c6b43d1cf74ea2c023b98a214134-br"
x-served-by: cache-bma1646-BMA
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600,public
date: Tue, 17 Aug 2021 06:46:13 GMT
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive
content-length: 19568
x-cache-hits: 1

GET
H/1.1

200
OK

adManager.js Show response
cst.cstwpush.com/static/
Redirect Chain

https://cst.wpu.sh/static/adManager.js
https://cst.cstwpush.com/static/adManager.js

59 KB
60 KB

117ms
29ms

Script
text/plain

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://cst.cstwpush.com/static/adManager.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 , United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

d58f45d43c64a9e74e1c5dbcfd0e1a4f9470b3e0370acefc41cfc0413dbdf09b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:13 GMT
Connection: Keep-Alive
Last-Modified: Wed, 04 Aug 2021 12:36:23 GMT
x-amz-meta-s3cmd-attrs: atime:1628080568/ctime:1628080568/gid:0/gname:root/md5:bb2330a82b6a96ad7073331187d2577a/mode:33188/mtime:1628080524/uid:0/uname:root
x-amz-request-id: tx00000000000001e1f25cd-00611b50ca-1539526c-fra1a
etag: "bb2330a82b6a96ad7073331187d2577a"
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1629182773.dop014.sk1.t,1629182773.cds022.sk1.shn,1629182773.dop014.sk1.t,1629182773.cds231.sk1.c
Content-Type: text/plain
Cache-Control: max-age=933
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
Accept-Ranges: bytes
Content-Length: 60414

Redirect headers

location: https://cst.cstwpush.com/static/adManager.js
date: Tue, 17 Aug 2021 06:46:13 GMT
server: nginx/1.18.0
content-length: 169
content-type: text/html

GET
H2 200 plugin.min.js Show response
get.optad360.io/sf/1a65995e-7e07-43bd-8be2-2ee136ae3c03/ 271 KB
73 KB 125ms
7ms Script
application/javascript 2600:9000:21f3:b200:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/1a65995e-7e07-43bd-8be2-2ee136ae3c03/plugin.min.js
Requested by: Host: ja.nex-software.com
URL: https://ja.nex-software.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:b200:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d66e8fa87723046272ec70096a2089355c29474796663f65f2fdf9a27a1d4bc6

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:18:41 GMT
content-encoding: gzip
last-modified: Fri, 26 Feb 2021 08:39:38 GMT
server: AmazonS3
age: 1653
etag: W/"17e80f6c6feec0780f80abd32f10552b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: hftms4Heh5jcaV9hwsRvtvxZv3JDcIdGhp2PqUxDcKzsY0rYkFqKng==

GET
H2 200 cookie-consent.js Show response
www.cookieconsent.com/releases/4.0.0/ 165 KB
47 KB 111ms
39ms Script
text/javascript 2606:4700:3035::ac43:89ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cookieconsent.com/releases/4.0.0/cookie-consent.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::ac43:89ba , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

145e535a116897a926b998fab94438d6902bbd6309aede144d4f4980e35832e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 329
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 17 Aug 2021 04:58:25 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"248212dad7024f3d3acc49e9ccc8e68b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fF2X9DA%2FjetlYqKeW4whueH9vJYi3dwRmiqsGt0wGyK21jC8L9oAIP84SbssMjtXX%2FMHyQ5sQE%2FKK0Ni1vK8kXB2sFLpcXIdz%2BsVBPJetmp14Qb3sNZso8XHch1J9jyEL7TE41c0z%2Fq%2FtF3jo6EOYb02i80%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: public, immutable, max-age=3600
cf-ray: 6800f1af2a7596f2-FRA
expires: Tue, 17 Aug 2021 06:58:25 GMT

GET
H2 200 what-is-winmail-exe-min.jpg
pic.nex-software.com/img/file-info/793/ 50 KB
50 KB 104ms
92ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/793/what-is-winmail-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

975a10ed42941c10306d1962a1110b784988d68db600f4a5772866efd2e8c8fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 51179
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:06:00 GMT
server: cloudflare
etag: "c7eb-58d9f9d2f6a00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RvVf0ntCU0mwcTQQhurbf%2BHNKA1zWDfM%2Bb1WXnIsNAtGTNiympJHzrKV79NdVd1eouGHTZvieVqPLd%2B2IWacNUtB30oTPViTSFG41ezzDR%2BYrioc6XFXjB5ASYtjtvcuPh243zKk3yhuC9sU%2BnvPGoW%2BWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1aedf2a0eb7-FRA

GET
H2 200 what-is-wuauclt-exe-min.jpg
pic.nex-software.com/img/file-info/326/ 160 KB
161 KB 86ms
74ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/326/what-is-wuauclt-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc5414fc8c70a4f758c08d9a455ce95aedfeb3c1afb385a6d964edaeca52c550

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 164214
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:05:56 GMT
server: cloudflare
etag: "28176-58d9f9cf26100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2FrCMkFOh5GbmV8GVPyozggoFesst2NORBVkBL7bfRBfCB8Y4%2FUTLvCCxpY4Ewid6WTem0%2BeltRIBbzCnUvllLK0mVxq0h5jK4Qz2Sf1QMpqovVtOO0WycEWxWZGjZag%2BudJM63W%2F6KGt4XTsRqEIY8riw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1aedf330eb7-FRA

GET
H2 200 what-is-iastordatamgrsvc-min.jpg
pic.nex-software.com/img/file-info/138/ 55 KB
55 KB 78ms
67ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/138/what-is-iastordatamgrsvc-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ae0dd79ac2d1f4c513cba15e222cf52b4e7cd5f7ddc83a89e39d6a675536605

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 56301
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:07:10 GMT
server: cloudflare
etag: "dbed-58d9fa15b8780"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F7I35Nwbyce8mRUkZCoQC3%2Fhpw6di9Yie%2BgFhqnUONe21zwisrfhBeHwFX%2FM5%2FugzMVrunhjyZIoVuWywelEPhPi%2BX9D7u2acwPFxdlpqxmWJ1xgEpe66GeDUS2uoA6QjojyFyX8%2FBL1T0dVBa3Vz55v9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1aedf300eb7-FRA

GET
H2 200 what-is-updater-exe-min.jpg
pic.nex-software.com/img/file-info/423/ 39 KB
39 KB 53ms
42ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/423/what-is-updater-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

461a8b47cc2f47a256f3b98f71de2706d1d2673701ad17b61f0cc3e211e1c2aa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 39738
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:06:08 GMT
server: cloudflare
etag: "9b3a-58d9f9da97c00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9bS%2BOe4C9ngk7dhIJc9WPF23iJ2cLQ5iAy0mKzVhkovj%2BzQ3pbl8dWQAB6Mhk7K1UzOFl74oul%2FS2IXjULTsZRcZNdEuWrSxkTyDOhWmsgm7RymrTdXNk6KQDp32%2FuOEr4ashoaUIv%2BNfZB4pWYbxNOdKg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1aedf2e0eb7-FRA

GET
H2 200 what-is-mbamswissarmy-min.jpg
pic.nex-software.com/img/file-info/305/ 74 KB
74 KB 69ms
58ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/305/what-is-mbamswissarmy-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00a13aaedbe3f03428cb62a646dfd5b157923df36e1508f1e6cc017452537408

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 75657
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:06:58 GMT
server: cloudflare
etag: "12789-58d9fa0a46c80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nf3U2MCKZJgeSmi%2B1R8esLx9oYorW1Dv9uF23f2ElF9WqwqBUS9%2Bx%2BjEAvRKV1BC1xbJ%2BJ8dZ4BnvQIaPQgUAW9yGjQAHbA6a1qP1WvJxKyJjBjaC8DTvZDVOB9pUtliAa%2Bcb%2FCy%2FfmE7Jvq%2B2OXjh8kcA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1aedf2d0eb7-FRA

GET
H2 200 what-is-atiedxx-exe-min.jpg
pic.nex-software.com/img/file-info/148/ 33 KB
33 KB 56ms
45ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/148/what-is-atiedxx-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0a91d53d6be7643e4f45a784cd8d3cffa6b23542b76a36e9546ec4a80be886d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 33850
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:07:40 GMT
server: cloudflare
etag: "843a-58d9fa3254b00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lec6%2FPTMyo3sn%2Bfj8jbQCAIRNKYn01JonspVFpe3MOz0%2FZw5ahlSV4uAQszxlruKlB0s0nC2d12g7JvLgi8e9SkFeol81I9nuF%2Ba0W2ti7fvUiJHWDwxRAfYLN7e9cYSBZQUGe1nUqJ8BYkW9ZqG14Zv1w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1aedf2b0eb7-FRA

GET
H3-29 200 what-is-oneclick-exe-min.jpg
pic.nex-software.com/img/file-info/764/ 55 KB
56 KB 95ms
45ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/764/what-is-oneclick-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

febc5c128078aeb9daa4a4470a5a618f98fdb0c296480b83ea48840c5994ec25

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 56336
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:06:42 GMT
server: cloudflare
etag: "dc10-58d9f9fb04880"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XLG2qQIx7usFBkxAqnp%2FbpKTUiPxkCqdnBWs21TlmfC1u406dSCnP1o7cQAuoYKOvtYTHk3XGcNWI65dOW7OH6RUCgAXDPXKqn%2FKWBP27BVAOltOf3FmpfJDYxUn01KcFrlztB87mpB4UcswG1GRPJTcBA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf14e86-FRA

GET
H3-29 200 what-is-imf-exe-min.jpg
pic.nex-software.com/img/file-info/227/ 404 KB
405 KB 70ms
20ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/227/what-is-imf-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81ed7e5d0fec417e9a01b2fd5fd99591b7571f074492e133dd087355a2722c17

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6219
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 413551
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:07:06 GMT
server: cloudflare
etag: "64f6f-58d9fa11e7e80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WOi2mHeLV880wDQPZhGCjE7F6Hy0skGGadvL%2BJwOlo5yry1eXO%2FvkOKGzTgAkFj3AE5Ecx2A%2BWrAMRjk%2BehNSNxy1nqct06ziZIKVjKhEESr0TyrO83WsyNaSX1rh2JpD%2BsSCz8wM7DFFmLAdLomXnbgyw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf24e86-FRA

GET
H3-29 200 what-is-nvcontainer-exe-min.jpg
pic.nex-software.com/img/file-info/32/ 28 KB
29 KB 112ms
62ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/32/what-is-nvcontainer-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3085321cac4d11009cd0a8f0db8241e1b012dda3a6817547e14b96f4cf2921fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 29171
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:06:46 GMT
server: cloudflare
etag: "71f3-58d9f9fed5180"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hscXidgjmOOSFGhglhva8L0txm1fkt4h4S8E6VRJG%2FEJtw5h%2B4j7FSVotFoVXs978tm9XSx1scDuMELNajWz0qHt8lwN52%2Bc7ihpb9%2FlSNv2IkMoeBKz3Pgw2JuX2bGzj2NSmhgjnA4dX5oeK5stzwZZVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7ced4e86-FRA

GET
H3-29 200 what-is-svchost-exe-min.jpg
pic.nex-software.com/img/file-info/110/ 41 KB
42 KB 130ms
78ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/file-info/110/what-is-svchost-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b0a41340d5c21cc6093bd231c6ae6b60c719ecaa4216b8f518abd585a84ac1b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 42331
x-xss-protection: 1; mode=block
last-modified: Sun, 14 Jul 2019 08:06:16 GMT
server: cloudflare
etag: "a55b-58d9f9e238e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KTittoUsj7wFmOaCy07L%2BxEIkbJeg8%2FcVKl4LnMEEd0KSnQWe%2F05xSDmWv1cZ5z4GGGz1%2BXSnfO7pAkfB7rFkGt2cvoDMWVbcBbJNhi57CU65LRdnkYI7yQ8rPaS%2BwkzEcogWTAmVLjen6%2BGE%2F795Bjz%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7d004e86-FRA

GET
H3-29 200 what-is-adksetup-exe-min.jpg
pic.nex-software.com/img/process-information/3232/ 26 KB
26 KB 128ms
77ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/3232/what-is-adksetup-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54a7df35a8c8e4c046fb79e095b6ea595e76c67e07997dd5b864d0bbe00cf192

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 26199
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:13:50 GMT
server: cloudflare
etag: "6657-59e2beff2c380"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x8ZewT7NOlvkLMyjWSx5Li%2FWfhhN6HVPKNpgq84cYRXsntBjMi%2B60hxA%2FkfmAqL9wEjQ1H6O4orqPjveB6lo%2F3fNx03wlo7p6ZlcTR%2FZUU3RtDmngLeHSQ%2FEIP1FszisPW%2Bx3PXX8NT9CvlEjuqsELuL7A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cff4e86-FRA

GET
H3-29 200 what-is-netman-dll-min.jpg
pic.nex-software.com/img/process-information/2565/ 36 KB
36 KB 116ms
66ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/2565/what-is-netman-dll-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bb6f53895da3cfe7ef0e813289039054d08b77515b3ededd0e2d110dcd04896

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 36727
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:11:04 GMT
server: cloudflare
etag: "8f77-59e2be60dce00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UokIOci9WDz6XDhHI9z%2Fyt8V7ehu7R8F0Lrlt%2Fdq4guceY8N2xfPpv0R5LJB%2FBCMmsQB6Bk40two8nYehHdINM49LUX3a0%2BjF14pI0BWTdVZig6FjaKQbfYtghKVRz83N8oFV6sp7ODOFdC3beQHUmh3hA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf54e86-FRA

GET
H3-29 200 what-is-googlechrome-min.jpg
pic.nex-software.com/img/process-information/3906/ 88 KB
89 KB 113ms
64ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/3906/what-is-googlechrome-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8dc446970b78c504c520fa08da9cc8fc76f40de8dcd3c0bd5e845db5687c7872

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 90450
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:12:12 GMT
server: cloudflare
etag: "16152-59e2bea1b6700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bl7NQpJ6G88031cz5W3D2WlC0Jm0g%2Bepfh6T5Z%2FobdTed%2B4L5Fyn%2F35CrE6B0Ch0zHeZJo5zMevDPufpzYWOII7%2BpBucpFLE%2FmIkvXvFPLz7fvG3iKqANPoRaXPB4rsR%2BoFGewyTHqVLmMoUnVvVGSJLxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf44e86-FRA

GET
H3-29 200 what-is-mpc-hc64-exe-min.jpg
pic.nex-software.com/img/process-information/3009/ 33 KB
33 KB 113ms
63ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/3009/what-is-mpc-hc64-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db80a17f39d8cd2ad5f8f17548eb20bfd67f6f987f611690dd71759850407302

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 33449
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:11:16 GMT
server: cloudflare
etag: "82a9-59e2be6c4e900"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DhhCvy5XamXKim%2B5s%2Blz1AsPvJ%2F1%2BjpRM71NeqBItF3R3NfROtIVmPt5FvzbfEq19Fu%2BMghiP%2F0KbvVgEYkr89ZnTK2tjEyupCOYRoH1GS%2FmJzwF1Ie6gbDuOwcrN5QAJXFBnyDtFVFdfOB2QOfT6q7oZA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf34e86-FRA

GET
H3-29 200 what-is-internet-download-manager-min.jpg
pic.nex-software.com/img/process-information/961/ 181 KB
182 KB 119ms
69ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/961/what-is-internet-download-manager-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35dfcb01734a60a61747c210a2f762b5a6421576bcdb65ebc912fd5d520c422e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 185334
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:11:50 GMT
server: cloudflare
etag: "2d3f6-59e2be8cbb580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BOKCVDZK6%2BBMhhS838n9usl3o%2Bo7XTTqaIZYEPVr%2BAKK7zadm67QMoapDlsY8x8l0UqHZkwm7y1nL%2BvxXpctqcnVtMPGX63QSh6IDybKcWMR7J%2BrgRdezRKPc3AZdqsjABLLgHxCz3A4OgFt8ZFMny9Vjw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cfb4e86-FRA

GET
H3-29 200 what-is-securityservice-min.jpg
pic.nex-software.com/img/process-information/2406/ 17 KB
18 KB 119ms
69ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/2406/what-is-securityservice-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13c3073a15f1fd4ea1dd512f48a88fec6b979cf2812e87a269c310b64ac2f4b3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 17873
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:10:06 GMT
server: cloudflare
etag: "45d1-59e2be298cb80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B1wiIdV6002487vFd4nMMkxqKRL4veDdRAfSpWD%2BV1UwCfKtPvtq6insZyRnkq1qT9gvaow2uUjvBcu3Z9cWGKJNtjv8EemIukHv3T%2BiBTajmWZ64iEmflnJ3RV0fB%2BNmmDaeyqkyS7U59PRnGoDbo%2BOKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cfa4e86-FRA

GET
H3-29 200 how-remove-silverlight-runtime-virus-min.jpg
pic.nex-software.com/img/process-information/1597/ 20 KB
20 KB 117ms
68ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/1597/how-remove-silverlight-runtime-virus-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79ce62849b956c8d7b315fd18445b733c20dc5dfc2f9614004681bb476151817

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 19991
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:14:04 GMT
server: cloudflare
etag: "4e17-59e2bf0c86300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FuwPBe48p%2B86%2BG6lsTlzBxDKLWs%2FOqFAitBmMwLReaJ8Hnal7CZBEbYvB4M3NuMgpm7jtEJhd7z4eYT40IxGBmJDhx3AU6J0t1siU3Eq0eBeDC5Ljc2a5ysCQwlghCyYO9rkvLD9DT6eFdXJebAXpPhDeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf84e86-FRA

GET
H3-29 200 what-is-system-transparency-min.jpg
pic.nex-software.com/img/process-information/2017/ 24 KB
25 KB 116ms
68ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/2017/what-is-system-transparency-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f9bc21de359659367b891227e48303c7daff14cefb2a1e677a8c8e6f22340e0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 25005
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:09:42 GMT
server: cloudflare
etag: "61ad-59e2be12a9580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZLUBooKqC11IV8PeSL9XusgCfd5Oq9%2BZcQ%2B3E8NiTyPpp60cV0SN4TJKSKSIv0t%2BKshw%2B9PUqckcPECGbitye7y8ULCYwGX3SjXl1%2BhiPK4c2knUCZNb568iCIa8NLdsSlzRDRodCun%2FHie7RtcQKe4Y6g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cf64e86-FRA

GET
H3-29 200 what-is-mt-exe-min.jpg
pic.nex-software.com/img/process-information/3837/ 132 KB
133 KB 121ms
73ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/3837/what-is-mt-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4aedadeea0464ebdc596a23facf171d24c974aa1d89ca897bc23831ccb6dd132

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 135373
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:11:10 GMT
server: cloudflare
etag: "210cd-59e2be6695b80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FnaxmSFmeespEsgHgK1b14LzI86O8%2BZDVLfDmMgCoiqGoTT9lYRmN%2FpMqT75e8hCW1egQljmiWNJwGctbINJkY4GVaNj8We8pxTFZCY5i2%2FpIungsrrTP1WMaaI0BtfnJ2kj6tAqjEjEl6A5z0%2B90mpKHw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cfe4e86-FRA

GET
H3-29 200 what-is-regsvcs-exe-min.jpg
pic.nex-software.com/img/process-information/2893/ 44 KB
44 KB 120ms
72ms Image
image/jpeg 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pic.nex-software.com/img/process-information/2893/what-is-regsvcs-exe-min.jpg

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8f43ca59b5c9d938363eb5c52a57ea760922788ce212e5f4d037bcd048c42ff

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 44900
x-xss-protection: 1; mode=block
last-modified: Sun, 09 Feb 2020 22:10:20 GMT
server: cloudflare
etag: "af64-59e2be36e6b00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uINhYvX0OSZEbji%2FyBkQCcZsc%2F5bXX1w%2FJ0wTn7%2BIi8%2BidzdQ7EUxPzfwZWqCGTXUDzTkz93MRF%2FP8S0jyzfZRHDr8FMXfnpQNgKREitYwfy%2BzUuBaPmEHlDq4l80bQQPFJozIK4%2BfC3kIQOkZy86fxoSA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1af7cfd4e86-FRA

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 185 KB
42 KB 191ms
58ms Script
text/javascript 65.9.73.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://platform-api.sharethis.com/js/sharethis.js
Requested by: Host: ja.nex-software.com
URL: https://ja.nex-software.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.73.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5f326d425eb729c44346ed04c6d645df7674684679d2a835ab07e538c7f8a2e0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:44:07 GMT
content-encoding: gzip
age: 126
etag: W/"2e4d1-HFFNdJQug8j8qBzOmH/AL75+DmM"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: HJ1w2LRs_HDmgcE5P851ACE4R2zySoYZa0SRk3ZZrtMmEU7c6GL06w==

GET
H2 200 jquery-3.1.1.min.js Show response
nex-software.com/template/js/ 85 KB
31 KB 45ms
35ms Script
application/javascript 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/js/jquery-3.1.1.min.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1653
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"152b5-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T9aNUAZDZM5w3MReMFOXuYBOLPKPu5obZJEmIWnr3hnZFTrFin%2F1nT1TLrcILGh6VVFLFlLabISYWSRQQBVAnI%2Bnzb7h%2Bs%2FfV%2F13rnkVwKJ3PopkjG45T8H9solEaFzWTH6yLY1EQLuJBezamjuJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1aedf290eb7-FRA

GET
H3-29 200 jquery.slicknav.min.js Show response
nex-software.com/template/js/ 8 KB
3 KB 117ms
51ms Script
application/javascript 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/js/jquery.slicknav.min.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

190402f488a1616b47304ae066078580059ca6a5958b7f217d2156d0a73931a9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"20df-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BdbcKilJQlcrQkgAXxWIIcetiI73ssJhKC7VvaZknZUlVlgAkaH7omPdOyrrl%2BnFUmvjTkwkksNpVlKJLNIOIvUqC%2BlYBMIRnGUC8p5XT7HYkI5WIg70p%2FhDrFSQ802yKoEpuQcwIZrLSNdJUdPx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1af6cd74e86-FRA

GET
H3-29 200 jquery.bxslider.min.js Show response
nex-software.com/template/js/ 23 KB
7 KB 129ms
63ms Script
application/javascript 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/js/jquery.bxslider.min.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7731d577c5dfa5f38e9bf82dedae51174c9ddd4d3d4668eea9d1e51d6ce13d66

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5bf7-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FhWpko7all3PTajltw%2BFkldjctsI7ktoyfjoA0OcG5jweDa5CdxG3PU8rKVr75zj3wMgueVksrz8V9xtmpxEJEL1o0cBZnZCc3anxnCCT1GxP%2Fgnylj7B9rPuk%2FoxO%2B70727dsZXP8T8n7P11xcm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1af6cd54e86-FRA

GET
H3-29 200 script.js Show response
nex-software.com/template/js/ 2 KB
1 KB 111ms
46ms Script
application/javascript 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/js/script.js

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

900e0d4503dfe926c2d74a1944f4e383d9d7573ecfcccba2dbb377f3be116a10

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"63c-581b2cc948300-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bNomFrlE9ZSHXKFcrMKVBPG3MN%2FcBemY5WjRXfB%2B6CwHLePjTvSF50meXp5rUd7%2FPJ9qc58Nx21gnomI2cSNtr8f3XQlxWrnVzvBOV3QVG5AM%2BheWxs2WkqpnNCcY8WW1vD02tDz%2F2A5kUJQLz%2F5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 6800f1af6cd34e86-FRA

GET
H2 200 abs.js Show response
cdn.zx-adnet.com/adx/ 200 B
230 B 28ms
27ms Script
text/javascript 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.zx-adnet.com/adx/abs.js?

Requested by

Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/brmsl_19102402.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9be45d830a633e050edaa82361e4ecac3cc189b3a3975a41aa01ae3cb4e4120b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31556926
content-encoding: br
last-modified: Wed, 28 Jul 2021 19:40:29 GMT
x-timer: S1629182774.736904,VS0,VE1
etag: "437b8edcf8ac42ac5e7961966dea7cee69a38a82519efa00f6f37a753caad24c-br"
x-served-by: cache-bma1646-BMA
vary: accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600,public
date: Tue, 17 Aug 2021 06:46:13 GMT
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noarchive
content-length: 118
x-cache-hits: 1

GET
H2 200 checkabuse Show response
cdn.zx-adnet.com/ 74 B
387 B 237ms
236ms Script
text/html 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.zx-adnet.com/checkabuse?surl=https://ja.nex-software.com/
Requested by: Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/abs.js?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Google Frontend / Express
Resource Hash: ff0ae836e78e254c691d18c04b2068e14419275cb170cd7c09587f1795114fcc

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
content-encoding: gzip
x-powered-by: Express
x-cache: MISS
content-length: 85
x-served-by: cache-bma1646-BMA
server: Google Frontend
x-timer: S1629182774.770254,VS0,VE211
etag: W/"4a-U3myf635cTml8/jliRIqPS6GEqY"
vary: cookie,need-authorization, x-fh-requested-host, accept-encoding
content-type: text/html; charset=utf-8
x-cloud-trace-context: 0f7284de782041735b9249dfc96db749
cache-control: max-age=3600,public
function-execution-id: af7mjzd1ea1e
accept-ranges: bytes
x-orig-accept-language: en-US
x-country-code: SE
x-cache-hits: 0

GET
H2 200 1350 Show response
na.nawpush.com/tags/ 240 B
355 B 88ms
28ms XHR
application/json 213.174.135.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://na.nawpush.com/tags/1350
Requested by: Host: cst.wpu.sh
URL: https://cst.wpu.sh/static/adManager.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: f7697cdbdb20e0d5d8fd4ef811c57418dcdcace4012fa556ca66c41f8d2be01c

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 17 Aug 2021 06:46:13 GMT
cache-control: max-age=300, public
content-type: application/json
server: nginx/1.18.0
content-encoding: gzip
x-proxy-cache: HIT

GET
H2 200 wp-banners.js Show response
vasgenerete.site/npc/sdk/ 0
239 B 78ms
25ms Script
application/javascript 213.174.135.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://vasgenerete.site/npc/sdk/wp-banners.js
Requested by: Host: cst.wpu.sh
URL: https://cst.wpu.sh/static/adManager.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
last-modified: Wed, 04 Aug 2021 11:35:07 GMT
server: nginx/1.18.0
etag: "610a7b6b-0"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 17 Aug 2021 07:46:13 GMT
cache-control: max-age=3600
accept-ranges: bytes
content-length: 0
x-proxy-cache: HIT

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2
nex-software.com/template/css/ 18 KB
19 KB 45ms
36ms Font
application/octet-stream 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/JTURjIg1_i6t8kCHKm45_ZpC3gnD_g.woff2

Requested by

Host: nex-software.com
URL: https://nex-software.com/template/css/css.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e43d592d0aa592f24ad510ef3f453a51bba24a9534a07a55a9685b4d4b3f2cb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://ja.nex-software.com
Referer: https://nex-software.com/template/css/css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 18728
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
etag: "4928-581b2cc948300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dQeXoA%2BbF3ppvbf6iEC1zmsmTQ4nMNXCNh2SnqDkLl3hr79ntTjqt8zBSxKxyOIf%2FW63nAFcFUtWGQkGmroyHenqkQtYCMHnPYXiCo6V5nrRijwxDAw0CusVnAz5wswZqhe8ffdK36CAEIOWxexP"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1b1089142f1-FRA

GET
H3-29 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
nex-software.com/template/css/ 18 KB
19 KB 51ms
42ms Font
application/octet-stream 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: nex-software.com
URL: https://nex-software.com/template/css/css.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ab7918478793ceb022d3f5449e401b44b78d87bc4429058ebb8b64163640da2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://ja.nex-software.com
Referer: https://nex-software.com/template/css/css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:13 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 18684
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
etag: "48fc-581b2cc948300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mqlfhnMWUxdBBaOMtIVhwabrbTpRL3bBAsmK%2Fah%2BLZl%2Fo4Mtqsy8WSMM0TSQVziQIpJ3d%2B57C1eIIXz44%2FDkPu%2FXsF1QJi%2FwrxbBdh10shbA0ukYsYanU3MQ1bg9S2AO%2BFqBSTiiPA4eqJRYkBLB"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1b1089542f1-FRA

GET
H3-29 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
nex-software.com/template/css/ 19 KB
19 KB 43ms
43ms Font
application/octet-stream 2606:4700:3034::ac43:cc49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://nex-software.com/template/css/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: nex-software.com
URL: https://nex-software.com/template/css/css.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:cc49 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

746589ecfb4406519933a6aea5f1149224afcba81e3c3ef0541e7ad6c8111b7e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://ja.nex-software.com
Referer: https://nex-software.com/template/css/css.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:14 GMT
vary: Accept-Encoding
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 18956
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Feb 2019 13:57:00 GMT
server: cloudflare
etag: "4a0c-581b2cc948300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iXtW%2Fv5DS2m50nsU%2B669RaSjF9dVVeXl8y8YybyRHD%2FZhsgrveosfu6yI6Jr8Ufj8G9ce3gCeqZ%2BJ1Sg1LAWiWT3RrDx8D6DtbCbIvSPfcnbTajbSR2HOx0H%2Bq2AOMOCesn6tJkXEwzmJcsE9mXa"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6800f1b179c242f1-FRA

GET
H/1.1

200
OK

hit
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit?r;s1600*1200*24;uhttps%3A//ja.nex-software.com/;0.910337494940566
https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//ja.nex-software.com/;0.910337494940566

43 B
528 B

44ms
44ms

Image
image/gif

88.212.201.198
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//ja.nex-software.com/;0.910337494940566

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

88.212.201.198 , Russian Federation, ASN39134 (UNITEDNET, RU),

Reverse DNS

host198.rax.ru

Software

nginx/1.17.9 /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:18 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Access-Control-Allow-Origin: *
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 16 Aug 2020 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:17 GMT
Server: nginx/1.17.9
Strict-Transport-Security: max-age=86400
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit?q;r;s1600*1200*24;uhttps%3A//ja.nex-software.com/;0.910337494940566
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Sun, 16 Aug 2020 21:00:00 GMT

GET
H2 200 5c086b7ea71f090011aea084.js Show response
buttons-config.sharethis.com/js/ 434 B
786 B 46ms
13ms Script
text/javascript 2600:9000:2190:b400:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons-config.sharethis.com/js/5c086b7ea71f090011aea084.js
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:b400:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d2fa83bbc70c843df2edd43096821128aa1f4bd404237f614c49cd48e7d5cfa3

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:45:40 GMT
via: 1.1 c07945b00aad28e34fbfebb3d3907061.cloudfront.net (CloudFront)
last-modified: Thu, 06 Dec 2018 00:24:07 GMT
server: AmazonS3
age: 62
etag: "8f8c95d8315dedb8a7c82f24235b706f"
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=60,public
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 434
x-amz-cf-id: itzEO0oYVEGid9z_1UHODu-ng7kr5urvicSIrMJ81dEDUgiWI2UYXg==

GET
H/1.1 200
OK / Show response
stat.optad360.mgr.consensu.org/ 20 B
286 B 158ms
50ms XHR
text/html 18.196.233.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.optad360.mgr.consensu.org/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/1a65995e-7e07-43bd-8be2-2ee136ae3c03/plugin.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 18.196.233.38 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-233-38.eu-central-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2e874225f7f8c8d6f2c8f3c6db0a2e4ed30410548114496260d3ab45b9381c3b

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 17 Aug 2021 06:46:14 GMT
Content-Encoding: gzip
Server: nginx/1.14.0 (Ubuntu)
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 72 KB
25 KB 191ms
72ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/1a65995e-7e07-43bd-8be2-2ee136ae3c03/plugin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

sffe /

Resource Hash

a689d270302f566a62de3a558b0bbd5c4b345025ec97b1a27f84b7ff16d967b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "961 / 705 of 1000 / last-modified: 1629151938"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25243
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:14 GMT

GET
H2 200 prebid4.19.0.js Show response
get.optad360.io/sf/ 410 KB
411 KB 13ms
13ms Script
application/javascript 2600:9000:21f3:b200:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid4.19.0.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/1a65995e-7e07-43bd-8be2-2ee136ae3c03/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:b200:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 257579348172eb9f739308373580772054c0b671f63e8f002aed9f9774a6272e

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 22:19:02 GMT
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
last-modified: Thu, 17 Dec 2020 09:52:06 GMT
server: AmazonS3
age: 289633
etag: "08b0612ac0c68ebf519b28323f4e2aa2"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 420147
x-amz-cf-id: y3ZyJFLzb0B_k-xp_N4yszoxpGPg1-GVsyg_8_FJM_2UfTnGcymlbA==

GET
H2 200 csub.js Show response
js.wpushsdk.com/npc/sdk/wpu/ 8 KB
3 KB 85ms
26ms Script
application/javascript 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpushsdk.com/npc/sdk/wpu/csub.js
Requested by: Host: cst.wpu.sh
URL: https://cst.wpu.sh/static/adManager.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 / PHP/7.1.28
Resource Hash: f64872de90e08a3d7ea1d1ffff973fc88f983afd6d7d545d447fea5305c6fdc1

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:14 GMT
content-encoding: gzip
server: nginx/1.18.0
x-powered-by: PHP/7.1.28
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 17 Aug 2021 07:46:14 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 portal-v2.html Show response
c.sharethis.mgr.consensu.org/ Frame E498 2 KB
1 KB 46ms
12ms Document
text/html 2600:9000:20eb:3400:c:a9b7:ddc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/portal-v2.html
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:3400:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8bc62c9ef81390af989b3829ace60aae916e299dab9df7ec5e49db2d07a956b6

Request headers

:method: GET
:authority: c.sharethis.mgr.consensu.org
:scheme: https
:path: /portal-v2.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

content-type: text/html; charset=utf-8
content-encoding: gzip
date: Tue, 17 Aug 2021 05:55:32 GMT
cache-control: max-age=3600, public
etag: W/"865-g9QqzjbIJI1xmvSY3DM2A/8Cpl8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 1ac3fd533bf6be1b511077f8b8e23bfd.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: 7NMoaBq80mU1zZglrjhozo-UPD94o8AE2Jdgp7mX33bRYgByDFbSJg==
age: 3042

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 20ms
6ms XHR
application/json 2a04:4e42:3::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20210817

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid4.19.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c3c48ad290a46eda56ea9897bf96038e1d5e209ace2877eeaaf782ee3bb03cda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 12833
x-jsd-version: 1.0.1071
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 957
etag: W/"69f-uBKAeygTdq/T3cXjcDbsb9Ctgso"
x-served-by: cache-fra19140-FRA
x-jsd-version-type: version
date: Tue, 17 Aug 2021 06:46:14 GMT
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
341 B 206ms
52ms XHR
text/plain 3.124.181.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/pview?event=pview&hostname=ja.nex-software.com&location=%2F&product=unknown&url=https%3A%2F%2Fja.nex-software.com%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=%E6%9C%80%E3%82%82%E4%BA%BA%E6%B0%97%E3%81%AE%E3%81%82%E3%82%8B%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E3%81%99%E3%81%B9%E3%81%A6%E3%81%AE%E6%83%85%E5%A0%B1&cms=unknown&publisher=5c086b7ea71f090011aea084&sop=true&bsamesite=true&consent_cookie_duration=108&consent_duration=108&gdpr_domain=.consensu.org&gdpr_method=cookie&version=st_sop.js&lang=en
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.181.115 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-181-115.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:14 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://ja.nex-software.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H3-29 200 pubads_impl_2021081201.js Show response
securepubads.g.doubleclick.net/gpt/ 329 KB
115 KB 131ms
68ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

sffe /

Resource Hash

01e51940762b45561e5a0c1ea5e5ad122f4c732178d0cb428f8f4409030efb13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 12 Aug 2021 08:42:15 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117424
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:14 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 38 B
78 B 127ms
65ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=ja.nex-software.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ee513a593bfdf11b5ad487228634ca0278032204b4c885e835a721fd4529587c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 06:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:14 GMT

GET
H2 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
853 B 136ms
48ms Script
application/javascript 2a00:1450:400f:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=ja.nex-software.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400f:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 06:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 35ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ja.nex-software.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 06:46:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 821ms
821ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=36231473746780&correlator=4181887379016738&output=ldjh&impl=fif&eid=31062141%2C31062284%2C20211866%2C31062180%2C31062297&vrg=2021081201&ptt=17&sc=1&sfv=1-0-38&ecs=20210817&iu_parts=121764058%2Cnex-software.com_SF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C750x100%7C970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1629182774&dt=1629182774856&dlt=1629182773559&idt=1220&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1200&adks=1465975555&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fja.nex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=728x-1&ga_vid=1958954451.1629182775&ga_sid=1629182775&ga_hid=786973179&ga_fc=false&fws=640&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

fbf04c13bed8be2265361dbdf20b10726f755910f01af479fbb146a35434f58c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8280
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ja.nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F8E0 6 KB
3 KB 47ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 17 Aug 2021 06:46:14 GMT
expires: Wed, 17 Aug 2022 06:46:14 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 66 KB
19 KB 441ms
441ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=36231473746780&correlator=4181887379016738&output=ldjh&impl=fif&eid=31062141%2C31062284%2C20211866%2C31062180%2C31062297&vrg=2021081201&ptt=17&sc=1&sfv=1-0-38&ecs=20210817&iu_parts=121764058%2Cnex-software.com_adi_ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C970x250%7C970x300%7C728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1629182774&dt=1629182774862&dlt=1629182773559&idt=1220&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=414&adks=2352026754&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fja.nex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=970x0&ga_vid=1958954451.1629182775&ga_sid=1629182775&ga_hid=786973179&ga_fc=false&fws=128&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e090280320be0f1b08e3afdb1773a5856ac4622bb536012d9c0fc47909255096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19632
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ja.nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 13 KB
7 KB 1021ms
1021ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=36231473746780&correlator=4181887379016738&output=ldjh&impl=fif&eid=31062141%2C31062284%2C20211866%2C31062180%2C31062297&vrg=2021081201&ptt=17&sc=1&sfv=1-0-38&ecs=20210817&iu_parts=121764058%2Cnex-software.com_am_S1&enc_prev_ius=%2F0%2F1&prev_iu_szs=750x100%7C750x200%7C750x300%7C300x250%7C336x280%7C360x300%7C580x400&cookie_enabled=1&bc=31&abxe=1&lmt=1629182774&dt=1629182774865&dlt=1629182773559&idt=1220&frm=20&biw=1600&bih=1200&oid=3&adxs=283&adys=1325&adks=439637098&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fja.nex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=750x0&ga_vid=1958954451.1629182775&ga_sid=1629182775&ga_hid=786973179&ga_fc=false&fws=128&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

81ad7185e5948313fcdb09d75a9a5308ea5955ac81adaa6bf6cf0fc963eb5df9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7507
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ja.nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 463 B
272 B 239ms
239ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=36231473746780&correlator=4181887379016738&output=ldjh&impl=fif&eid=31062141%2C31062284%2C20211866%2C31062180%2C31062297&vrg=2021081201&ptt=17&sc=1&sfv=1-0-38&ecs=20210817&iu_parts=121764058%2Cnex-software.com_adi_W1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C200x600%7C300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1629182774&dt=1629182774868&dlt=1629182773559&idt=1220&frm=20&biw=1600&bih=1200&oid=3&adxs=1123&adys=1427&adks=2071077498&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fja.nex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=300x0&ga_vid=1958954451.1629182775&ga_sid=1629182775&ga_hid=786973179&ga_fc=false&fws=128&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

2fa06661a3d8360c53e9efab58c7ca0396a589b2d7ddfc56570f3d34924c26a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ja.nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 13 KB
7 KB 632ms
632ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=36231473746780&correlator=4181887379016738&output=ldjh&impl=fif&eid=31062141%2C31062284%2C20211866%2C31062180%2C31062297&vrg=2021081201&ptt=17&sc=1&sfv=1-0-38&ecs=20210817&iu_parts=121764058%2Cnex-software.com_adi_right&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1629182774&dt=1629182774871&dlt=1629182773559&idt=1220&frm=20&biw=1600&bih=1200&oid=3&adxs=1123&adys=466&adks=3709533993&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fja.nex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=300x0&ga_vid=1958954451.1629182775&ga_sid=1629182775&ga_hid=786973179&ga_fc=false&fws=128&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

3fd76622a2a4239c03b2ee1e968ea25c04510ff17d8d77398c25ad4cd9b721a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7616
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ja.nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 41ms
21ms XHR
application/json 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021081201&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe1b12827d390be054afbe03c42584fffb7f606c42b35e10928a4f4e5411e1ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8581
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 57ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 0AF9 12 KB
5 KB 21ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Mon, 16 Aug 2021 17:09:25 GMT
expires: Tue, 16 Aug 2022 17:09:25 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 49010
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 87C8 783 B
834 B 16ms
15ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

80f5cd7e58eac60ed06a804d88dd0b32c0d973cd44bd30535602009af770dbc8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HGSN5jLDgTUfh+/I1WnaIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

expires: Tue, 17 Aug 2021 06:46:15 GMT
date: Tue, 17 Aug 2021 06:46:15 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-HGSN5jLDgTUfh+/I1WnaIQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js Show response
pagead2.googlesyndication.com/bg/ Frame 0AF9 35 KB
13 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0239bfd43728e85cc93174d290d229af26b978e2a325070598bbcee72d075b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 00:17:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13491
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 00:17:46 GMT

GET
H3-29 200 container.html Show response
caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 18BD 6 KB
3 KB 20ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 17 Aug 2021 06:46:14 GMT
expires: Wed, 17 Aug 2022 06:46:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
28 KB 43ms
23ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe4436f1d882b3acd98fb2763984bacd382664582f4918647b89894f46b871

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113446242536"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27733
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 18BD 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:44:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 11770686601635027189
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:44:13 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 18BD 8 KB
809 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 17 Aug 2021 05:42:12 GMT
server: ESF
date: Tue, 17 Aug 2021 06:46:15 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/ Frame 18BD 14 KB
3 KB 28ms
6ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.css

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 11 Aug 2021 20:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 470004
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 19:09:16 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 20:12:51 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/ Frame 18BD 355 KB
123 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

744b144a1c71e20f0abbd0169cda5a929525b8a6446895322efeb987f82b9bd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 11 Aug 2021 20:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 470004
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126259
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 19:09:16 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 20:12:51 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 18BD 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:27:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:27:01 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 18BD 0
0 15ms
14ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSSSSkW-4x17j6JUdUJe5wBrUSGUaStdGFkTubDFRiJVJrcjcySO-ptRe3rK5hneaKIvC5ImdT2-SOqaLKqS5t6samc8Q
Requested by: Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ Frame 18BD 0
348 B 34ms
13ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~ksfpcyvt&c=4382265454967&slotId=2191132727483.5&qqid=COeR1eS6t_ICFd-K_Qcd7GgFLw&fb=outstream-lima&sei=44729911%2C44730425%2C44730426&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 18BD 15 KB
16 KB 25ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 12:00:01 GMT
x-content-type-options: nosniff
age: 585974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 12:00:01 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 18BD 15 KB
15 KB 23ms
10ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 44391
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 18:26:24 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18BD 0
20 B 28ms
27ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CWoXBN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAcgDmwSqBN4BT9CG5q2IiWqR9RKp5iKX_qQKAM1Sr7pibBps3-IDHw11ypo2QB5IJMC6mxKzg1K0uhixFVxl91yaeQ_BP_mghHaegtMhTbfzNWDoTXaXnCZspBb5e9DbndFz3NbMkY2NXo8Dz7FH7BXJh4ziJTWyCjxgZPfAk7TIZMgtwOpa90IUuV-y7u1PZYgIydDD3p6Jp_TkS-38rTAAJhhI9o7mVOiLrRcyI_EDovqv4HUJGepoSPNJlbt3wuBEznM0CBwYGaCO395Rm99a1_Ji4bPXe83HDPav3W4fIGaDIoYBwATZ1-Cf2APgBAOQBgGgBk6AB5qq2jWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE7nslwzIE-6h4t0D0BMA2BMKiBQD2BQB0BUBgBcB&eventType=clickstring&clientTime=1629182775455&ai=CWoXBN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAcgDmwSqBN4BT9CG5q2IiWqR9RKp5iKX_qQKAM1Sr7pibBps3-IDHw11ypo2QB5IJMC6mxKzg1K0uhixFVxl91yaeQ_BP_mghHaegtMhTbfzNWDoTXaXnCZspBb5e9DbndFz3NbMkY2NXo8Dz7FH7BXJh4ziJTWyCjxgZPfAk7TIZMgtwOpa90IUuV-y7u1PZYgIydDD3p6Jp_TkS-38rTAAJhhI9o7mVOiLrRcyI_EDovqv4HUJGepoSPNJlbt3wuBEznM0CBwYGaCO395Rm99a1_Ji4bPXe83HDPav3W4fIGaDIoYBwATZ1-Cf2APgBAOQBgGgBk6AB5qq2jWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE7nslwzIE-6h4t0D0BMA2BMKiBQD2BQB0BUBgBcB

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 18BD 29 KB
14 KB 197ms
82ms XHR
text/xml 142.251.5.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-COkoXrTexFLs-uGX9C9mwyz3wV3wuLX499P1abSW9Q1FA8YBqTsDu3cak1vO369jRf_stjDOdvxhLyNi2f6wDxKR_WSw&dbm_d=AKAmf-CVLyyK1DkFC9fPXQjjhNnyi-Shbj_xBMeBXjJFCCYvLf1V_VJRC3HEVv5v-Om6E2uwVAQcHeW6s665oSx-Bez6ctX6-1kgZUw6FWh14KEfTTZi6VhwjgsNRJi-mV_zNLl2n31AUNmc8u9uDL30FwasJoDnwXwqPs30DpPAMk8OMvSPtH_ul99T8iRrR6PvHCp3-TWzY-nit_Q7fWf2VELOxjD97RlenO_nyn7PpMKfvE3TUDtSGtDil-R3GAIkOKDegX8dFQEhQYHTIJYqRJKLaiciZKiaUvbr9dg-w504k76u251FiP5upR61vzF6m2ukkT8f5H6ylYNWS7HWUxOty4HY0TQp8TNxeDc9ejFPLPxqzgrT718l2JUeHCWEww27a1-MoUOj9Iz2iRF-1yfOQOz9kaZxNhwb4SxPdadgZkXOzM6OcCPQWWwL2ZrnHz-C4i2g8mn5pqVy_Dn0Rw8oUQpoTmMUcmUrtzg3t31GZV2AqDY31zWyCiXMyL5GAht23YzTtHrCaaQgEsW5DtHoa-bDpl0ERvLePV5ktxnTnVGpbp7a-Pkou0Xz1db6agN7lctJIEhow3Zy9uej9tBDG3GeQaDEoQfThWa-5Fhl8XrtR5em4pvyg9oJth3Rsxrj8s45KbDBv6efLM_s8LfNNd5oL5Kg3wnMCH4b4K4Nj4EmVlTpkfkYP0BjH7tS5sUHcGiD8pjgpaGUZ-2zROtyjEQsF5GuLPfg0cb_AeDuJSCbkHJI0Pr7vPn9vzPCQwpZJ2dqSahytrn3LnLxLvW3TMPeO9BRmisO6ZR3igDg1N-HKig02JOqyDytdGLlNVt4otf5hhMwTWjRENJ3FaaLD0fHqN0rS0ccyoLE4_SDwKuJv7k_41IxCM3mNriS42JDwBU1rgHs8PKM_ZnEsa9CJ06ZO2tqWC_XZmJ3SlPhAY6hWKFxxnphJXJ7Mr6eBpj5-_CHxt3aitRxI0QNRwW8h_mqMVEsWTpWsL8ZSBOLhDi0P16vOTnfe3Ty9askuNcFPB-aRVarcLiSy5CyOGoFdkCSnQDS6NnnEwCVRFc5xb4G2RVAQj4Jjfo6T4GXaLaXnYWvAuw_jp6tiencPyPazVS_FKpHNF_t7wnymi9qLJ2XtXa5e7y_Nz2sCXymG8UWf5hSHan0G250KnJrN-8BLNoXqMA-B--H8QYpNm0trdCui8Q91_ho3OEJNnDlgGcGEm-Lx1tJ6IDr-ELbHuP4pJcCsg0WxMZqX2g9mai1BObQbZCg6VvfoSbU6XebzpD2IAVxypZom7CTmWQZNatAAbCOAgz3Kngi82B0wcn1DKBepfFCoY7tJec9SC09TOgisKRd2_TI-CwqE5bu64qLPU5NZDK8TMw2wBLT8Q3NwMwUREhs7tkRYh-PD36LndeeYZnZNpV_p3zASEfIkpbcVk7LMrRRBGQWW6f9CQR9rK5KIrKM1l2fzW2tBg0Il7UKCRiZYEdCOul9-Y6CfCVRsCbiOiNCfTt6JqjzRIY7Jy7JCN7abrzJ_7DRvoDh7Z5_hSCFdEx10Muujxj7pwaaMqSqwKqkfxOQwgvF_4aHHF5LkI-uHvhSDDpQ41bgDTCkbzEAJAwMlyJb9OAGUAp9EsxHe11Ag8EGo693Orx6uFwFThR2-KJvTvqFLfUSih-V54nj5MlyqZK-z_0sI5v6ajP331UkG29S88CzRC06SFX8jFnPkzpsugNH71n6m2-6f8aQWa_IIBBCDaRzWI55RTkpLyo7Ko3PL-4Iu1wSl8vnwBFOMofJNtCMJQtJYQTja3ujFTLFySVdH2OzaXbRuh8dqQjHVr0JTU6o4saixp8luBh-sEfwJeVnLzAnmva6q1BB7paZEITNMkx5KKDaw__uPX4LNcs88xHiFMZjjLYQprG-TEQZAgk_C4Ez8hKpw9bgvJ9eV-Ov2qHWAv2SkCh39D6DWyEZq8aItlSIjOmEh57B_v529pTNjolsbNt_TuDoDLcDHBmBRVMA4KLmi7-HQB9aFBpMd2KImDEz-MUDjPhjKh9N4awrBDPz_v4m3ilAqTRT-yol8djoRglB0wcnRHqIt_X5QTdJlfM5XsJ1_n7nmlIcv1HEb3OJtRwY1irKH8rdZmqKuluvVLmougSfQcgtuqIcJK9J36R7qPVKzpkMcoiPwLQ6HGB6rtM5dxGRX73ke6lm19sDfPAkc9FDKZQhEntnOkMEbvSqArQ6jwo7TabvpV0K1R3RjNJUZhjgeXLlK1rQYRLNaR8oxyyy279uk0eN9QztpYz4yG-F-hOnSwqeQZcyNmaKvLMh9YuGtA1A8k_nPSYDiBvoRELfzLpbGKrACes950YNHq6YU6UzkdGHMCaAPl4TonUZ_ZEThzmWcYv0oJfjX5vnLHeb3aTavh9dPW3Ljylm3KMvyeZdNrMLlfau43pIIzIGyVhJdHl2TnKbNViOfOIRyUygGSVN3aRUbUMRjAvaB90eDZmvcQtkfjYukRtqYsN4QAb-7WfAWBCOWnCGVUwHQX67zoAmXv_zGKv6f_iCyE-TlJa4ghgMT0Tz54-ZmpMV5USnj0mF99omh4E6p1pDm-vZDJL5oOO_UI44ZD8yoXHVAVjctkN9ioCusiqscq5ytfb8s122jXR7smUYQ8LtZA1wGtimttvuVpz3rvKLgCnd_Cr2sjEe0vKyPJIdp1VU4aBRBSYIRQURuCxjYSxR7w9-UcjfYmBzbofza6g3sjYr3F4wgLkEs7MRGks5gzA5Qiykrq1kNMWuvVi_2P1_llAnx9x73vATqH_NHORxT6JROk-v8plEBIWOEFR0kfkSHIE89OivIUhFa6j-KLVfeMHHCgOwbSf87yB3ytJk9mWFqQ7qJG-nET9HrijnFvTbZPo846TjmAqK04kjKZcezaYUhtTdoV72onTtsUZiKdLIHRgBojhX2d4gbdZMsNGDa0MwYrhVXize1Bk8Sw0t2895qtFU8Qp-FqEuD7jb3sKOkqj3o7RXw67FeW0ewcwa5rLCu7CM9BrCf8savFJJa3WqMjzLwkY5nbQ2tJlh27G7I2p65L8_0ATxngCLTBvvvMhm7BLjrcBG5BEQnOCd0tvVPVHAkGAN28VN8gUnJh-ZUf1fay8gaYJYo0ioWpkEV99NfAvghffKWEfuFweL-h3DaSTc4HX5RnJKIc8TzP_YFTfv0EyeyExkPKgI4VGziWQxQvJMYtQGAHy46JnVQIAKIBh6JpnAzuhwz78lhwzjRTJ4_viyNK9SRydN26OFL98nNq8MmWVo2ncZMonyEw5A69x1EDtijsFswcpuEqdndyvOFNHA2k1MxL5WgauVIUOsmpgNa0vb8XQxSAly0ihoBF8xOX7YX8g5dZivsFcM5W4rrsmb7YkQnnFzbfeLPE8HoOFGdtdSoULKhStCuca_v1pcpCgGiA7FID8LSzOajOU&cid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wg-in-f155.1e100.net

Software

cafe /

Resource Hash

563ba273cbb08c3b4e9df2feb9e822a7cae0bbd5c6ec388708482d7a13057234

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13900
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 18BD 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8671001593b9b6be023648a644f0d679c3b04b532f66f1d8924973e454d61ef4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 18BD 0
0 80ms
80ms Fetch
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CGQhFN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAaoE2wFP0IbmrYiJapH1EqnmIpf-pAoAzVKvumJsGmzf4gMfDXXKmjZAHkgkwLqbErODUrS6GLEVXGX3XJp5D8E_-aCEdp6C0yFNt_M1YOhNdpecJmykFvl70Nud0XPc1syRjY1ejwPPsUfsFcmHjOIlNbIKPGBk98CTtMhkyC3A6lr3QhS5X7Lu7U9liAjJ0MPenomn9ORL7fytMAAmGEj2juZU6IutFzIj8QOi-q_gdQkZ6mhI80mVu3fC4ETOczQIRBm7vIblSEUJQosN4bQ7mjO-7SrJk3ciC8f3QJrABNnX4J_YA-AEA4gF6pOTsTSSBQYIGxACGAGSBQsIIhACGAFIse-QAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGToAHmqraNagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUb2AcA8gcKEJjpFhi86_KSAdIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tOTE2MTg2MzY4NTgyNjk1NoAKA8gLAbATueyXDMgT7qHi3QPQEwDYEwqIFAPYFAHQFQGAFwGyFx4KHAgAEhRwdWItNTUxMjM5MDcwNTEzNzUwNxiS7yE&sigh=JwY45x7FfrQ&uach_m=[UACH]&cid=CAQSPwCNIrLMwLHQlJE2KStswd_uqEcQkFnoFMGJzW2QMck0JmP-i0ZNXRZqXl3KjMjQ2nxILKChxpwqIY-1YWa6og&vt=10&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..
Requested by: Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 container.html Show response
caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F3F0 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 17 Aug 2021 06:46:14 GMT
expires: Wed, 17 Aug 2022 06:46:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3822 624 B
611 B 18ms
18ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COf3vwIQzILFAhj29qSvATAB&v=APEucNUSK-HrTrXBOC5vglC2S0hPn3ttBAQ22N7i4kjOeoioE9OwNi2EQX4QganyDY4O_hSnO3PVbqFMMg6H4BC8gtncz11raZ9gdSI1Wylou6wAjgIh7i3pgPKs_C07nKEv6REDDN3Xd7Jyg7eOzGrSv6uzUAJeDwf66WiMiWRcQY8Yth2nf985wK56Ew8hvWRvN_lvoAtt4XebtgUjMHLvBCqu1OKcfg

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=COf3vwIQzILFAhj29qSvATAB&v=APEucNUSK-HrTrXBOC5vglC2S0hPn3ttBAQ22N7i4kjOeoioE9OwNi2EQX4QganyDY4O_hSnO3PVbqFMMg6H4BC8gtncz11raZ9gdSI1Wylou6wAjgIh7i3pgPKs_C07nKEv6REDDN3Xd7Jyg7eOzGrSv6uzUAJeDwf66WiMiWRcQY8Yth2nf985wK56Ew8hvWRvN_lvoAtt4XebtgUjMHLvBCqu1OKcfg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 06:46:15 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUk2-3dXx9Y_A-3hqnpxvH3GUG8iFdIupnUKkjjln6KormHCAc2ZKEK4c9y9; expires=Sun, 11-Sep-2022 06:46:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F3F0 54 KB
26 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AFpf6nyel-Vj9mKs4-DCaEeSXFhClpx7U7AWkkZJKSGqem4DbYJW7SvgoC_3oQfVxXiXAKdwUQEWGGZXR4ZFGajMGWhyInLj_plKwYMvMfGrXt_PaCpDygsd2w2XSJOFCiaaADhbsHoWaDUf0_BHcyRfWcrQ&dbm_d=AKAmf-BapgDoABZVGSt5h4DsKeIdlRSegdgIQD-d5u_wpH_8i9rKR_u5S6zdoAiZQLcA01B_Rcecl3eNddZxhK4_aOQKMlkfOzJVWfM7iysu4bIt_9tA2UDYcb9bHmEQCABHL6MJxTKbPhNGKCBrbddR1hNByGNIhhpt5hELQg0Quws3f0l1jZzYDJJZaCohkcg7vtnYtU9ooPTS7-C26Ku7Mui9FxeIjA-PXxf1AjurKNcONtVag8DPNZqszrv2k3wjmW9nI__LlI_cNFUzJkM3-_gKvD_nTy4GslTSLL_ACMd7hyrgUd3tbZ-q8YBrWdMsfTRe7rV6nANoNV0zZLXFZcYzcmY2GQgnYWWQcfMOpLNgW60z8BI_nPUaqNxj5krbQe9e5Z1KK0_xcUtl3gA9OWCEmgVlb2IuTPLU6CyED4__OQo2lK4cVCSYZoJhVll8uKnM2_KGC8-vtN2R46a_sZ2tMyUXbI6IdSAC-aIn_rOHmeSxegqOPeo12BxfTrvCy19XIQh0g0bNQtUUnoXijx_P9K7dHO_28kRUVRVZjCslJEVzTqRR8iJvtJqSRXF14vUDlNLlMZAuUQdUdPBtT2POIAmenLTNCYG2WZWIhlkxe0HQmByN-gbsJ2bAvJdVLRfhHqYyNYqMVNTrtTDn4QXWaxap4hHKWTacouKCExqDl6egfDg_l6KnWyJ-DEXyc4-eUoKRJObWJvEkcoFGJoqCKzoNOtVsudcRZgl6mm_7HF-xt8k3A8_8FNMJMxOi9S3bkEmgB5YtKsebZZvCAovlZEgL-mPb7BEQmJ4tJjELU4hvSzFq_OfKv1nrRKBHIztRHvAsPwBZVAtI7Nrof7IoA8YNUrCEmrWjSC5AAzfMziT3GCCCZWJQHtcys2jEV-GW7pNmgUaY82X-H9F2uyI648iIG-bGpnud-qlJDTOaFSUuys7T-cW6MjWKhZ8HkIISkryUt0pGbNwwlE3M8bGfQIYPxzC6Zhw8idmS-6zalyjT40scITikUv_qkPoGhE69KXgMIQXYAQ_xOAD3MFgrh7brxblgvWAgoaSUNjb-UwjpyftPEoEFGkx3yHhyz7HlX6n23Tn6n2V4XwfYiE_K6N3ON6givgVlL6bwtu7mxTKlbFzBSt746yhCZ3ZUEDXvH6lEt4of4akGVyfzZuUE2p-cQu-oKX9O7O6HZxq-icIulPYdnIdUEu5V-AkMKqRNdioqXgLYbsJeZKSTI622Ped4EFuWcWNG19XU1dkTUqUytuJgujrNLQE-WYYUBAeu3cducwFWZHyz_SfBVwiIBzW38LCufor3IVBOLLSX6KsrpfMN8jTROojqMwxNuNTU3uzXjjJvfxoYj9mQZTHJgscr8rZX7JK08moWN-Bc2qQxRprPy1RwoRV1qVcORFtMRU1ftENLzSrnD9FiBm1xGhedGkC39DujSWtetqew5B9HIn-B8EwtW8dHQtnE7L_XKv2mTQqlhkUVVphncgLucEjGrp6Rxr0i3cQc22R4edcA7lgx5NPt4RgGDYH9nkj500y0QzhsSo1cDD7mTCg7oZbOCxv5U-jtWUPbZXJE5FVY-K53_RYSOkB75Wa8-Mgpn0BdrDFBxoxWvkAiKy7eKCeEDB4qWqNupx7BmtgksOatkYa3M214M9YrdNLr_13qFm0luZ3GIlDq9au2D_WGQXONxW9eqlcv8f3vhdxGtRPJQq8w6sAgfhoVopJxJDsO7JEK69zWG_CkP7p2ndbJESh0Lhb8XfhBn_76NSu0eZlqzBkqcMT_7wjMeinth6mM4518ZTbDcTE6i62NrB9upsev-ACep3HNaMZUh-YNI_PO1MpUpJymH2fJICQJVLeq-Jr8jIxZRfoQgpWao6aL4NuyVTOH_wsd8Xy-PSSfFlfu6W0LQ4QBzZgPrand13pwwssHxbR4g58VfoxI5xkjX8M2hTA8pAo4u0s2qs_AxmPHmaH0GEXWRnKOaoZ_rAMRwy2GFmg2qN-OKEZWvf7EcHXNOakkno1pOcsTEo2gQ8uVmOhUUdsQqZVyQ_9h180L8kxw_gu6IYb8ypNuSGJCawQfbgOqfgr5HUdiCoY_FBM4F9XxJ4_rm4HSHJsOelxTNtgwY-O08N8Rf2of8VFJmso2Xsmy8DtxaSh2gWgCC2_sacGDsb5Y5iC0wHmmII8Dp4SlC5vBYiOpXCq0R-uKQBpKYjGxRDmLOJT2-adc-BiPjbkN_IUdeRR0WMT6pRlJxqEOlOBlfA261pz9vG-1aPeQUjuDeuzn42P5knqBcB_D4l9qUku6kCJngnVauWeDgqM6l8TP-ooXSceM_cAFbJ_UaAF0_-vgocrjQe9S5uCOaXyPL_zoCgIHDR8K3Y1l2D78hCb8VfA1mj0WJwaF_fW4uhpBuXGtKdDwb_m7YCvIzMGL0Vg6Q32VEcsLh9q4XSqvDazYLoKQnWMfYbNohVjK8w_TKEMs6y0Lljmmlvb6D1C91QI67hZ1HHse1UCzH-5kyoEy48iRPBpGuq8FT1501ApULcPVl2-o8QOyTzAyrLnknOu3mD55S72HdNjN4dujw1PadBMviB3ay5nuGp8DH6fNpbQo52ysqtviMzS_Td7hYuox-gMzJ6Uya51vb2f6BQQgaX8w0kMsCodDqKt18gNSXU76yIk3MhX4NJm7dHCC0ZQKbp0Qr-yQV5hSzRAaExao6dIgd9ySFPoHZ8iwV0iVD6wxpYXWCgjRN1khWU4psaHWcXFjlGRx8Q0OM7yhz3VILzdec9J20d3haC6p_Etjv6mG31kM9f-5zx0nQo24iwz8ZNapTljVSyuK_E7X8_jN9EFLpgasTcL2TO-ZFSfcHoXSYvyNkzRv4MORCnQE7bKfCzAd66J4S3l9tzfy_pM5PNda7Q_O7ur0LKQzvTzSUrhJ_NS2zSgP0B2Bz_1FDHUZgzeyB6ogyMI4_3-hxb1QuZ-xlRkDLICXmg0kfbLTaHy982__W8JPMQXtQswY6mW2D71VqZqqXinyGx2ZfhBSZmW2fp_hPUCJgiLpEQ1Z2b521DC1HULdXwSxQdogLmYQEwW6XDNS-XZpblOKR5_XepvC_S9VE6xbEvz8slXuKqD80jXWhjGveLbPJTAMQeTX9a-ZWCV0-XM8HMX7ZQYn6lituP4cR0ZCUl7sAE9VTYG0jz0aAxhLXy9fTp21gLO1UJ8HKCGtgqGvu7fw6pe1vcbyQNUBoWVVXINKFG0zop8QJ-lKMI_7umunPfg_J75LZr1NpFvxzN6QY_sbcP4NJyNi4aQKNlYBNm9GfRIAG4F9nBqScVSGMhBv7yblVtvROPai0QmGKvjXlbRmUxCjbDTHB4tSqZQGm3rfqSq_tfQCf9pnYuNsUoGP9wRPp-2e7INw6KhUaZRuCQdUQWicZE-DxPS46O36ELbvFZv_GXlFhgTS5R3dEX0qGTfJ5pSeTXeeVon_Y8nrQIzPJWo7qQ8hMKIVA3JKkAQXTw&cid=CAASFeRoaSuwSlSeIyY13E_WPG2eJwyBZQ&rfl=1%2Chttps%253A%252F%252Fja.nex-software.com%252F%240

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad27b83e8542e635f68e415ed1e8180bc0c332af48be92bb375bdab187d5c601

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26121
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F3F0 42 B
63 B 28ms
27ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CcvVtfC0nCWAVEtkWhsB9BGtJoG5FCfzOVad66lfUViYOpthcJq5OVKNUVQ-Vljuoz_vWGj-gRDanzl4E0VUwO4_9vVk3YfrVe5lWlg2Fl2QRBIUY

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame F3F0 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:17:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:17:52 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F3F0 124 KB
37 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame F3F0 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:27:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:27:01 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 29ms
29ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021081201&jk=36231473746780&bg=!KimlKW3NAAZvV8FTb1c7ACkAdvg8WmY84BDACIRZ9h7EjvQ9ay2gy44JI2e8iKeIexMaRF5pCH1YewIAAADKUgAAABFoAQcKAJAs4-in6edmcCSwoVPDqWxWYRQGNYX9F10PzgCG5ObYUEIBjszj1Qdq_JsjbGTQ6PbbQqjH2xjq7nCGXEef6Mek0P0hBDLk57w8KlBsvm2fhI6jzj9BrQxGUOwji4RPzbVqTq8rzBgo6JyfdvK0vkQrOAVzacNvxgBqbzenNr7Bop9nR0lUjyjWCVMW5ZshTVCZAnbWmAnvNsIf-2hi_otSr8Ju-G8tGypb6WNVyDh8-MSVzKHAcn8beARHxFetROmh5WdQlADzmB-y3NnJAxuz9lDqsP7GkaYZuCGB_2G7Qt4ZaP0q2RtyW0gcU00XWxEFrcN-Ty2Fk-rdrn7fiLxFW81HnB6RWpsW5eU3MscldG1U-SfeASx3zyTW7FwVKcpgMBfCjhSOYkzBRhg7rVQk_uNW_vEayib5Q7ubc_UuJ48vpUa_Q8ipRLyGWtrJtxVnviu_kMX-fof051Rxo0B82MvxUW47kZeHAVgJP0jKmdZGvkDDvDllqfm0b-90eV62h1gD2YYaY8ZpuiysfmLiEgQquxat1Xc9FES221TW1s3-6ULHTxWTLkC7Syd3kDixbYtvbXZWXI5I6ItJcX5lGjF1rbma1CPA27dD9Tj9fTnXdGnAxgDfR9ZopY4gpTWiarUPKH5Ns7S4ygd2WePDUJNeR37uEGiukC68miA7nEkyw8DNP5RY7LcCezNi4epDwa8tsbM-6uxUlKoI6dDLRYtzhcEHcYvRle7MYen2-nTfaZ1m4WVLWhPBgimaJWmBI3R24VcVgjcumrB0Lml6PrV0XAxDmgFIKKvX1BjSURpHkF5huqCKnSvJwA-oDqEZPXla8BQGuI6UhntECvabGZd8c6k2uabrKMIbM7fSXP6HP_PuXpiLNdtfIvRt4zCzfS_fxYC5b0KplhnRezd8EiVZvcPtdDqEGOpfHdFyLPAofxYFUXTRlReVxcEc0FBOt3BESsSznSSo6bFfWyhvOMAqLcCJLsRV6W1p0xyI7hFj29LJ-2sGermKWKU3owxDaYl3r_cbpMg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ja.nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3822
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP4r2fNFronh1vt-diy0x6w&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP4r2fNFronh1vt-diy0x6w&google_cver=1&C=1

43 B
1012 B

125ms
85ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP4r2fNFronh1vt-diy0x6w&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COf3vwIQzILFAhj29qSvATAB&v=APEucNUSK-HrTrXBOC5vglC2S0hPn3ttBAQ22N7i4kjOeoioE9OwNi2EQX4QganyDY4O_hSnO3PVbqFMMg6H4BC8gtncz11raZ9gdSI1Wylou6wAjgIh7i3pgPKs_C07nKEv6REDDN3Xd7Jyg7eOzGrSv6uzUAJeDwf66WiMiWRcQY8Yth2nf985wK56Ew8hvWRvN_lvoAtt4XebtgUjMHLvBCqu1OKcfg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:15 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 17 Aug 2021 06:46:15 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:15 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP4r2fNFronh1vt-diy0x6w&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3822
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRtbNysSqO--rr0FzYBocQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1

43 B
1012 B

71ms
70ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COf3vwIQzILFAhj29qSvATAB&v=APEucNUSK-HrTrXBOC5vglC2S0hPn3ttBAQ22N7i4kjOeoioE9OwNi2EQX4QganyDY4O_hSnO3PVbqFMMg6H4BC8gtncz11raZ9gdSI1Wylou6wAjgIh7i3pgPKs_C07nKEv6REDDN3Xd7Jyg7eOzGrSv6uzUAJeDwf66WiMiWRcQY8Yth2nf985wK56Ew8hvWRvN_lvoAtt4XebtgUjMHLvBCqu1OKcfg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 17 Aug 2021 06:46:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3822
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECrkfTrEICpZAFPkEyLGxWg&google_cver=1

43 B
1005 B

113ms
48ms

Image
image/gif

185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECrkfTrEICpZAFPkEyLGxWg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COf3vwIQzILFAhj29qSvATAB&v=APEucNUSK-HrTrXBOC5vglC2S0hPn3ttBAQ22N7i4kjOeoioE9OwNi2EQX4QganyDY4O_hSnO3PVbqFMMg6H4BC8gtncz11raZ9gdSI1Wylou6wAjgIh7i3pgPKs_C07nKEv6REDDN3Xd7Jyg7eOzGrSv6uzUAJeDwf66WiMiWRcQY8Yth2nf985wK56Ew8hvWRvN_lvoAtt4XebtgUjMHLvBCqu1OKcfg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:15 GMT
X-Proxy-Origin: 37.120.209.214; 37.120.209.214; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: fd15788b-f5f1-4184-863a-8952169e5ece
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECrkfTrEICpZAFPkEyLGxWg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3822
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1

170 B
188 B

133ms
69ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:15 GMT
X-Proxy-Origin: 37.120.209.214; 37.120.209.214; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 95701d88-218a-4a24-8ef3-db291d25992a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame F3F0 24 KB
9 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AFpf6nyel-Vj9mKs4-DCaEeSXFhClpx7U7AWkkZJKSGqem4DbYJW7SvgoC_3oQfVxXiXAKdwUQEWGGZXR4ZFGajMGWhyInLj_plKwYMvMfGrXt_PaCpDygsd2w2XSJOFCiaaADhbsHoWaDUf0_BHcyRfWcrQ&dbm_d=AKAmf-BapgDoABZVGSt5h4DsKeIdlRSegdgIQD-d5u_wpH_8i9rKR_u5S6zdoAiZQLcA01B_Rcecl3eNddZxhK4_aOQKMlkfOzJVWfM7iysu4bIt_9tA2UDYcb9bHmEQCABHL6MJxTKbPhNGKCBrbddR1hNByGNIhhpt5hELQg0Quws3f0l1jZzYDJJZaCohkcg7vtnYtU9ooPTS7-C26Ku7Mui9FxeIjA-PXxf1AjurKNcONtVag8DPNZqszrv2k3wjmW9nI__LlI_cNFUzJkM3-_gKvD_nTy4GslTSLL_ACMd7hyrgUd3tbZ-q8YBrWdMsfTRe7rV6nANoNV0zZLXFZcYzcmY2GQgnYWWQcfMOpLNgW60z8BI_nPUaqNxj5krbQe9e5Z1KK0_xcUtl3gA9OWCEmgVlb2IuTPLU6CyED4__OQo2lK4cVCSYZoJhVll8uKnM2_KGC8-vtN2R46a_sZ2tMyUXbI6IdSAC-aIn_rOHmeSxegqOPeo12BxfTrvCy19XIQh0g0bNQtUUnoXijx_P9K7dHO_28kRUVRVZjCslJEVzTqRR8iJvtJqSRXF14vUDlNLlMZAuUQdUdPBtT2POIAmenLTNCYG2WZWIhlkxe0HQmByN-gbsJ2bAvJdVLRfhHqYyNYqMVNTrtTDn4QXWaxap4hHKWTacouKCExqDl6egfDg_l6KnWyJ-DEXyc4-eUoKRJObWJvEkcoFGJoqCKzoNOtVsudcRZgl6mm_7HF-xt8k3A8_8FNMJMxOi9S3bkEmgB5YtKsebZZvCAovlZEgL-mPb7BEQmJ4tJjELU4hvSzFq_OfKv1nrRKBHIztRHvAsPwBZVAtI7Nrof7IoA8YNUrCEmrWjSC5AAzfMziT3GCCCZWJQHtcys2jEV-GW7pNmgUaY82X-H9F2uyI648iIG-bGpnud-qlJDTOaFSUuys7T-cW6MjWKhZ8HkIISkryUt0pGbNwwlE3M8bGfQIYPxzC6Zhw8idmS-6zalyjT40scITikUv_qkPoGhE69KXgMIQXYAQ_xOAD3MFgrh7brxblgvWAgoaSUNjb-UwjpyftPEoEFGkx3yHhyz7HlX6n23Tn6n2V4XwfYiE_K6N3ON6givgVlL6bwtu7mxTKlbFzBSt746yhCZ3ZUEDXvH6lEt4of4akGVyfzZuUE2p-cQu-oKX9O7O6HZxq-icIulPYdnIdUEu5V-AkMKqRNdioqXgLYbsJeZKSTI622Ped4EFuWcWNG19XU1dkTUqUytuJgujrNLQE-WYYUBAeu3cducwFWZHyz_SfBVwiIBzW38LCufor3IVBOLLSX6KsrpfMN8jTROojqMwxNuNTU3uzXjjJvfxoYj9mQZTHJgscr8rZX7JK08moWN-Bc2qQxRprPy1RwoRV1qVcORFtMRU1ftENLzSrnD9FiBm1xGhedGkC39DujSWtetqew5B9HIn-B8EwtW8dHQtnE7L_XKv2mTQqlhkUVVphncgLucEjGrp6Rxr0i3cQc22R4edcA7lgx5NPt4RgGDYH9nkj500y0QzhsSo1cDD7mTCg7oZbOCxv5U-jtWUPbZXJE5FVY-K53_RYSOkB75Wa8-Mgpn0BdrDFBxoxWvkAiKy7eKCeEDB4qWqNupx7BmtgksOatkYa3M214M9YrdNLr_13qFm0luZ3GIlDq9au2D_WGQXONxW9eqlcv8f3vhdxGtRPJQq8w6sAgfhoVopJxJDsO7JEK69zWG_CkP7p2ndbJESh0Lhb8XfhBn_76NSu0eZlqzBkqcMT_7wjMeinth6mM4518ZTbDcTE6i62NrB9upsev-ACep3HNaMZUh-YNI_PO1MpUpJymH2fJICQJVLeq-Jr8jIxZRfoQgpWao6aL4NuyVTOH_wsd8Xy-PSSfFlfu6W0LQ4QBzZgPrand13pwwssHxbR4g58VfoxI5xkjX8M2hTA8pAo4u0s2qs_AxmPHmaH0GEXWRnKOaoZ_rAMRwy2GFmg2qN-OKEZWvf7EcHXNOakkno1pOcsTEo2gQ8uVmOhUUdsQqZVyQ_9h180L8kxw_gu6IYb8ypNuSGJCawQfbgOqfgr5HUdiCoY_FBM4F9XxJ4_rm4HSHJsOelxTNtgwY-O08N8Rf2of8VFJmso2Xsmy8DtxaSh2gWgCC2_sacGDsb5Y5iC0wHmmII8Dp4SlC5vBYiOpXCq0R-uKQBpKYjGxRDmLOJT2-adc-BiPjbkN_IUdeRR0WMT6pRlJxqEOlOBlfA261pz9vG-1aPeQUjuDeuzn42P5knqBcB_D4l9qUku6kCJngnVauWeDgqM6l8TP-ooXSceM_cAFbJ_UaAF0_-vgocrjQe9S5uCOaXyPL_zoCgIHDR8K3Y1l2D78hCb8VfA1mj0WJwaF_fW4uhpBuXGtKdDwb_m7YCvIzMGL0Vg6Q32VEcsLh9q4XSqvDazYLoKQnWMfYbNohVjK8w_TKEMs6y0Lljmmlvb6D1C91QI67hZ1HHse1UCzH-5kyoEy48iRPBpGuq8FT1501ApULcPVl2-o8QOyTzAyrLnknOu3mD55S72HdNjN4dujw1PadBMviB3ay5nuGp8DH6fNpbQo52ysqtviMzS_Td7hYuox-gMzJ6Uya51vb2f6BQQgaX8w0kMsCodDqKt18gNSXU76yIk3MhX4NJm7dHCC0ZQKbp0Qr-yQV5hSzRAaExao6dIgd9ySFPoHZ8iwV0iVD6wxpYXWCgjRN1khWU4psaHWcXFjlGRx8Q0OM7yhz3VILzdec9J20d3haC6p_Etjv6mG31kM9f-5zx0nQo24iwz8ZNapTljVSyuK_E7X8_jN9EFLpgasTcL2TO-ZFSfcHoXSYvyNkzRv4MORCnQE7bKfCzAd66J4S3l9tzfy_pM5PNda7Q_O7ur0LKQzvTzSUrhJ_NS2zSgP0B2Bz_1FDHUZgzeyB6ogyMI4_3-hxb1QuZ-xlRkDLICXmg0kfbLTaHy982__W8JPMQXtQswY6mW2D71VqZqqXinyGx2ZfhBSZmW2fp_hPUCJgiLpEQ1Z2b521DC1HULdXwSxQdogLmYQEwW6XDNS-XZpblOKR5_XepvC_S9VE6xbEvz8slXuKqD80jXWhjGveLbPJTAMQeTX9a-ZWCV0-XM8HMX7ZQYn6lituP4cR0ZCUl7sAE9VTYG0jz0aAxhLXy9fTp21gLO1UJ8HKCGtgqGvu7fw6pe1vcbyQNUBoWVVXINKFG0zop8QJ-lKMI_7umunPfg_J75LZr1NpFvxzN6QY_sbcP4NJyNi4aQKNlYBNm9GfRIAG4F9nBqScVSGMhBv7yblVtvROPai0QmGKvjXlbRmUxCjbDTHB4tSqZQGm3rfqSq_tfQCf9pnYuNsUoGP9wRPp-2e7INw6KhUaZRuCQdUQWicZE-DxPS46O36ELbvFZv_GXlFhgTS5R3dEX0qGTfJ5pSeTXeeVon_Y8nrQIzPJWo7qQ8hMKIVA3JKkAQXTw&cid=CAASFeRoaSuwSlSeIyY13E_WPG2eJwyBZQ&rfl=1%2Chttps%253A%252F%252Fja.nex-software.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:42:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 244
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:42:11 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ Frame F3F0 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:34:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 726
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:34:09 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F3F0 0
107 B 205ms
84ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstBlk3mRJaI31bUR4_-wiaB3fzTSa1s0wJbR6hS_H8YS7z0V3sZhZbgqGljDjt7KteeV5VAsReGfLhLmXM10SgddPQCZADpUmQfxiGVI_tj4TtcB03b4EFgcQxE6KQGSs8ficjJ1J7AwoauZYoQqy2iGVP-CnaT7DZcHbfS7wWzuVndIIVWrUWGEhOzOeuHRu1BBaGOqCqNf6iHtRfMZpBckPEJnudF5F5xe-behbOdHQlxRe6vHt-9tKDljMJxlH19IjZAoFpsF8b2a7j2Uu5yY6xs0qB48X_z6CYgAqKkTQrRBdAFg44R3xae8aX7F28e6KeLUvAbLyj33YPrLVR3f8sjeTg28xjM_fGJrL2oHje13uJIxZII6kVWMKlUx5fNQEVopesVzpGcP0AlOFD4FeqxoaALAqzC_S7checeD59PZephRTCftQ--fPKJvrwOX-2GnbQTuqhe-q2crCGV_b3TI0av90jXZh64EZykWmc3mLfuv7syYO2usmdE0VFr6U8MKOfRFRR8iLW_yuLgfj5sdQu_lsvIPRRaa47C9eL4Rdx4XSMsWNQ7t3rpnqtNCHPBEoxPzjxJsF3kkp5DbdHDg0CTheCtJ2DIfoS1i6AZZRgGZ8IQe6JDmlbh9pNmwdfkT93-RhUGCqNu_0g99TZMK3fDykV41oenOLLZqbXLu4vOdb3cG5NWqmKb5G9MCtirCpm65RMuCyicTptJvUXftOTmuSrrejZQXPfNhDS9k8ySPNQXDdWdODEW8H3bmCOVeXM2rOfJh7jp7PSbrnG0AO7_-9EtIciktNQc1xiQ7UFM07BZWBjEd4IMUzT0EZjyiY5prSJHSx1ybXGHlfpeOJZx1jYzr23T6bnjGcKTEQcZaGyXD8xNSP3VAJBBUn0a364odxVNzHpVcAQks_EmhGb9lZN04TliaIvvG6bHWTNfYJ0eRSrl44F9BzfBXVbQbCBEC4HCNdVks6DBAmNZ4pXVOLWQvz126APahNRJ9o9IrhNC2A3M78KswLQEHkwZqy6topXMZShWxRKigzwb61IidOIHdSD4D5hA2QK4WrgsbGCzVNdZlubQc1GbIv3COXRSfo27JwCzZTxbYK97YPvja7TbtBixqt0N3q5cOGOe0y04S_Z5cvX8R0FBeXHMHhaNRQmtVkAAelyVnJGlCk3z4kZLnt-1A7Bp9ApSTEkQSCgF91_mhVt9agsLDREhpiKtQ1UiAWkfrcjY9FP-IUSM8JJ5JymsslOUuAxkL2DDEEA&sai=AMfl-YRUa1bliBi0yULQ-Q2KxqQL1lyc4NbQuYrp3ntVPl42yL-4gp0MBdUfPY7rG8nawGGAUJ12Kbe_Uzizx1aJgrcowBamC7QASl6vVj6tysgYahwQiFCvXIYXKCXB6-bzK9bfhuMcCsE_9Ob4PwLBRetzRTlXGx9U4UZHBnA&sig=Cg0ArKJSzFkIEwd1qZoNEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210812.42383&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 17 Aug 2021 06:46:15 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F3F0 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 17:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308304
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 17:07:51 GMT

GET
H2 200 4403788546148749497
s0.2mdn.net/simgad/ Frame F3F0 28 KB
29 KB 27ms
7ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4403788546148749497

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e46488663e925c9ad557a7f0c427e47f331a48e050b07274871ad9a3856395b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 15:23:04 GMT
x-content-type-options: nosniff
age: 400991
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29148
x-xss-protection: 0
last-modified: Wed, 07 Jul 2021 11:00:32 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 15:23:04 GMT

GET
DATA 200
OK truncated
/ Frame F3F0 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 505370e336a18b80e7de8a982d319c2cb7e76fa17103cd48514e32514d7c4b9d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4DC6 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 16 Aug 2021 00:46:47 GMT
expires: Tue, 16 Aug 2022 00:46:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 107968
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F3F0 0
545 B 139ms
79ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js Show response
pagead2.googlesyndication.com/bg/ Frame 4DC6 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0239bfd43728e85cc93174d290d229af26b978e2a325070598bbcee72d075b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 00:17:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13491
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 00:17:46 GMT

GET
H3-29 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 18BD 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 18:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 388777
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 18:46:38 GMT

HEAD
H/1.1

200
OK

file.mp4
r3---sn-4g5e6nss.c.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m... Frame 18BD
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/sig...
https://r3---sn-4g5e6nss.c.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/acao,ctier,expire,id,ip,ipbits,i...

0
0

26ms
6ms

Fetch
video/mp4

2a00:1450:4001:5e::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r3---sn-4g5e6nss.c.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/167A878390E5C6C654B64A877763F50EE5AC44A6.23890DC50B33AB609131223BCBEF10E387972CD0/key/cms1/cms_redirect/yes/mh/EV/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5e6nss/ms/onc/mt/1629182421/mv/m/mvi/3/pl/49/file/file.mp4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:5e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:15 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2627526
Last-Modified: Thu, 08 Oct 2020 14:27:49 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Tue, 17 Aug 2021 06:46:15 GMT

Redirect headers

date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 652
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r3---sn-4g5e6nss.c.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/167A878390E5C6C654B64A877763F50EE5AC44A6.23890DC50B33AB609131223BCBEF10E387972CD0/key/cms1/cms_redirect/yes/mh/EV/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5e6nss/ms/onc/mt/1629182421/mv/m/mvi/3/pl/49/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 18BD 0
17 B 27ms
14ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~ksfpcyw0&c=4382265454967&slotId=2191132727483.5&qqid=COeR1eS6t_ICFd-K_Qcd7GgFLw&fb=outstream-lima&gpm_i=12&gpm_c=12&gpm_a=12&smb=1000&br=853&mt=video%2Fmp4&vs=640x360&ulv=1&cll=0&vmfc=18&vhc=0&msm=1&aits=17%2C36%2C18%2C22%2C37%2C59%2C342%2C343%2C344%2C345%2C346%2C347%2C692%2C43%2C44%2C45%2C46%2C0&webm=3&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fwebm%2Cvideo%2Fwebm%2Cvideo%2Fwebm&hvmf=false&vms=1&bit=343&vsrc=doubleclick_dmm&ape=1&met.4=videopreviewvisible.ni
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4B34 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 17 Aug 2021 06:46:14 GMT
expires: Wed, 17 Aug 2022 06:46:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame AC53 23 KB
9 KB 7ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/H0ZEmIz7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8727
date: Fri, 13 Aug 2021 10:43:47 GMT
expires: Sat, 13 Aug 2022 10:43:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 331348
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D59F 624 B
299 B 34ms
20ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY0o_tSTAB&v=APEucNVZqAtpNXm70ajWVR3-_efXi3J956ys5LWQojpjCItx2Y3mdJj4IHIVsx1uJAvk3OfJsUmLeL2GJ9tzVIc3kC6_N7C0FoASs8j4eDOryLLdpEaAYMSkXgf6-V59Vgn3T3lD2L68NoXXOGYMYBFRAHr2MOjb-UXVRh7nhL-vFgNrBe7uTjEN5J_XE1IDqHJAUbW9ue0IjzWsGAEbFH75WAL55S5Zxw

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY0o_tSTAB&v=APEucNVZqAtpNXm70ajWVR3-_efXi3J956ys5LWQojpjCItx2Y3mdJj4IHIVsx1uJAvk3OfJsUmLeL2GJ9tzVIc3kC6_N7C0FoASs8j4eDOryLLdpEaAYMSkXgf6-V59Vgn3T3lD2L68NoXXOGYMYBFRAHr2MOjb-UXVRh7nhL-vFgNrBe7uTjEN5J_XE1IDqHJAUbW9ue0IjzWsGAEbFH75WAL55S5Zxw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl0B0xCcRr4PH3aklUTE_D2jVvSfaEYBy_ZlvM159OREcHwCU58pcsNY6Y137g; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 06:46:15 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4B34 25 KB
13 KB 49ms
35ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aqf4prnl09oTDv-ht1TvbZDQseILjonLMXIgAGlB4KAmLg7SN553DCX9BdcVqbT7G_Qy1rsc51uhOeWXpN2UwDJ_CSss8AwAF2vnykdoyNSum-JZIRgJkbxgAvKALmY5j2IBhizIUCvgOltar1xIqtuZvEAw&cry=1&dbm_d=AKAmf-DWBs77IGmUQAcD1rYCYR373YVbc4qugxCrDlsoc4X41wWQvH_rMSPqbEs-tMOyqXKuUinrupj3yk3wLgp0Chi7WqUed5FwnkaU_mofu0Y-gHyo2qvweSzUain7u9NItXqLp0P-Q-j3fX4QsXHegnBjo3wBg2ffF8U6Ky6ox7HssmhXC0_O96bxGOL2hvrY5NVHEn9X82nqF_jZsy4KxYq5A3L9B3EJH0LHOzmrQkvYuQSQdd8CJywn0bdqVpq8ErZZlCaqO-OtknqOpNjh4vD5jNajSREZYJkqIml3cCKMmYDmqoIEUUbV0VmblLb5fGSqL6cHZ-GymwgUK0FvEZjqxR72HBbXdpAAx8WrdOC-V4ha1iLEtkIbS3ZNjTPp2qN_mLkjvcyZ848kpA1C6fP-ymjD-xn-XwuBojRkNwjoIFW-ReC8qz9brWPJehwqKxWUdyczIzNYBRJKg6HjhvCQQ4BqPCoJ7c_LCHQvaFK7tvQc6uVk5tN9qFRxzoo1JAjuMhSZHbSgzOb1sulpU5RBXmRgVE98JdI_4BvPi0qryJPAf4UfcA6crn3hhbzTPRN28K6WEX8HZCQ3QSTc1fdAw1nqaNR4KzWvh1nVjAQfVI6m5A87oyhgeejsXSueNV3KDNtIjq7yUIZhHveOrlqB3HCPTkgPszy1ErzCX9MKfKW9N9BIBxv9YwMkVHnPaU9QRzIWUXReVfEKC_h9ZdQb0VwBmasiz51XYViac6RP287y12qbJmaoz4EI9tCJ_wwxmrhS8vS5lhn3zKc9XWcgI3kfk4S7F1Fnf34JmDvMa5hbR_PQGS0BF9Fd0t_Ow6TL0f60GhK_-P0m0MMtCXWFQ8i6iUVhwOEvQMQ_Asu-4qE_BWKIAFZyarLF5rHLdV_D5oBHEQvT5hCdBI-2k8QqQ1DpsFjXzP1C1bjciIWCp-qKhCIlac8UpVkDEH7guC3OJpRt4HTXqfg0TsTYTwF7LBwdiZT7MPxUbqN6SiLNjWmSkh5CVwVMkcarT1au-DEDEDiGKwQhh6lBDbfYOLcCY0CbDS8WC5prWvsSZqHAeZGWc4aWOmvS8Ld9Glkg7As3rLv1oLgI_SwTl86aE05RGhT5_MJUi1TAM5O75nRkrOTSt-U71dAANhFHyjwqrf5gmlR-O7CRq5ri1GfC-AEr5DaRZeetTufeiWR4Mugw09mItntAYPx2G6xxJyh-g0b3VT0HSfNqC-e2xdbHi8xxdmCbQ6-dQap1J15HLC--tdnHG9h3BsCDXoZc7eKnzfkfuQGEK0MgJgIhK80UYJ2zeAfyQTThAYyd6UxSJTuGXinpDtV0VY-3MvsznHHAnizo8hU0ACj2VV0ncMoMOtrqbPE2iHrwsh7ivyfnLDJRlMzqiOVfUcsGP5529xoOaPZGVxF9W3iMr5ifojeE7fwIs75FHl4sSGXI9gU9lK78JjBUzYc0xVkHeE3mWFYRG_jJMwzwcFXbiPXbhwCCgWBw1fwRPWJW9_axt6hbeJfb7JdGluuHCK8it3Acow1L2bgWyrEXSW1PkLJjkgEGD8RR03wpURLQ75dM8UEOTm8nvJZRgFoE9VLJGSeRqTkXOxXGq7AJL64cf05ebUfmaQZEpdfyXLtomgFgMo2cwtDJJV3Nu_6M9GgjHE-0zrHQafc5iy5IHuP6wFg7KADPJlbsEX0NsIVEmwBB8PY6BXlI1b6Pa7pGisBDRxcDr2mown-9BVtRUb43xHnvTD5XvIRTKXdLtGmGdRtRDJVv9O66iSCoj7e3XCQz36FTh5DBCkxZHfD_QeKEIXCcEQuyd2ZR2qU2M7EiPthhAY6PoSK1cE1jHsIY560QCjYC8_-FDB1RZVRNlNTb7r0C0Q-5MCmRJbe1lRsYVw0Q5Yes-wNxUY-hupk2Z_qaYqIm0P4aipYO9rLX6I8satdbtsKOIoyiaLw_WpvClvpySsSJJzuzx97x-k04WbE6OhMt6u3XsWqAQDOShdTevJV12TTHBzhVn_l7nHCYsonbzo_niU_9i8d8jQ7j6TVFfJBd3tL5HsBnlMuGYqZqQxasJPeJMeNys199OIueej3f2MgaR62EG63BJ7g63x2ZxeK7wKANYbdJJyYrlo7gXunv78CZ5q_5V6ojrEc0SAlN3cbQjSepaHu3IfGXKM_bVSboFxUxZ9_ZT35WNKAwPD580kp5KPiOaZLMkW0xZBOottWh6PWwsDReKd6Jjeh_moBZmLAVLZLmT_dxIyGvLmEEsTnYZEUS09TGP-mQz4luDnVRtkbN27DKJfuOFPLfCfwEEBqAllrtRs0mSPGcX4IFCzb84qRJn58It3BXSP64XZTRylaWsjfG-rXhvkee9tOGRT4Sa9MNWozs08XxA4iIAmriaHESrnHuq4cn6NBU1v6-ZTbpXmtxF5-ZDJBD2MOKdUEs2M21uns2hs1YZ9U3slij1SEipC8hsmpLDJcl-HK1w6FGLefjXcVzLDiiloi_u0OA46EITwKwISQAViIOvReh4tGzjhaz9caxd8IPux6_dFaKKjvCmnaiQTXMG4JUpWBvyP15Z0GeBlrhPGpThEVxSkgZ-B4bqze_T31ZFImd8OP0XO3WLn81E1BpNA3-8VElWaj55D0Dsw1inB69Di_1LmwjC1jWRTfXeJbBmdspVIapgaXfbYZLPIzt4rD0pgRnnoOScYwLiP_rSsCgWtAMrq5O_okqzWO2MVQT_lu0BOXNMlZalWBsgqHPMfZkHfOBNNN56Xg35L7UrZzgqQWCXL-ClVaNqiSOQGusIwyu8alSUBrMLm_BZgQ4bpBaYk0DoO920mv3xc_gKS2GUevIXECyc7l2kiaNBKg23lKyn5LRKAOe2HbnIiZCInzp-JouH_e7T_QVZAPcTG26rFm_LoJUNLRTQqv-RLmvz0InNVdD7Rs0yNPEe8_mXXjCqXefORQzAxoiOag_6TbdTXOa9a85FVFW_30tbeeJ-WDh7nDqllHoyEOOZ84Jp5bB_AOaavs0kbHfCXIZ07PCsLXPVY13UEHc26-dCNiF5S924eD6Kb0FHfpjz_tWgvBbmVtoN7wLM_zI6-4--k9ET3vubZZfpZ60QOtKQ6-TyaDiU2dHpscMxghT_JVk7xr2zUS5GGSQxiLpAQ0i8D7VfiI_PENjP1nMFmL60gD1rWNZF3QN1_nMSOz9IsOykipAdASKOYU9Xvk-LFINrhMtxhvGq09Z5PR5kwRcHhb2hx-vK4no-wNwoJOMwBG-WC_S1iGuA7W3YpvuwJaQnhTgoPwZY67cvtfLD-CL_vWKTkNuu0cnRX0j7W-Uj2x5LK8rtU93908pnwEa9c1HIkVtFiIIhXZziCO6W4gPFCImBVDyfLNxj9_sA5w&cid=CAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw&rfl=1%2Chttps%253A%252F%252Fja.nex-software.com%252F%240

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c09ce42dbd9d0a0627fa60474846b47bd87699fd76ae6bedf0313b628af5ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13033
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4B34 42 B
63 B 28ms
26ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DqnjAtVIRy3d8Ceqom5qhgLsY-E_53NpbuLmnNI9TXNQnGTQfIBBSmLkHxFajeh7PYZvipPmhKVkzhMR34kcc1kL2KxEJ3Q4-9MbBKu8h8fdL8x3Q

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 4B34 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:17:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:17:52 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame 4B34 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:27:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:27:01 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4B34 124 KB
37 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 ESHX-PsTG84Fy6-bdaEnL5--1XpTzSOdL-kezmPtlCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame AC53 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ESHX-PsTG84Fy6-bdaEnL5--1XpTzSOdL-kezmPtlCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1121d7f8fb131bce05cbaf9b75a1272f9fbed57a53cd239d2fe91ece63ed9424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 20:45:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 554442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13272
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 10 Aug 2022 20:45:33 GMT

GET
H3-29 206 file.mp4
r3---sn-4g5e6nss.c.2mdn.net/videoplayback/id/41e67f3b4ed2bfc1/itag/343/source/doubleclick_dmm/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3746615270/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,m... Frame 18BD 3 MB
3 MB 15ms
7ms Media
video/mp4 2a00:1450:4001:5e::8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:5e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

703ab88d0482fd397d46d9595b4ccd156b82cc60a3eebbb7bfbdc24a3a24f812

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-2627525/2627526
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2627526
expires: Tue, 17 Aug 2021 06:46:15 GMT
last-modified: Thu, 08 Oct 2020 14:27:49 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
client-protocol: quic

POST
H3-29 204 csi
csi.gstatic.com/ Frame 18BD 0
17 B 13ms
13ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~ksfpcz32&c=4382265454967&slotId=2191132727483.5&qqid=COeR1eS6t_ICFd-K_Qcd7GgFLw&fb=outstream-lima&gpm_i=12&gpm_c=12&gpm_a=12&smb=1000&br=853&mt=video%2Fmp4&vs=640x360&ple=0&umsem=0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fgcdn.2mdn.net%252Fvideoplayback%252Fid%252F41e67f3b4ed2bfc1%252Fitag%252F343%252Fsource%252Fdoubleclick_dmm%252Fctier%252FL%252Facao%252Fyes%252Fip%252F0.0.0.0%252Fipbits%252F0%252Fexpire%252F3746615270%252Fsparams%252Fid%252Citag%252Csource%252Cctier%252Cacao%252Cip%252Cipbits%252Cexpire%252Fsignature%252F7D36C3F075FA493F91103D898635EA3B955D1A8B.A683453404B8371A46FD1AE551AB60773947AAFB%252Fkey%252Fck2%252Ffile%252Ffile.mp4&encoded_body_size=0&transfer_size=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame 4B34 24 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aqf4prnl09oTDv-ht1TvbZDQseILjonLMXIgAGlB4KAmLg7SN553DCX9BdcVqbT7G_Qy1rsc51uhOeWXpN2UwDJ_CSss8AwAF2vnykdoyNSum-JZIRgJkbxgAvKALmY5j2IBhizIUCvgOltar1xIqtuZvEAw&cry=1&dbm_d=AKAmf-DWBs77IGmUQAcD1rYCYR373YVbc4qugxCrDlsoc4X41wWQvH_rMSPqbEs-tMOyqXKuUinrupj3yk3wLgp0Chi7WqUed5FwnkaU_mofu0Y-gHyo2qvweSzUain7u9NItXqLp0P-Q-j3fX4QsXHegnBjo3wBg2ffF8U6Ky6ox7HssmhXC0_O96bxGOL2hvrY5NVHEn9X82nqF_jZsy4KxYq5A3L9B3EJH0LHOzmrQkvYuQSQdd8CJywn0bdqVpq8ErZZlCaqO-OtknqOpNjh4vD5jNajSREZYJkqIml3cCKMmYDmqoIEUUbV0VmblLb5fGSqL6cHZ-GymwgUK0FvEZjqxR72HBbXdpAAx8WrdOC-V4ha1iLEtkIbS3ZNjTPp2qN_mLkjvcyZ848kpA1C6fP-ymjD-xn-XwuBojRkNwjoIFW-ReC8qz9brWPJehwqKxWUdyczIzNYBRJKg6HjhvCQQ4BqPCoJ7c_LCHQvaFK7tvQc6uVk5tN9qFRxzoo1JAjuMhSZHbSgzOb1sulpU5RBXmRgVE98JdI_4BvPi0qryJPAf4UfcA6crn3hhbzTPRN28K6WEX8HZCQ3QSTc1fdAw1nqaNR4KzWvh1nVjAQfVI6m5A87oyhgeejsXSueNV3KDNtIjq7yUIZhHveOrlqB3HCPTkgPszy1ErzCX9MKfKW9N9BIBxv9YwMkVHnPaU9QRzIWUXReVfEKC_h9ZdQb0VwBmasiz51XYViac6RP287y12qbJmaoz4EI9tCJ_wwxmrhS8vS5lhn3zKc9XWcgI3kfk4S7F1Fnf34JmDvMa5hbR_PQGS0BF9Fd0t_Ow6TL0f60GhK_-P0m0MMtCXWFQ8i6iUVhwOEvQMQ_Asu-4qE_BWKIAFZyarLF5rHLdV_D5oBHEQvT5hCdBI-2k8QqQ1DpsFjXzP1C1bjciIWCp-qKhCIlac8UpVkDEH7guC3OJpRt4HTXqfg0TsTYTwF7LBwdiZT7MPxUbqN6SiLNjWmSkh5CVwVMkcarT1au-DEDEDiGKwQhh6lBDbfYOLcCY0CbDS8WC5prWvsSZqHAeZGWc4aWOmvS8Ld9Glkg7As3rLv1oLgI_SwTl86aE05RGhT5_MJUi1TAM5O75nRkrOTSt-U71dAANhFHyjwqrf5gmlR-O7CRq5ri1GfC-AEr5DaRZeetTufeiWR4Mugw09mItntAYPx2G6xxJyh-g0b3VT0HSfNqC-e2xdbHi8xxdmCbQ6-dQap1J15HLC--tdnHG9h3BsCDXoZc7eKnzfkfuQGEK0MgJgIhK80UYJ2zeAfyQTThAYyd6UxSJTuGXinpDtV0VY-3MvsznHHAnizo8hU0ACj2VV0ncMoMOtrqbPE2iHrwsh7ivyfnLDJRlMzqiOVfUcsGP5529xoOaPZGVxF9W3iMr5ifojeE7fwIs75FHl4sSGXI9gU9lK78JjBUzYc0xVkHeE3mWFYRG_jJMwzwcFXbiPXbhwCCgWBw1fwRPWJW9_axt6hbeJfb7JdGluuHCK8it3Acow1L2bgWyrEXSW1PkLJjkgEGD8RR03wpURLQ75dM8UEOTm8nvJZRgFoE9VLJGSeRqTkXOxXGq7AJL64cf05ebUfmaQZEpdfyXLtomgFgMo2cwtDJJV3Nu_6M9GgjHE-0zrHQafc5iy5IHuP6wFg7KADPJlbsEX0NsIVEmwBB8PY6BXlI1b6Pa7pGisBDRxcDr2mown-9BVtRUb43xHnvTD5XvIRTKXdLtGmGdRtRDJVv9O66iSCoj7e3XCQz36FTh5DBCkxZHfD_QeKEIXCcEQuyd2ZR2qU2M7EiPthhAY6PoSK1cE1jHsIY560QCjYC8_-FDB1RZVRNlNTb7r0C0Q-5MCmRJbe1lRsYVw0Q5Yes-wNxUY-hupk2Z_qaYqIm0P4aipYO9rLX6I8satdbtsKOIoyiaLw_WpvClvpySsSJJzuzx97x-k04WbE6OhMt6u3XsWqAQDOShdTevJV12TTHBzhVn_l7nHCYsonbzo_niU_9i8d8jQ7j6TVFfJBd3tL5HsBnlMuGYqZqQxasJPeJMeNys199OIueej3f2MgaR62EG63BJ7g63x2ZxeK7wKANYbdJJyYrlo7gXunv78CZ5q_5V6ojrEc0SAlN3cbQjSepaHu3IfGXKM_bVSboFxUxZ9_ZT35WNKAwPD580kp5KPiOaZLMkW0xZBOottWh6PWwsDReKd6Jjeh_moBZmLAVLZLmT_dxIyGvLmEEsTnYZEUS09TGP-mQz4luDnVRtkbN27DKJfuOFPLfCfwEEBqAllrtRs0mSPGcX4IFCzb84qRJn58It3BXSP64XZTRylaWsjfG-rXhvkee9tOGRT4Sa9MNWozs08XxA4iIAmriaHESrnHuq4cn6NBU1v6-ZTbpXmtxF5-ZDJBD2MOKdUEs2M21uns2hs1YZ9U3slij1SEipC8hsmpLDJcl-HK1w6FGLefjXcVzLDiiloi_u0OA46EITwKwISQAViIOvReh4tGzjhaz9caxd8IPux6_dFaKKjvCmnaiQTXMG4JUpWBvyP15Z0GeBlrhPGpThEVxSkgZ-B4bqze_T31ZFImd8OP0XO3WLn81E1BpNA3-8VElWaj55D0Dsw1inB69Di_1LmwjC1jWRTfXeJbBmdspVIapgaXfbYZLPIzt4rD0pgRnnoOScYwLiP_rSsCgWtAMrq5O_okqzWO2MVQT_lu0BOXNMlZalWBsgqHPMfZkHfOBNNN56Xg35L7UrZzgqQWCXL-ClVaNqiSOQGusIwyu8alSUBrMLm_BZgQ4bpBaYk0DoO920mv3xc_gKS2GUevIXECyc7l2kiaNBKg23lKyn5LRKAOe2HbnIiZCInzp-JouH_e7T_QVZAPcTG26rFm_LoJUNLRTQqv-RLmvz0InNVdD7Rs0yNPEe8_mXXjCqXefORQzAxoiOag_6TbdTXOa9a85FVFW_30tbeeJ-WDh7nDqllHoyEOOZ84Jp5bB_AOaavs0kbHfCXIZ07PCsLXPVY13UEHc26-dCNiF5S924eD6Kb0FHfpjz_tWgvBbmVtoN7wLM_zI6-4--k9ET3vubZZfpZ60QOtKQ6-TyaDiU2dHpscMxghT_JVk7xr2zUS5GGSQxiLpAQ0i8D7VfiI_PENjP1nMFmL60gD1rWNZF3QN1_nMSOz9IsOykipAdASKOYU9Xvk-LFINrhMtxhvGq09Z5PR5kwRcHhb2hx-vK4no-wNwoJOMwBG-WC_S1iGuA7W3YpvuwJaQnhTgoPwZY67cvtfLD-CL_vWKTkNuu0cnRX0j7W-Uj2x5LK8rtU93908pnwEa9c1HIkVtFiIIhXZziCO6W4gPFCImBVDyfLNxj9_sA5w&cid=CAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw&rfl=1%2Chttps%253A%252F%252Fja.nex-software.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:42:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 244
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:42:11 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4B34 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 17:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308304
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 17:07:51 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D59F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1

43 B
1012 B

74ms
73ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY0o_tSTAB&v=APEucNVZqAtpNXm70ajWVR3-_efXi3J956ys5LWQojpjCItx2Y3mdJj4IHIVsx1uJAvk3OfJsUmLeL2GJ9tzVIc3kC6_N7C0FoASs8j4eDOryLLdpEaAYMSkXgf6-V59Vgn3T3lD2L68NoXXOGYMYBFRAHr2MOjb-UXVRh7nhL-vFgNrBe7uTjEN5J_XE1IDqHJAUbW9ue0IjzWsGAEbFH75WAL55S5Zxw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 17 Aug 2021 06:46:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D59F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YRtbNysSqO--rr0FzYBocQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1

43 B
892 B

70ms
68ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY0o_tSTAB&v=APEucNVZqAtpNXm70ajWVR3-_efXi3J956ys5LWQojpjCItx2Y3mdJj4IHIVsx1uJAvk3OfJsUmLeL2GJ9tzVIc3kC6_N7C0FoASs8j4eDOryLLdpEaAYMSkXgf6-V59Vgn3T3lD2L68NoXXOGYMYBFRAHr2MOjb-UXVRh7nhL-vFgNrBe7uTjEN5J_XE1IDqHJAUbW9ue0IjzWsGAEbFH75WAL55S5Zxw
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 17 Aug 2021 06:46:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI-J6lQwW7_T9Rs7GmU-JGI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D59F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPW7R3ebVlb6NO0nnQAS64o&google_cver=1

43 B
1005 B

56ms
56ms

Image
image/gif

185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPW7R3ebVlb6NO0nnQAS64o&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY0o_tSTAB&v=APEucNVZqAtpNXm70ajWVR3-_efXi3J956ys5LWQojpjCItx2Y3mdJj4IHIVsx1uJAvk3OfJsUmLeL2GJ9tzVIc3kC6_N7C0FoASs8j4eDOryLLdpEaAYMSkXgf6-V59Vgn3T3lD2L68NoXXOGYMYBFRAHr2MOjb-UXVRh7nhL-vFgNrBe7uTjEN5J_XE1IDqHJAUbW9ue0IjzWsGAEbFH75WAL55S5Zxw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:16 GMT
X-Proxy-Origin: 37.120.209.214; 37.120.209.214; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 080f56de-9e23-4897-b92e-14b0af30f97f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPW7R3ebVlb6NO0nnQAS64o&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D59F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:15 GMT
X-Proxy-Origin: 37.120.209.214; 37.120.209.214; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: d476f870-3ef9-4f6c-946a-e23533eed882
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzE3NDA2ODY5OTkxNjE2OTA1
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2C79 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 16 Aug 2021 00:46:47 GMT
expires: Tue, 16 Aug 2022 00:46:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 107968
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 0k1uvb5ne9s9 Show response
hal9000.redintelligence.net/zone/ Frame 4B34 11 KB
4 KB 171ms
56ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/0k1uvb5ne9s9?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7HpiN1sbYaSEHa_P7_UP-q6U2AeBiOHUYMaU1_aFCvAuEAEgqoDDImDxrfyFpB_IAQmpAnxNTQfFwLM-qAMBqgTSAU_QWfx7CrtmPXFd11JA44mTzdPA1c6O8-3iW0XRvQu8kyQe6BxHhxRbMYvZux8c944O-IB_3as3SxybegIDxxlLYIgGoXtjZkW2kGYFMF5zxF5jr0R9qq0Lbw9rngcKY2olDWSa8HXmQVd_OS4qA8lHl5fTRtl92CRUBAJN7KD150ZChVPM4TRPFVn2sWNS-i3QAtBj7eZTzqXc_ef6ait-27iiTpO8APFcwgSdr8B--o71UmMGauZkmBamJH0kgKd_pKJJYR59_-3ROzX006CpDcAEgqXhs2vgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5HlsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw%26sig%3DAOD64_3ftxOerSYII9SttCEc3jQS4vI_nw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-CZpfks_bsOwdGk0w0zmMoCWKnLfGB44Bwffpde9Fk0mKNpMaNO9t9lvB2KtocRVVoTa88-cHSDlr_KigxRYVS8sSopWvSncZcUySXdbgloxE5AV5BR2CmIppOIj04fhzJRLYHyMbM1j-Z4JpeHabQjdDA36Q%26cry%3D1%26dbm_d%3DAKAmf-B771GI6DyT2qylZWLwjz9D0M0bo92q9WcagyLqZ7vUriiV4-ld_y5I3BFYg6UAAGlMbAPp31LX_M-d3t6zCnccqpb5LLvfeUX2VH-tZQmRXbpWss45KGu5GY0pYz_2A48yKcusOljz8fqo185_nfpON3Cdtr_2GDOmTW9QoQ8jxv9dww7ZFqwHqwIYlFsojpDiA-qKrRSLoeLUm62CS-pnvTeheFuxlczL3-FaIY_JEiq1trbn6QlyTY_A3H8OjE0OP8wfBTPuxWhWtUTR1JOuXQwDADOZMcYfMwciufWq679zRSOVVVUUyOvtUdBS_GeAqABmbb75qaAQ7CRH_PIXhZFSZzAEYERIpmJIXxJspBvscah5DMuTQAlI_XOGtkS-OgdUrRyK5oBUYhMHe9NuXm-VnjGtWn8cNQrxirzPsLxkIhP63yTazTkjfexkHYhU40NH%26adurl%3D
Requested by: Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: c0b92a29f043cd4af8c7a5bf6f8782dadbd9d53f75da60df99407e466f18946a

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:16 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3918
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 container.html Show response
caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A4C1 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ja.nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ja.nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 17 Aug 2021 06:46:14 GMT
expires: Wed, 17 Aug 2022 06:46:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%...
ade.googlesyndication.com/ddm/activity/ Frame 18BD 42 B
107 B 70ms
66ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D1%26dur%3D20010%26vmtime%3D19%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1629182775953;dc_rfl=[URL_SIGNALS];ecn1=1;etm1=0;eid1=11;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 18BD 42 B
64 B 19ms
18ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CWoXBN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAcgDmwSqBN4BT9CG5q2IiWqR9RKp5iKX_qQKAM1Sr7pibBps3-IDHw11ypo2QB5IJMC6mxKzg1K0uhixFVxl91yaeQ_BP_mghHaegtMhTbfzNWDoTXaXnCZspBb5e9DbndFz3NbMkY2NXo8Dz7FH7BXJh4ziJTWyCjxgZPfAk7TIZMgtwOpa90IUuV-y7u1PZYgIydDD3p6Jp_TkS-38rTAAJhhI9o7mVOiLrRcyI_EDovqv4HUJGepoSPNJlbt3wuBEznM0CBwYGaCO395Rm99a1_Ji4bPXe83HDPav3W4fIGaDIoYBwATZ1-Cf2APgBAOQBgGgBk6AB5qq2jWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE7nslwzIE-6h4t0D0BMA2BMKiBQD2BQB0BUBgBcB&sigh=t4l7w-X-kD8&label=part2viewed&ad_mt=19&acvw=sv%3D20210811%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D1%26dur%3D20010%26vmtime%3D19%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1629182775953

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 18BD 0
24 B 147ms
84ms Image
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss060_Cqu6vX0c1beAX7zMJZbgzcb5oq3xF-n40Q4cF7BpMvx5HnwxFaIv8WS0qXAg6chl793d2QrkRq5Phz7g7URsoWKjfQHmsPsTMTOu43gM6MuakX2F9KthSxwv_394rfFtNFjSzT5Ng7RKqPRH4PEr8aSQqzWK1NpE2EkXW_FfV8EiLJPr6lmJ6rJo3fMAyeJ4AUhcJS4GjYlEVzM1_Zw3UCSGYAKZcCyPoE6sfyxhkYExEXvHk5_2nHNjUTGgsuv22ZVelUMd57b1NP7sHsc1RNj0v6P8p9F64eLK11dtJu0_rcSNI1ZcNB9-gIzmGY043f_S0sdhFD4SP1-LAzY367uA23jHCLdY1lSFWRbBSQSa4WHHePVq8lHyeCpO07KKwu_qfyiKyynSV3uqudgQuNI6H3flUXzIXwDzFiLhpBZ57gdVh5umgvIrOVe1Ca79Gsqn8mNq0NWK6zCI7VDjCeFmYpOaGNOKyvAplL7dpVSB6QoCYU5xTJx18PulIkVtJJtPTGJgtNcL24YtcJX15nXjzUOFGPEWFuZwL2cobd8yR0aHb9waMO0gV0otOgmgA7voeRjk6OzEoUzGzXHqSPIZN_FWsMbLSAEwBQvZbQvy4lLPwzytMvKM2juyv452wHnJO_J3itbGfpHycAwTdP5UzYKNLap7HfuJNih1ikBtmQz1xlGjEIcBoMdozuR351fZ7y1S1Ps4hk6LCyL3jntlcjBQnpO_AS47GEdpCiVs9fR8EDsCPbSG4EOj4k_j4m3Rg6qkod7JIiCwfHgiIGrbgVcweORcfDMyiqJTlw4VGVl0hh4G68fvEm8OypguvJbeqm0syxHDaORpdx3Dp2pq9gCMRKupl9yakvr6vc5GnwOOUPEVaY492iGi5wniCPau_G2wLbzVxrMNwGW3Az92TRWaE22O3I7Mq1GQc8DduqOEZRFZIogiLppFS06G1xR_4X6X-skfsMG9aYBofeOYEk2lZzTd02nCcbXOMiP63FfYjqQPEgFC3n6CgxPbUxQagEv5eDF2d1sy056zwZW01hlvJCrH2ACyRmk9ib0W2mDKOqibygEUoSWZFxUH3TIdWA2_BU0p-1PznTGKwfdefAKWjurRDgAhTn8zshtXiyRym01l-82CO1G3yT0WGiGAJIL_zBU_veBzTnTqctJLw40KuzzBeLBXaOG3arClNmv7miA&sai=AMfl-YQrD-api6iJfIq1-K4XUJI-wDdTX0k29I2IzUNofnRJLs2vHNtGpvnJH4IaCPKuL887V5W6oqa61tfdGTggVziV8Xta0BTrrymvc1SQgA-_FJtkk8_zS0y7qb-EGqgNlyCD6DVVll0J8dCj_riuDVwJrYxGIvSyzVLo2aw&sig=Cg0ArKJSzPJU-qVZuSI5EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 17 Aug 2021 06:46:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame 18BD 0
0 19ms
18ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMrnJRCo8yUYvOvykgEgATAB&v=APEucNXp2ijrbG03hBZykj_SSsy2BE7h4-Ywh6GV-h2uN3ESj1FFcTZ6pF-ZDbeum9tCLr9N7Se2FmgQUBT9lOCux2f56kS_fg
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18BD 0
20 B 28ms
26ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%...
ade.googlesyndication.com/ddm/activity/ Frame 18BD 42 B
300 B 69ms
66ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D1%26dur%3D20010%26vmtime%3D19%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1629182775953;ecn1=1;etm1=0;eid1=200101;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 18BD 42 B
64 B 31ms
29ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvBoVFi1YcYmqoPoDjyh61cql4hhy2BN28hpWpHSyIEfl51dXx8M-Mi5MQ8QHMx3uGih_Jy8jQ8htBB9TstEY59TgZnIgkuyr0Z7pjJJK3yArDNPKcLbUfdTVYK4g&sai=AMfl-YSSn4caBkonC9uJ4VlW5zCZ4VeCnzTWKuDOomg-r_RT7_UbPQoRArTpSozH1uC-iMH9TPb0HqH43saBWVk65_WRIQcbfr_QKm8oJN4HVyZtWENDs6QAFaAO7uc4ufWN&sig=Cg0ArKJSzPQAXyFemT2JEAE&cid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw&id=lidarv&acvw=sv%3D20210811%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D1%26dur%3D20010%26vmtime%3D19%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1629182775953&avm=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 18BD 42 B
64 B 20ms
18ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CWoXBN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAcgDmwSqBN4BT9CG5q2IiWqR9RKp5iKX_qQKAM1Sr7pibBps3-IDHw11ypo2QB5IJMC6mxKzg1K0uhixFVxl91yaeQ_BP_mghHaegtMhTbfzNWDoTXaXnCZspBb5e9DbndFz3NbMkY2NXo8Dz7FH7BXJh4ziJTWyCjxgZPfAk7TIZMgtwOpa90IUuV-y7u1PZYgIydDD3p6Jp_TkS-38rTAAJhhI9o7mVOiLrRcyI_EDovqv4HUJGepoSPNJlbt3wuBEznM0CBwYGaCO395Rm99a1_Ji4bPXe83HDPav3W4fIGaDIoYBwATZ1-Cf2APgBAOQBgGgBk6AB5qq2jWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE7nslwzIE-6h4t0D0BMA2BMKiBQD2BQB0BUBgBcB&sigh=t4l7w-X-kD8&label=vast_creativeview&ad_mt=19&acvw=sv%3D20210811%26cb%3Dout%26e%3D19%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D1%26dur%3D20010%26vmtime%3D19%26is%3D18%26i0%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1629182775953

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-29 204 csi
csi.gstatic.com/ Frame 18BD 0
17 B 14ms
13ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~ksfpcz5b&c=4382265454967&slotId=2191132727483.5&qqid=COeR1eS6t_ICFd-K_Qcd7GgFLw&fb=outstream-lima&gpm_i=12&gpm_c=12&gpm_a=12&smb=1000&br=853&mt=video%2Fmp4&vs=640x360&dm=20000&event_name=first_play&asset_bytes=215343&video_bytes=0&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=11&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=1&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=videopreviewstarted.uq
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20210811_RC00/outstream.min.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A6D0 640 B
318 B 20ms
19ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUl0B0xCcRr4PH3aklUTE_D2jVvSfaEYBy_ZlvM159OREcHwCU58pcsNY6Y137g; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 17 Aug 2021 06:46:15 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A4C1 54 KB
25 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwXHzZZ5590BXqI3blnQ6EErKsQOuUnq45Bpo4r6F96DzpfnRhWaRQtTSMOTbCOrkSx5cjNS8q5LCufcw4UspdnHfRiCJDnZa9gMZaAwGsAPdZzKgjUcSJIVYJB3VCta3ZKzSR2kVvgHbAuF96s7ySx631ug&dbm_d=AKAmf-DsOSgMd2Zm8E-BdEsfp3PT5ZRsVW2RqCe4sdRgrHNaw_8fYXwPXzVOmy0IkEykP9r78JqHXQLZpyXiu4AusDxPNeqnN-xom9VT6cUugic86oH23IlX7FdhnfxM4Gw2R8U0X9WEAjJxmL4PJMj0mKvBTSv_M5v_jQE2xfECxnSMfWWykdquSlQhTAWUiVPNPfwQ8hNz6mo0kDVx9Nc_g6i2Wvv41VKATqoZjA932xEM1XbnjQCD-qzngAo8aYUSlmBuGHQWQmiD5xOQ1ikmLWOzi64P0brHLsQtASkNzyRcWw6ToTiU9tRPLPqWgnBg5cq_G_N_-ePsi9C49PzE2lWs4F9CFkHzNAWrxr9Feh4y3_G-_Ti0vzlqmJ8bl5vlS3To9BB4EsYRmjGeshlaAoecf9gY1wSmtJVesGtgpFZK4wbnq91nUljIAlJj01oeIc2jpa8WeGH180acNxgHO-MFuWVK-PxO39xBcDyqQoC76D0rb6xzncZpeAhFsd0V8ul6Hi9bZxVDqx0M6nzX7UADfnM4FJotAV2Ju__bJMd69edOoiLiECCJkMVxD4_y6q5_OirWcugkBLwSiyod8KXV6wxuD7nf-bPfuzRa0htUnr81mIBxfFYws2xY-yPmsmlUV6s_wElUq8gjxBE_HxqUdFw3bmEWeSsPFXU_AXOdG5J_SZkNjLwEFxn_C6BgYjOpogiwRIc60hUjUJQ2z0fLLDvgPf0p6gWy-2L5t5y7-SyBbW_98cnrhyM6VNdURepO1HNFLHUPMsTYY6eHpLzHzmKyNuPc_Vt1oekHzSG3N6RQ36MvXnZexYq30PYDap1lfVabUpTLiwLXX_xs5MZ5ozi9jMSStsxgu0xyU3-ldmiYU8lYgsupvZGiJENJcJDWBijEBv0XWgYJFLrPE01h2ePZud4N9CAl6Atb1StRUedvxlWGBULvAULz_6eXgr6MNCQuYc85VxUDJpmBrEQCZTEv2zuPZcT2QNpoPT3_EBhW8lrPYViIqr4LgmHt6dWSyOEjvcyCaPbeapRyVuxzOqLOwyA7dB7gxOR5qeuwS5GkfYdwMPJIxKSrGqTMV5GvZHZMWnmOmMc9Me_pV2mNbtfKtGlg2jnXqJF-pI0MBXaoMVcNL_6__qAz-hJL9NjYahhovoM8_lahy5xZjzSeFna5Rn3hgqCAZh63xKxnRo7ox7Gf1UTqVwYDczY6L4SVGwu9cnzFd3OPv5j2ezOSM0bdpHVY4Vx7SA4ujJKuuCIpfCk_cD0ki6f4B7PzjSjVYM7-7tqiED3WQDpyZD6lviTV8Oq9HMx4UX0NHZb--_4_SaFglN20r8YR_FN9iq-_6Zxze4GrxdEzqWGAoYcbM5LL7rjzr86ESyKEwOumwDykfmLlpFGxTG-pMAb4OlNkFieO5QIZRY7dFHok5WyqLfzOpMiJoiiK9Iy1e_TYYPE8kEJgkahtJ_4GWCUzr9HUvNI3dbM-WKitcqrIkNlB7IjzNiZN1lloXYatWDkJVR58TCJFHpEJKNl7vgHJa2pGhlSCzY9wlGPKZNz0u_QQP5Jhg_nKKdocdZ_3W1J1uOgcK5Okk-MxJXl4FShRnvO4cj8bMCZAb7llbjsOh0f0FiIr3E_DD4OWjrjwnN2CeNCATC70Ba8eAyZ7zpiP1yqxyEvZhJCgoMDcBYdEvg_KbxG0FTLpOeDEdDSGDqQmGtcyr9_7ByJ_anC35wgGsZmjQhcnWxpI777dNyzw9hHNKhhqOz03nIq4jpsKk7177X_n51zIOEVvwC3LCwjx0Q1rhMevNWbiBQnlHpidvwJ3tUElSlRpAoUPJftwfZ-KFaoi4PXHEstVTbSYILC0NqH9B41FReY5sE6-bHLxCW9xi1LERZHJR6Wdkv8C5hACSwI-2a1qiZWlpj-Lbuoxx6b-fE8Bgty_J2H7jbtsRHysAkSr2B-D6oBPBWTEOnBXaRnfDe0vAi3HOVTpbc1Dv9O1xlaTdWtMBORGteN7B7sTmonV8lbBXxGTqTaLI_dzwdbS8PHsFo4O3yLRi_WkOngWUUHG2CWeLoaIUMy0dFiUpkToPF9uyqd8UTVy970LMEK4kX0E1EI-3KJ18cidHMJv9R7YVMnEDo5_TcbkOtmfe1ctyg60LgtVvIOtSLFHiAISPBYW5agddOkBekWPAiQ5QncVeq669bjMgEeeduMr9PgpZf0VVoSsjZqD4VUBy8wllaQrLkd7Jkew_GFFsiqkqAhTUefWfkNfOt_q_KIQYjKHZD2VAtwDC1X-QiAsmlEKpfWvvQw7KLVzLtvl8XvmblAqS9mA4vRtkEtIC7-zNGqH0O-JelIBT3lUNymQvHsynLpFM3ARRJO90YFtDBrL_7kaXOPpvU5U65mp7CfwYwgfBlLwX8an7QsNDWuyOOONQ18kQLl3bkm8o_Wd9NVjHB-37A6HcHHbdF2dGnuSgMzswZWQQQejIVUcLmcqu3suS_JaRvyvNML7IUXNj56pahTT2arJicqwB_uAtbF4WDtcedfXzNXoKzuLe4Stwnpa4257k2rJqSQaQrbgjYBANmlSlxb6eqsrJ8Uj6FDZp2gGBEuCcez9eQVmU0yewCZgrNtoowkbtPozaxcVGJN5ZEU2yA9DtnIX5xv1iYOua6DNoASMKtTtw0TIRb7rGds465GDLR0s4L6z7xR2FQ7sUPzzwxnD2QhPMfYvw12ynppDu_bS729t8CxyUiJ896Y0ASzu4MxJRybWhP4oORufmtaS_UIfY9q6o8cpL3WmUU7KWJT7j1Qkxjaf9eCbTamRd76vWh84JV3sy9STSQTuI8jkGLpjJ4wkx73RLIHBySPq2LappggSbGEON1PFCImiRRculhH40bhJD_1hquPKDTiT5Q07lpXYJv482E3MjJX6eSKLJP7S8jBZLBgMzSoC-JYPAA3xC4qDOkLiC2uxZ3jxTH7atsufPzCf6VMN04B4cLaVVcyLKwZtwUdZxAcSGphcCStlo9ZYyxwb7QarOnogg8jH_cGelcy11uPaV7wyp8AgPKirmWDF-NhoEqyHYqFfYYQoKXg1ZuW7Djj5ZIxBf-n2kHUtgNkirdFZj9rRx4NAgu5IVZ6Kxff6h-0mHbTnNqzYalaaxB7IxeoWivwwHFkzkt8EIubDjMqTRC8hRLKPnjTIxJiCOYx6aKyQymcjpoxvhTsMC4jfPBrijr2S-td3WINh9aVjkk-XnItOqm7bFQXEC_hMMx868zy3WTqCu-28X6oqCreTmZNaU4q7JYdKSJB-cJDDTloIS2PSHAO-FqbCVZFl1MPKj2wvU4M_3W45PvppwjDTbG6k_qGTw76Mh9Azj0pNUkPmr4g8DZ9G6bBExaKOsRXU3ZVx0fHj5jZSIZBx5fZKJj7Aaw7c&cid=CAASFeRo3KSBtBUxR8CIbwlT2b9ghn5XSQ&rfl=1%2Chttps%253A%252F%252Fja.nex-software.com%252F%240

Requested by

Host: ja.nex-software.com
URL: https://ja.nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

616b28e4f5d4ac64577d0c9362eb1b7e68e88f13779d994d895ff3d6fa7a06c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25698
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A4C1 42 B
63 B 28ms
27ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BoIjk4UNS19ZPSv7O_EkQpyvuZsoPPIuogp0UY225ccni6YI2bRbuCVQ-zD7lVnFdyf0FZM5aVwaPz4_3i6Btn4gA4-iWgZ-PCA1N1VYaGvrzFZ1k

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame A4C1 2 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/window_focus_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:17:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1703
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:17:52 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A4C1 124 KB
37 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:46:15 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1629113426487594"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38194
x-xss-protection: 0
expires: Tue, 17 Aug 2021 06:46:15 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/ Frame A4C1 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210812/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:27:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6205
x-xss-protection: 0
server: cafe
etag: 3431872159862141604
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:27:01 GMT

GET
H3-29 200 Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js Show response
pagead2.googlesyndication.com/bg/ Frame 2C79 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0239bfd43728e85cc93174d290d229af26b978e2a325070598bbcee72d075b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 00:17:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13491
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 00:17:46 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4DC6 0
20 B 29ms
28ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9N1dN1sbYZrFIfGU9u8PhaqO0AsAAAAAOAHgBAI&bg=!i4iliMzNAAZvV8FTb1c7ACkAdvg8WkbxqrXSCNvhbfj91nkdiWlupAya4t99mzHytpGacnZHAInIyAIAAADPUgAAADloAQeZAscN4YdS3SBEICEgTuOnDxh1awHfLTmBXootRrzfWEMUs31sXh5eFfUrhVEVXhQqIQ-YMEBCXbtq3-TNnNbTKnlXs_1Eg0uJRPDJIvUL8xnpylGtYcreugnS9582223lbCpsskYaKMn7bIwJKwhjrK4GSkVnJrbUOsMQ9NPI2byD9M1rn2YniLzQyETYeCPVrHDor-DH4BxTqzx8IRAmiSy0U9YiZhQfzTcoItepeWvGs6FuFDaYQze_IsYKtaFZ8O69dDfox5CubpZdNVKW00gV8E6w0Xgi6lmo9t9oWiWxqBcu5NAjUjPO2FqFt13MgJtniQ3QBhrRmzi7z74KXfzfFq8qEmrWDoZYG37aExN-0GsJzl0oOUsIkgZyWTKAIr57kN4lJNk7wL6fxg4Iowk-BeZ5aIG-2m46mRkW-mdlovYqD8eOI4vE8zhpFiPSaw9gtg7jSH7O3sDeegsLVYLUGeJvtKpFQbvKILyBhS0e9l03w-gW1sIGDK3Bh4TBjnwvhgYTcaEDnnpdOm7vRecPMC0aVoEhj1hvTdJVmjIBLHBMk8I2kRTBgPvSEjWW_qlfmLybIYaqn416x5cTdwiyLT3tB9eBMQObDJGEOj5tBF1l2mOvEItxt-ZDVs_hzKfREb0Ngsyub0sacCxA84b0B1uqFFyUkZc8OygVzaL0ZQeLKf-gE_R3FXYlM5DnM87uDYOrXmKCH8BL9dgQ8ex1hggxgZkGko0IbH1hCf-w0IMQ-iZWy0TY0Gg-UEfg3-rhAkCJ5KFuc7uirwFaQnMPlSNbzIzQOjDE_3yD_Cmx_2RUCzdj7p4AZTt8JJwbXkIzJj5cG3NWH0puuhL2sEI8y58vSm4MC8UqYqzlgQGTemIDtVWmfiBk7iW7ocbegh-_u4f_iJYUqsqKlPA9M9-8E7jA6ZzOHnqtNOtrdY7IHs7nDqZ81HM

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A6D0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIRVMvcM4s4TcIImnldSCqA&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIRVMvcM4s4TcIImnldSCqA&google_cver=1

43 B
172 B

54ms
54ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIRVMvcM4s4TcIImnldSCqA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.213.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
via: 1.1 google
server: OXGW/16.213.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEIRVMvcM4s4TcIImnldSCqA&google_cver=1
date: Tue, 17 Aug 2021 06:46:16 GMT
via: 1.1 google
server: OXGW/16.213.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame A6D0
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTUxZmE5MTEtMzlmYS0yYmQxLWMzYWQtODQ5OWU2OGUxMzVi

170 B
188 B

69ms
68ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTUxZmE5MTEtMzlmYS0yYmQxLWMzYWQtODQ5OWU2OGUxMzVi

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 17 Aug 2021 06:46:16 GMT
content-encoding: gzip
server: OXGW/16.213.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTUxZmE5MTEtMzlmYS0yYmQxLWMzYWQtODQ5OWU2OGUxMzVi
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame A6D0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEJ54M53CJ2UNCktgyo5YHEc&google_cver=1

23 B
172 B

147ms
87ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEJ54M53CJ2UNCktgyo5YHEc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 17 Aug 2021 06:46:16 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEJ54M53CJ2UNCktgyo5YHEc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame A6D0 23 B
172 B 235ms
88ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJC1NBCfyqQCGO7Pw7ABMAE&v=APEucNXBL1VmhcITxqZQNH7uyRrs0dJiS5eYkaYYMYZGshHgBZqvDQV6yL-XAoq4__5EieMSPEox95UC810emZXXvbYFUxOpRcisdM3GVU7fI9KPtUKEvUbj0-7KHv2Ofp5aD21AqNubEZb3K8DVBLrJwxfvy_SXeGC1c4b7jzV6JUfVUfuJPXkLOpowMpxLDv-9Dg33Ejxetqm7tJB2gw9a53Vurv9Ixg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 17 Aug 2021 06:46:16 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/ Frame A4C1 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwXHzZZ5590BXqI3blnQ6EErKsQOuUnq45Bpo4r6F96DzpfnRhWaRQtTSMOTbCOrkSx5cjNS8q5LCufcw4UspdnHfRiCJDnZa9gMZaAwGsAPdZzKgjUcSJIVYJB3VCta3ZKzSR2kVvgHbAuF96s7ySx631ug&dbm_d=AKAmf-DsOSgMd2Zm8E-BdEsfp3PT5ZRsVW2RqCe4sdRgrHNaw_8fYXwPXzVOmy0IkEykP9r78JqHXQLZpyXiu4AusDxPNeqnN-xom9VT6cUugic86oH23IlX7FdhnfxM4Gw2R8U0X9WEAjJxmL4PJMj0mKvBTSv_M5v_jQE2xfECxnSMfWWykdquSlQhTAWUiVPNPfwQ8hNz6mo0kDVx9Nc_g6i2Wvv41VKATqoZjA932xEM1XbnjQCD-qzngAo8aYUSlmBuGHQWQmiD5xOQ1ikmLWOzi64P0brHLsQtASkNzyRcWw6ToTiU9tRPLPqWgnBg5cq_G_N_-ePsi9C49PzE2lWs4F9CFkHzNAWrxr9Feh4y3_G-_Ti0vzlqmJ8bl5vlS3To9BB4EsYRmjGeshlaAoecf9gY1wSmtJVesGtgpFZK4wbnq91nUljIAlJj01oeIc2jpa8WeGH180acNxgHO-MFuWVK-PxO39xBcDyqQoC76D0rb6xzncZpeAhFsd0V8ul6Hi9bZxVDqx0M6nzX7UADfnM4FJotAV2Ju__bJMd69edOoiLiECCJkMVxD4_y6q5_OirWcugkBLwSiyod8KXV6wxuD7nf-bPfuzRa0htUnr81mIBxfFYws2xY-yPmsmlUV6s_wElUq8gjxBE_HxqUdFw3bmEWeSsPFXU_AXOdG5J_SZkNjLwEFxn_C6BgYjOpogiwRIc60hUjUJQ2z0fLLDvgPf0p6gWy-2L5t5y7-SyBbW_98cnrhyM6VNdURepO1HNFLHUPMsTYY6eHpLzHzmKyNuPc_Vt1oekHzSG3N6RQ36MvXnZexYq30PYDap1lfVabUpTLiwLXX_xs5MZ5ozi9jMSStsxgu0xyU3-ldmiYU8lYgsupvZGiJENJcJDWBijEBv0XWgYJFLrPE01h2ePZud4N9CAl6Atb1StRUedvxlWGBULvAULz_6eXgr6MNCQuYc85VxUDJpmBrEQCZTEv2zuPZcT2QNpoPT3_EBhW8lrPYViIqr4LgmHt6dWSyOEjvcyCaPbeapRyVuxzOqLOwyA7dB7gxOR5qeuwS5GkfYdwMPJIxKSrGqTMV5GvZHZMWnmOmMc9Me_pV2mNbtfKtGlg2jnXqJF-pI0MBXaoMVcNL_6__qAz-hJL9NjYahhovoM8_lahy5xZjzSeFna5Rn3hgqCAZh63xKxnRo7ox7Gf1UTqVwYDczY6L4SVGwu9cnzFd3OPv5j2ezOSM0bdpHVY4Vx7SA4ujJKuuCIpfCk_cD0ki6f4B7PzjSjVYM7-7tqiED3WQDpyZD6lviTV8Oq9HMx4UX0NHZb--_4_SaFglN20r8YR_FN9iq-_6Zxze4GrxdEzqWGAoYcbM5LL7rjzr86ESyKEwOumwDykfmLlpFGxTG-pMAb4OlNkFieO5QIZRY7dFHok5WyqLfzOpMiJoiiK9Iy1e_TYYPE8kEJgkahtJ_4GWCUzr9HUvNI3dbM-WKitcqrIkNlB7IjzNiZN1lloXYatWDkJVR58TCJFHpEJKNl7vgHJa2pGhlSCzY9wlGPKZNz0u_QQP5Jhg_nKKdocdZ_3W1J1uOgcK5Okk-MxJXl4FShRnvO4cj8bMCZAb7llbjsOh0f0FiIr3E_DD4OWjrjwnN2CeNCATC70Ba8eAyZ7zpiP1yqxyEvZhJCgoMDcBYdEvg_KbxG0FTLpOeDEdDSGDqQmGtcyr9_7ByJ_anC35wgGsZmjQhcnWxpI777dNyzw9hHNKhhqOz03nIq4jpsKk7177X_n51zIOEVvwC3LCwjx0Q1rhMevNWbiBQnlHpidvwJ3tUElSlRpAoUPJftwfZ-KFaoi4PXHEstVTbSYILC0NqH9B41FReY5sE6-bHLxCW9xi1LERZHJR6Wdkv8C5hACSwI-2a1qiZWlpj-Lbuoxx6b-fE8Bgty_J2H7jbtsRHysAkSr2B-D6oBPBWTEOnBXaRnfDe0vAi3HOVTpbc1Dv9O1xlaTdWtMBORGteN7B7sTmonV8lbBXxGTqTaLI_dzwdbS8PHsFo4O3yLRi_WkOngWUUHG2CWeLoaIUMy0dFiUpkToPF9uyqd8UTVy970LMEK4kX0E1EI-3KJ18cidHMJv9R7YVMnEDo5_TcbkOtmfe1ctyg60LgtVvIOtSLFHiAISPBYW5agddOkBekWPAiQ5QncVeq669bjMgEeeduMr9PgpZf0VVoSsjZqD4VUBy8wllaQrLkd7Jkew_GFFsiqkqAhTUefWfkNfOt_q_KIQYjKHZD2VAtwDC1X-QiAsmlEKpfWvvQw7KLVzLtvl8XvmblAqS9mA4vRtkEtIC7-zNGqH0O-JelIBT3lUNymQvHsynLpFM3ARRJO90YFtDBrL_7kaXOPpvU5U65mp7CfwYwgfBlLwX8an7QsNDWuyOOONQ18kQLl3bkm8o_Wd9NVjHB-37A6HcHHbdF2dGnuSgMzswZWQQQejIVUcLmcqu3suS_JaRvyvNML7IUXNj56pahTT2arJicqwB_uAtbF4WDtcedfXzNXoKzuLe4Stwnpa4257k2rJqSQaQrbgjYBANmlSlxb6eqsrJ8Uj6FDZp2gGBEuCcez9eQVmU0yewCZgrNtoowkbtPozaxcVGJN5ZEU2yA9DtnIX5xv1iYOua6DNoASMKtTtw0TIRb7rGds465GDLR0s4L6z7xR2FQ7sUPzzwxnD2QhPMfYvw12ynppDu_bS729t8CxyUiJ896Y0ASzu4MxJRybWhP4oORufmtaS_UIfY9q6o8cpL3WmUU7KWJT7j1Qkxjaf9eCbTamRd76vWh84JV3sy9STSQTuI8jkGLpjJ4wkx73RLIHBySPq2LappggSbGEON1PFCImiRRculhH40bhJD_1hquPKDTiT5Q07lpXYJv482E3MjJX6eSKLJP7S8jBZLBgMzSoC-JYPAA3xC4qDOkLiC2uxZ3jxTH7atsufPzCf6VMN04B4cLaVVcyLKwZtwUdZxAcSGphcCStlo9ZYyxwb7QarOnogg8jH_cGelcy11uPaV7wyp8AgPKirmWDF-NhoEqyHYqFfYYQoKXg1ZuW7Djj5ZIxBf-n2kHUtgNkirdFZj9rRx4NAgu5IVZ6Kxff6h-0mHbTnNqzYalaaxB7IxeoWivwwHFkzkt8EIubDjMqTRC8hRLKPnjTIxJiCOYx6aKyQymcjpoxvhTsMC4jfPBrijr2S-td3WINh9aVjkk-XnItOqm7bFQXEC_hMMx868zy3WTqCu-28X6oqCreTmZNaU4q7JYdKSJB-cJDDTloIS2PSHAO-FqbCVZFl1MPKj2wvU4M_3W45PvppwjDTbG6k_qGTw76Mh9Azj0pNUkPmr4g8DZ9G6bBExaKOsRXU3ZVx0fHj5jZSIZBx5fZKJj7Aaw7c&cid=CAASFeRo3KSBtBUxR8CIbwlT2b9ghn5XSQ&rfl=1%2Chttps%253A%252F%252Fja.nex-software.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:42:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 245
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9341
x-xss-protection: 0
server: cafe
etag: 177112232901409761
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:42:11 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/ Frame A4C1 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210812/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 06:34:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 31 Aug 2021 06:34:09 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame A4C1 0
24 B 85ms
85ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss8-c7GqbKi6fby_Sp3XI2x2rNCK6xvsqievwbGU1r8GF-EaU9FHhicm_QHLdGmvrC6F5n-_loukGi8ZM-DH87GArxyxSYOSeFF8EHOIyIzB7JOU4GssvrjlLGFxidmiJ6XVq1_ZxqE981s-uxiBxk4qpqPXB6y_o6Cs9L-Ey7xhlxDNKFIOQ8TJt7TWB9lD2X6B1HJXtPniSloX-C1Yr0Tyh1jmZfEuU9got-ix9chCG4F_6A8ZqQmnsqZworhiJnpMi0iH3bajrJVFuWeagVKWIxvzK46WKDaqDf3SO-6wO6qI0Y_sKLduosXJHrBabU1NoI5wBNMJjxLXY4CbYXiPOIh83gIMCFttSVH4RGX-oyd796QPJkAx5Ipqsj7-odnPuoYPw8lneuRIOOA514d6o3cDsyxLmt42VfayI7yaq9rkA_Wv-cf4zK5ciO_GIUPJKAHLOhmpm7z5cqwGzLWiWobZrV0uHe8qGF3IBO2xwz6zsdJl5_yQ2yj4fzvvAs5Ayd5F3Jpe6ct87xnzFOigJ-nDXvGXjFZZVZZh8xBncMYgt-SKXk6e9oRr6-M-dZr2xitDeq2k6KUGaqSF8H7uDw44X4VEDK_UxljX6V08p0wFjkbq207il2f_Gu5CslQYj8717qyL6-mNyrv-7NJ47xv5A7epCMxyDAAy5vzy6MEV4_nJh-13Ad6b-OWiPZ1iO6skpGy6sWOvouPAAwliwVx7_ItzfLxuLBFrIH-9GohPAWhBn-IMwnq2DszPxhK8IuyeT5xZNkCpSzEXmEcCNsksO8SCKu9vR6pzfUZ9wl7XM7mU5yjRxgbUL8eGzmTxUjhDYAEd6HWTbugQd9-xBcAb3vgfWlZ4f9RoslQe4zcnbJ2jvyk5q5mg-aQvtZs3DgBjQTT_JPw0_glnoeo8iAWY8w0rZ-pVrbQjHOtO6oBVUVw3TwJqcV9R6femZZtOhjPTpN97CboSPvuHs2XqscQm048gNfmdGQokrH-Krb9pcTOlHP079XyK47zJxhnlizhjpCiUg0UWGcsjzXzrfpOtTbtR6sANrF6Hlh4VLGqGbo31hVxI7r3POWuOFevZj-BzMTrg6-RNVX4Pgg3dhywLQFeQubYt00CivW__8fPHLWLZcihGqY4uRrw2ayTiknoS-G6p_uE7wjVvmEwDxqKHOheQPCK5D25nR0VnwIfejQkP0q-&sai=AMfl-YTzlPKPv1rGwL86upSNcLmPeTIhaqJewH1Do6tXf62Ay4Ts6AaJcMefxX6W7AAhmPPRhknnglqR7lae9_yLuiJSil26dkMqAJQEtk2A-O7sVg9AMoUJcJ6ja33n-CJnQQicNvcJInsT92rSvC_LXiMFeeeT30aW0Axvm9o&sig=Cg0ArKJSzPC-PHsEFeoHEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210812.56416&adurl=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 17 Aug 2021 06:46:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A4C1 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 17:07:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 308305
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 17:07:51 GMT

GET
H3-29 200 10487663242572772438
s0.2mdn.net/simgad/ Frame A4C1 81 KB
81 KB 21ms
7ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10487663242572772438

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d734d7cac9ee378c70d4ce345bdffe188d2b8fa5d90f117047afd863b97d1e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 04:33:54 GMT
x-content-type-options: nosniff
age: 94342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83334
x-xss-protection: 0
last-modified: Fri, 23 Jul 2021 17:34:23 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 04:33:54 GMT

GET
H/1.1

200
OK

request.php Show response
hal900010.redintelligence.net/ Frame 4B34
Redirect Chain

https://hal900010.redintelligence.net/request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900010.redintelligence.net/request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

611 B
935 B

235ms
110ms

Script
application/x-javascript

138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7HpiN1sbYaSEHa_P7_UP-q6U2AeBiOHUYMaU1_aFCvAuEAEgqoDDImDxrfyFpB_IAQmpAnxNTQfFwLM-qAMBqgTSAU_QWfx7CrtmPXFd11JA44mTzdPA1c6O8-3iW0XRvQu8kyQe6BxHhxRbMYvZux8c944O-IB_3as3SxybegIDxxlLYIgGoXtjZkW2kGYFMF5zxF5jr0R9qq0Lbw9rngcKY2olDWSa8HXmQVd_OS4qA8lHl5fTRtl92CRUBAJN7KD150ZChVPM4TRPFVn2sWNS-i3QAtBj7eZTzqXc_ef6ait-27iiTpO8APFcwgSdr8B--o71UmMGauZkmBamJH0kgKd_pKJJYR59_-3ROzX006CpDcAEgqXhs2vgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5HlsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw%26sig%3DAOD64_3ftxOerSYII9SttCEc3jQS4vI_nw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-CZpfks_bsOwdGk0w0zmMoCWKnLfGB44Bwffpde9Fk0mKNpMaNO9t9lvB2KtocRVVoTa88-cHSDlr_KigxRYVS8sSopWvSncZcUySXdbgloxE5AV5BR2CmIppOIj04fhzJRLYHyMbM1j-Z4JpeHabQjdDA36Q%26cry%3D1%26dbm_d%3DAKAmf-B771GI6DyT2qylZWLwjz9D0M0bo92q9WcagyLqZ7vUriiV4-ld_y5I3BFYg6UAAGlMbAPp31LX_M-d3t6zCnccqpb5LLvfeUX2VH-tZQmRXbpWss45KGu5GY0pYz_2A48yKcusOljz8fqo185_nfpON3Cdtr_2GDOmTW9QoQ8jxv9dww7ZFqwHqwIYlFsojpDiA-qKrRSLoeLUm62CS-pnvTeheFuxlczL3-FaIY_JEiq1trbn6QlyTY_A3H8OjE0OP8wfBTPuxWhWtUTR1JOuXQwDADOZMcYfMwciufWq679zRSOVVVUUyOvtUdBS_GeAqABmbb75qaAQ7CRH_PIXhZFSZzAEYERIpmJIXxJspBvscah5DMuTQAlI_XOGtkS-OgdUrRyK5oBUYhMHe9NuXm-VnjGtWn8cNQrxirzPsLxkIhP63yTazTkjfexkHYhU40NH%26adurl%3D&documentReferer=https%3A%2F%2Fja.nex-software.com%2F&ancestorOrigins=https%3A%2F%2Fja.nex-software.com&random=7248249264890&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8b2d63b492d59d6852d7539d2a6d9e01a250c09deaff56a056cc03a88bae7650

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:16 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 45692800033150300044684011689010
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 329
Expires: Tue, 17 Aug 2021 07:46:16 +0200

Redirect headers

Pragma: no-cache
Date: Tue, 17 Aug 2021 06:46:16 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7HpiN1sbYaSEHa_P7_UP-q6U2AeBiOHUYMaU1_aFCvAuEAEgqoDDImDxrfyFpB_IAQmpAnxNTQfFwLM-qAMBqgTSAU_QWfx7CrtmPXFd11JA44mTzdPA1c6O8-3iW0XRvQu8kyQe6BxHhxRbMYvZux8c944O-IB_3as3SxybegIDxxlLYIgGoXtjZkW2kGYFMF5zxF5jr0R9qq0Lbw9rngcKY2olDWSa8HXmQVd_OS4qA8lHl5fTRtl92CRUBAJN7KD150ZChVPM4TRPFVn2sWNS-i3QAtBj7eZTzqXc_ef6ait-27iiTpO8APFcwgSdr8B--o71UmMGauZkmBamJH0kgKd_pKJJYR59_-3ROzX006CpDcAEgqXhs2vgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5HlsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw%26sig%3DAOD64_3ftxOerSYII9SttCEc3jQS4vI_nw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-CZpfks_bsOwdGk0w0zmMoCWKnLfGB44Bwffpde9Fk0mKNpMaNO9t9lvB2KtocRVVoTa88-cHSDlr_KigxRYVS8sSopWvSncZcUySXdbgloxE5AV5BR2CmIppOIj04fhzJRLYHyMbM1j-Z4JpeHabQjdDA36Q%26cry%3D1%26dbm_d%3DAKAmf-B771GI6DyT2qylZWLwjz9D0M0bo92q9WcagyLqZ7vUriiV4-ld_y5I3BFYg6UAAGlMbAPp31LX_M-d3t6zCnccqpb5LLvfeUX2VH-tZQmRXbpWss45KGu5GY0pYz_2A48yKcusOljz8fqo185_nfpON3Cdtr_2GDOmTW9QoQ8jxv9dww7ZFqwHqwIYlFsojpDiA-qKrRSLoeLUm62CS-pnvTeheFuxlczL3-FaIY_JEiq1trbn6QlyTY_A3H8OjE0OP8wfBTPuxWhWtUTR1JOuXQwDADOZMcYfMwciufWq679zRSOVVVUUyOvtUdBS_GeAqABmbb75qaAQ7CRH_PIXhZFSZzAEYERIpmJIXxJspBvscah5DMuTQAlI_XOGtkS-OgdUrRyK5oBUYhMHe9NuXm-VnjGtWn8cNQrxirzPsLxkIhP63yTazTkjfexkHYhU40NH%26adurl%3D&documentReferer=https%3A%2F%2Fja.nex-software.com%2F&ancestorOrigins=https%3A%2F%2Fja.nex-software.com&random=7248249264890&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Tue, 17 Aug 2021 07:46:16 +0200

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AC53 0
20 B 28ms
28ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B4B7dN1sbYeD-JZO9-waE1I-ACQAAAAA4AeAEAg&bg=!w8ClwITNAAZvV8FTb1c7ACkAdvg8WhugS1phw836F7plrQKeW9a0N0lQxifIgt1XKzcuMvbvbji2PAIAAADIUgAAAC5oAQeZAs3bjZZmsuTJec5BtdboK65wT9PPfWfJdipHWdIfWPOrhmH3c-d9CUQRyOqiaVaeSQ9BW2UColaTF5UDAnQNADZkEKpN0ZqsQAJJ4F88pC9IbyI4aa4ZdfhEVk2wIJL0p1ve3SkB-LBdgcUkDNgykFpO4wsT9A66KQLVdCMwh0U_XOORacRNgsGq69kRKLVBF9AKPCGhc3UARH3IfgTcYMfr_HVpAz_mowFMoOl0KoJD3-igCU1Ite6vvkghv6Pj0GzDd1ctFlpxhn-hzKN6kxHS4A1JggdttMtkFi0pnofyT3H9UmGKmRwn7_xAvsv4RjjTDXBbs4cKY55FGbF8SgmoJvd6WlyIfcCnjPDlJgWFct545o8wj7MNGmUvJFlf7ll57Dh9JpRbAahQpTWtIDaaM6B4nQZg9dy_OqKxWW8RRTOa8Tv7TV4kNdjIIhDvQyE8oGLM_RpH-jwLAqFW2mzuOiuVg6i4tTtVzOpbSN4LfQ7Upty06QYeIYxvNLiNYbf9vuc9sumsPp0KS0NPkejazkbocvbYHvDUxETE0Zl77pUtjC1su-qaVKakvN5XFqB5aUJyWR5sUFS9BWhLOqQu4A7POlFVuiB7AQRkFF83Ox71TAiwUiPkCG-sdpUouzoC3SkMESeuMdzAeZpinSUtmkKmgnUk2YTSa6OkhPiatpPHrfohegQc3I9vIeaPQpYPU1X0NTGHo4chEgJnxZCYYPncl6F3Sul3rBTmfz8MR3KW9CZiV-22jAJQzQO0VRztn6W3obctlBdFKW-PCi7payzeTqTYCmJ4Wnsz2tYa3MIsPErH_IljoDovOo1u9FfSV-8DBvJ5ARL6jgM6zvaItArVRIMdGdfefLKhTzwL5CJIN1FeevbL4SiluO48pN4RK8TU0ngm0ZuNmOfAcnQNlf6mGWPh2BFSRNevTfEBd9vTdhvDylKnXm6TVHQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 223A 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 16 Aug 2021 00:46:47 GMT
expires: Tue, 16 Aug 2022 00:46:47 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 107969
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame A4C1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5eb75ebbe618db4339b39a1bd18bfc9213183fdc5f4fa1ef98bdf7d6010907c2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame A4C1 0
23 B 79ms
79ms Ping
image/gif 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js Show response
pagead2.googlesyndication.com/bg/ Frame 223A 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ajm_1Dco6FzJMXTSkNIprya5eOKjJQcFmLvO5y0HW5A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0239bfd43728e85cc93174d290d229af26b978e2a325070598bbcee72d075b90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 17 Aug 2021 00:17:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23310
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13491
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 14:48:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 17 Aug 2022 00:17:46 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C79 0
20 B 29ms
29ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BMKTNN1sbYYyyMJuWgAfszbTgAwAAAAA4AeAEAg&bg=!fX6lfjrNAAZvV8FTb1c7ACkAdvg8Wi4vxL8vz8XydTMUK9wFDJdjkyF4QAyP052gyM0dGqHYjdf4xgIAAAD4UgAAABdoAQeZAsa_drQRblj7vy9Wvvbfmkct-QV4i9gsIBjIkMq8WkgCfzOKKVHyyywwQgPQjEbaVLPVrVO9Rni92RbgIB2LoUFh4qaQRXs9bDEteDRixMQPgN_klZqZ9T4-a18KkHN4Ztvga3H37gUOjcCd7wXhXpQe4fIiIxmo9h1N_hFcUJeO2X5B0uF69BokfYbXrl6IDdDqYl2n-SL-TPr43S4TD3sU0H_bcUB8QUSQ7gW7-NghBbmaEoBWY1E46zcmCI6psbTAkpFOfJ1yTOhTocFpln4n_eh5CNAO9J7dnLAdEN-O-D8wEx5XmpvQX1kJdfvgbb0Ee4MYsuMlwFSbBXmvo5TAjJ-NGrEzgj_bm4W2uKKxwceNyE-x739haCReCOD48QuWgHKNrA9JCAqVQOMX-zmTwXa-8YNS3nHkjSiOOQlSx7pgumx77ZlZ1MZMRQPtgTOwSRO9hrwthEg5sf1MYUTv2d72y6cJCoY2M_EIQNrjh6jOnvoE697c79xE72PZ5D7epDDhrFav__zQ_oxmIFIjVT3TcdPlhG0xM-C2LSy_a-HjxYZYhEcomHI086SSQpNonU3hVsv6VIjRvoVYqxtBuFUwo8n1tgHu26EH_SWg70UW4kkoIaJjuIelluqYkhzNcK_EuhdDWibUdWTVjKd4yo7ej62sAujH_CUZvU_FKmihOdlhojaATLyxw085p7SWkbrDax4ylykN8KWqq7ZOwQEMVxG3Z1jVYmkGVEWIitN1iYWViJ0CEDTrjZO-QjJIVZg5qwD3gNmhzWpYGWV6P2WFHy9NzQEHOflMNT7yWA_X8dhIXoSqTr0XRGqQRAXAygyIslSPo9ihfABT4EO2pfO72C6pHZrPzu4dKw7gMIhuuslKjjqUGhAjzTFvm9tEHNvRSHSL8bO154DpkmOL_5uqd55exYUfHsrBu1fOfvZTDsbqbg

Requested by

Host: caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
URL: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 223A 0
20 B 28ms
28ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BOdLON1sbYbexPNzh7_UPgMeryAIAAAAAOAHgBAI&bg=!U1ClUBTNAAZvV8FTb1c7ACkAdvg8WjXD6263MOxCZprjPiz96ygYgQQNPdsxP9A27QbCecWoBDv5RQIAAACyUgAAAAxoAQeZAtE3VDbuWXMPnpLZu_eUvsFJk1jvnvC32NZqhGflVW49_itTUnr-0SNbFCvwdeYjBf6-SWiMZrUqVvL9_kWLSBbE9BNTl1htqaqBstArwBMJUPTtam6JBjpT6PAwSXXYFwswSzUR5J5wah1SE1fD7415-SJZGUk7kKx9MDNzPAISlzhZac3l4Lvgj3LB4mIHH7t5zhydvKoBsA6_1lxL9gq56-hh0KEsdXLr05TeFQ45Aoz3SjoVVIhDJO-QLvGI1Z4Nddqi0uBE7KqNeBGFph9aN25E3y9fpZr3_FCDhsjwP6TRZB0XXDBiTMdVsze9wTke3EUwNw_-GlzK_g-GuwjjlcLz9jD5n-evz37l_4_dP5p07bCyOomfFvQas0r3ZcV8Zykc7dmXlKNtK_P7CVX2x4zWwNJHGYNADWvFC6--BoTOcVJgY3VJ7dHHecChH9hVs7Joj6ro-1WggZmDg9NuirX8WP6w87G22rG2ZVK9Fks0CpUtSi9GK_s6UzyZQd-pumb0zqK-HJCVLXQPpsL9GywrgvKQ4TOGrI4u1cnhP_jqyCqN5ENdw76iNVXDwEkVh1shLmZPBJBVb2LqPoYpL2brbq6cXflIeltckx5wE5GB1LS8PxcX3dyvJCT6cvPG1g0TcOquNXL36P5hPH17EcfawBB3RaiWky1jEgkLDIxTx-e5Tk7i7eFlOk24IJ2nHRI1Ga1SFriAOydN599OQIO8UE4hjQ4prajl9IAATpkHCXAa4m7GMkoP_bUsWVrM6fKObKtgujj1BQtcJgzFjv6IHVDPj4n_BSk4AMDQnsJFxR40L7nRuF6HmpzdZ9Fn86MvtEyl9L2XtRBWdIp99t6LwN9j7I3Zur2oSd0RbnD6-12mBlZLUIbHHSONAnxoHRSfCbjhm-aoDe3r9TQ9d1lC6GpcMuO4qD5D9s1Qz9I_Yxepay9tAu-GPN77KRjt

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal900010.redintelligence.net/ Frame 6863 7 KB
3 KB 159ms
54ms Document
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request.php?zone=0k1uvb5ne9s9&nw=20&renderingType=javascript&namespace=2ca7d7b5e3&subid=&uid=b679d8fc288e3d5c&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC7HpiN1sbYaSEHa_P7_UP-q6U2AeBiOHUYMaU1_aFCvAuEAEgqoDDImDxrfyFpB_IAQmpAnxNTQfFwLM-qAMBqgTSAU_QWfx7CrtmPXFd11JA44mTzdPA1c6O8-3iW0XRvQu8kyQe6BxHhxRbMYvZux8c944O-IB_3as3SxybegIDxxlLYIgGoXtjZkW2kGYFMF5zxF5jr0R9qq0Lbw9rngcKY2olDWSa8HXmQVd_OS4qA8lHl5fTRtl92CRUBAJN7KD150ZChVPM4TRPFVn2sWNS-i3QAtBj7eZTzqXc_ef6ait-27iiTpO8APFcwgSdr8B--o71UmMGauZkmBamJH0kgKd_pKJJYR59_-3ROzX006CpDcAEgqXhs2vgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5HlsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw%26sig%3DAOD64_3ftxOerSYII9SttCEc3jQS4vI_nw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-CZpfks_bsOwdGk0w0zmMoCWKnLfGB44Bwffpde9Fk0mKNpMaNO9t9lvB2KtocRVVoTa88-cHSDlr_KigxRYVS8sSopWvSncZcUySXdbgloxE5AV5BR2CmIppOIj04fhzJRLYHyMbM1j-Z4JpeHabQjdDA36Q%26cry%3D1%26dbm_d%3DAKAmf-B771GI6DyT2qylZWLwjz9D0M0bo92q9WcagyLqZ7vUriiV4-ld_y5I3BFYg6UAAGlMbAPp31LX_M-d3t6zCnccqpb5LLvfeUX2VH-tZQmRXbpWss45KGu5GY0pYz_2A48yKcusOljz8fqo185_nfpON3Cdtr_2GDOmTW9QoQ8jxv9dww7ZFqwHqwIYlFsojpDiA-qKrRSLoeLUm62CS-pnvTeheFuxlczL3-FaIY_JEiq1trbn6QlyTY_A3H8OjE0OP8wfBTPuxWhWtUTR1JOuXQwDADOZMcYfMwciufWq679zRSOVVVUUyOvtUdBS_GeAqABmbb75qaAQ7CRH_PIXhZFSZzAEYERIpmJIXxJspBvscah5DMuTQAlI_XOGtkS-OgdUrRyK5oBUYhMHe9NuXm-VnjGtWn8cNQrxirzPsLxkIhP63yTazTkjfexkHYhU40NH%26adurl%3D&documentReferer=https%3A%2F%2Fja.nex-software.com%2F&ancestorOrigins=https%3A%2F%2Fja.nex-software.com&random=7248249264890&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 872b3f1ffaeb3cddb7fd789f3d83975d76826fc53977f88d867be2895b9e2da1

Request headers

Host: hal900010.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=25b22a0b854d2233
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/

Response headers

Date: Tue, 17 Aug 2021 06:46:16 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Tue, 17 Aug 2021 07:46:16 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2311
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4B34 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8555c2efb865b560a600d4f51859d57aa7fb0c595a57ee6bcbcd964d1cfeae6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F3F0 42 B
64 B 42ms
29ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvute9DUgru_nbBWlw46KhqT3qEGRCBUMmGMp32Jfp5x3D_DTAG25nlakJ-Ch5wQEFMcWmNrC97nEsB0clAleB9tSOB2JvF2sSk4XYuuH665upYpE5QAyg_gwRoCA&sai=AMfl-YSfc9XUL-g_TzH5OPVY1j6sULDBpvWA-azgAlMVC72oCbUIc4OF2HPwgxV4CpWiuY2qkCyVEkvhcU57DKKej0N7Eq6LXVSCpERtRVWrjHPr8zoodWgCZtLxLlv8aR9f&sig=Cg0ArKJSzOhvhfKbxb6kEAE&cid=CAASFeRoaSuwSlSeIyY13E_WPG2eJwyBZQ&id=lidar2&mcvt=1000&p=750,1123,1004,1423&asp=750,1123,1004,1423&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210816&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=3709533993&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629182775520&dlt=8&rpt=139&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame 6863 89 KB
32 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 12:47:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 12:47:57 GMT

GET
H/1.1 200
OK 728x90_OMAC_2016_Launch%20(3).jpg
cdn.contentspread.net/24i/advertiser/14265/creativesup/ Frame 6863 41 KB
41 KB 249ms
81ms Image
image/jpeg 145.239.2.103
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/14265/creativesup/728x90_OMAC_2016_Launch%20(3).jpg
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 145.239.2.103 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3082036.ip-145-239-2.eu
Software: nginx /
Resource Hash: 7cbedaf4d01c2b49cf1eab36979755222f1525f7424ff2b03a98b83830301288

Request headers

Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:16 GMT
Last-Modified: Tue, 16 Feb 2016 11:45:27 GMT
Server: nginx
ETag: "56c30bd7-a476"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 42102

GET
H/1.1 200
OK viewability Show response
hal900010.redintelligence.net/ Frame 6863 0
150 B 160ms
54ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/viewability?s=45692800033150300044684011689010&a=f7e29da5&vb=m
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:16 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 6863 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4B34 42 B
64 B 29ms
29ms Fetch
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssT9gBw_eb_qc8KyU4aRao8xgBLcODvbyv16EuKHWAClfPg4-6-ZriKfBsAJ1hJjVmHHy28QJ4qdvTCKhoS2_YiMUg0BK3t0SlxLLZiE5NDgc07&sai=AMfl-YRyWUI2bA-1RIVDny4q9z75mSaTPwbhHsS3lShktP2Si3O8TvEQGqUdVQiGyoSXFSJ53r3d_jtM7X_FkmgE-ahu0PzsC-6nSsdtFZRO2PZOWOlzKdxMupiOKkUu4EuV&sig=Cg0ArKJSzAU9aHv0aapmEAE&cid=CAASFeRo7yZTU-6JC9ASIk3eKopv6GN-Rw&id=lidar2&mcvt=1000&p=1110,436,1200,1164&asp=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210816&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1465975555&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629182775717&dlt=19&rpt=828&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900010.redintelligence.net/ Frame 6863 0
150 B 162ms
55ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/viewability?s=45692800033150300044684011689010&a=f7e29da5&vb=v
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900010.redintelligence.net/request_content.php?s=45692800033150300044684011689010&a=7c6446fb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 17 Aug 2021 06:46:17 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%...
ade.googlesyndication.com/ddm/activity/ Frame 18BD 42 B
63 B 66ms
66ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%26cb%3Dout%26e%3D9%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D2005,0,0,0,0%26mtos%3D2005,2005,2005,2005,2005%26amtos%3D0,0,0,0,0%26mcvt%3D2005%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2173%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D43%26pst%3D1%26dur%3D20010%26vmtime%3D2194%26dtos%3D2005%26dtoss%3D1%26dvs%3D2005%26dfvs%3D2005%26dvpt%3D2173%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D7%26psv%3D6%26psfv%3D6%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,2005;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1629182775953;ecn1=1;etm1=0;eid1=200000;

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 18BD 42 B
64 B 30ms
29ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvBoVFi1YcYmqoPoDjyh61cql4hhy2BN28hpWpHSyIEfl51dXx8M-Mi5MQ8QHMx3uGih_Jy8jQ8htBB9TstEY59TgZnIgkuyr0Z7pjJJK3yArDNPKcLbUfdTVYK4g&sai=AMfl-YSSn4caBkonC9uJ4VlW5zCZ4VeCnzTWKuDOomg-r_RT7_UbPQoRArTpSozH1uC-iMH9TPb0HqH43saBWVk65_WRIQcbfr_QKm8oJN4HVyZtWENDs6QAFaAO7uc4ufWN&sig=Cg0ArKJSzPQAXyFemT2JEAE&cid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw&id=lidarv&acvw=sv%3D20210811%26cb%3Dout%26e%3D9%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D2005,0,0,0,0%26mtos%3D2005,2005,2005,2005,2005%26amtos%3D0,0,0,0,0%26mcvt%3D2005%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2173%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D43%26pst%3D1%26dur%3D20010%26vmtime%3D2194%26dtos%3D2005%26dtoss%3D1%26dvs%3D2005%26dfvs%3D2005%26dvpt%3D2173%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D7%26psv%3D6%26psfv%3D6%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,2005&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1629182775953

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D5000,0,0,0,0%26mtos%3D5000,5000,5000,5000,5000%26amtos%3D0,0,0,0,0%26mcvt%3D5000%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5168%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D45%26pst%3D1%26dur%3D20010%26vmtime%3D5190%26dtos%3D2995%26dtoss%3D2%26dvs%3D2995%26dfvs%3D2995%26dvpt%3D2995%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D5000,5000,5000,5000,5000%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D63%26psv%3D62%26psfv%3D62%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,5000;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1629182775953;ecn1=1;etm1=0;eid1=960584;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 18BD 42 B
223 B 17ms
17ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CWoXBN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAcgDmwSqBN4BT9CG5q2IiWqR9RKp5iKX_qQKAM1Sr7pibBps3-IDHw11ypo2QB5IJMC6mxKzg1K0uhixFVxl91yaeQ_BP_mghHaegtMhTbfzNWDoTXaXnCZspBb5e9DbndFz3NbMkY2NXo8Dz7FH7BXJh4ziJTWyCjxgZPfAk7TIZMgtwOpa90IUuV-y7u1PZYgIydDD3p6Jp_TkS-38rTAAJhhI9o7mVOiLrRcyI_EDovqv4HUJGepoSPNJlbt3wuBEznM0CBwYGaCO395Rm99a1_Ji4bPXe83HDPav3W4fIGaDIoYBwATZ1-Cf2APgBAOQBgGgBk6AB5qq2jWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE7nslwzIE-6h4t0D0BMA2BMKiBQD2BQB0BUBgBcB&sigh=t4l7w-X-kD8&label=videoplaytime25&ad_mt=5191&acvw=sv%3D20210811%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D5000,0,0,0,0%26mtos%3D5000,5000,5000,5000,5000%26amtos%3D0,0,0,0,0%26mcvt%3D5000%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5168%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D45%26pst%3D1%26dur%3D20010%26vmtime%3D5190%26dtos%3D2995%26dtoss%3D2%26dvs%3D2995%26dfvs%3D2995%26dvpt%3D2995%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D5000,5000,5000,5000,5000%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D63%26psv%3D62%26psfv%3D62%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,5000&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1629182775953

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:21 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIoPb15Lq38gIVk97eCh0E6gOQEAAYACCOtqpCOhkIgpXlNBDZ1-Cf2AMY7qHi3QMgwom_w80NQhMI55HV5Lq38gIV34r9Bx3saAUv;dc_rmcid=CAASFeRo40qXA73NXDVvg6buxRWQzB2-Fw;eps=CIjhgBAQARgd;met=1;acvw=sv%3D20210811%26cb%3Dout%26e%3D2%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D9997,0,0,0,0%26mtos%3D9997,9997,9997,9997,9997%26amtos%3D0,0,0,0,0%26mcvt%3D9997%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D10165%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D49%26pst%3D1%26dur%3D20010%26vmtime%3D10190%26dtos%3D4997%26dtoss%3D3%26dvs%3D4997%26dfvs%3D4997%26dvpt%3D4997%26is%3D275%26i0%3D18%26i1%3D275%26i2%3D275%26ic%3D512%26cs%3D16778003%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D4997,4997,4997,4997,4997%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D2047%26psv%3D2046%26psfv%3D2046%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,9997;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1629182775953;ecn1=1;etm1=0;eid1=18;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 18BD 42 B
64 B 19ms
18ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CWoXBN1sbYaeaBd-V9u8P7NGV-ALPm5SCZMKJv8PNDfAuEAEgqoDDImDxrfyFpB-gAc7VpcoDyAEFqQKr78O1W_5-PqgDAcgDmwSqBN4BT9CG5q2IiWqR9RKp5iKX_qQKAM1Sr7pibBps3-IDHw11ypo2QB5IJMC6mxKzg1K0uhixFVxl91yaeQ_BP_mghHaegtMhTbfzNWDoTXaXnCZspBb5e9DbndFz3NbMkY2NXo8Dz7FH7BXJh4ziJTWyCjxgZPfAk7TIZMgtwOpa90IUuV-y7u1PZYgIydDD3p6Jp_TkS-38rTAAJhhI9o7mVOiLrRcyI_EDovqv4HUJGepoSPNJlbt3wuBEznM0CBwYGaCO395Rm99a1_Ji4bPXe83HDPav3W4fIGaDIoYBwATZ1-Cf2APgBAOQBgGgBk6AB5qq2jWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BuoB6qbsQLYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE7nslwzIE-6h4t0D0BMA2BMKiBQD2BQB0BUBgBcB&sigh=t4l7w-X-kD8&label=videoplaytime50&ad_mt=10191&acvw=sv%3D20210811%26cb%3Dout%26e%3D2%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D9997,0,0,0,0%26mtos%3D9997,9997,9997,9997,9997%26amtos%3D0,0,0,0,0%26mcvt%3D9997%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D10165%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D49%26pst%3D1%26dur%3D20010%26vmtime%3D10190%26dtos%3D4997%26dtoss%3D3%26dvs%3D4997%26dfvs%3D4997%26dvpt%3D4997%26is%3D275%26i0%3D18%26i1%3D275%26i2%3D275%26ic%3D512%26cs%3D16778003%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D4997,4997,4997,4997,4997%26qnc%3D1%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D556362485%26psm%3D2047%26psv%3D2046%26psfv%3D2046%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,9997&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1629182775953

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Aug 2021 06:46:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://load5.biz/?pu=mztdqolemm5ha3ddf4ztooju(Line 174) Message: Error: Browser is not suitable for subscriptions
console-api	info	URL: https://cst.wpu.sh/static/adManager.js(Line 1) Message: %c [AdManager] - color:cyan version 2.1.8
console-api	info	URL: https://cst.wpu.sh/static/adManager.js(Line 1) Message: %c [AdManager] - color:cyan run tag spots
console-api	info	URL: https://cst.wpu.sh/static/adManager.js(Line 1) Message: %c [AdManager] - color:cyan init spot [object Object]
console-api	log	URL: https://cdn.zx-adnet.com/adx/brmsl_19102402.js(Line 2) Message: zxnt->domain abuse ->no ads
console-api	warning	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js(Line 6) Message: [GPT] Ignoring the PubAdsService.enableSingleRequest() call since the service is already enabled.
console-api	warning	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js(Line 6) Message: [GPT] Ignoring the PubAdsService.enableSingleRequest() call since the service is already enabled.
console-api	warning	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js(Line 6) Message: [GPT] Ignoring the PubAdsService.enableSingleRequest() call since the service is already enabled.
console-api	warning	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js(Line 6) Message: [GPT] Ignoring the PubAdsService.enableSingleRequest() call since the service is already enabled.
console-api	warning	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081201.js(Line 6) Message: [GPT] Ignoring the PubAdsService.enableSingleRequest() call since the service is already enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ade.googlesyndication.com
adservice.google.com
adservice.google.se
ajax.googleapis.com
bid.g.doubleclick.net
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
caf0e5b1dc7497ecb6802e8982ce97b9.safeframe.googlesyndication.com
cdn.contentspread.net
cdn.jsdelivr.net
cdn.zx-adnet.com
cm.g.doubleclick.net
counter.yadro.ru
csi.gstatic.com
cst.cstwpush.com
cst.wpu.sh
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
gcdn.2mdn.net
get.optad360.io
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hal9000.redintelligence.net
hal900010.redintelligence.net
ib.adnxs.com
imasdk.googleapis.com
ja.nex-software.com
js.wpushsdk.com
l.sharethis.com
load5.biz
na.nawpush.com
nex-software.com
pagead2.googlesyndication.com
pic.nex-software.com
platform-api.sharethis.com
r3---sn-4g5e6nss.c.2mdn.net
s0.2mdn.net
securepubads.g.doubleclick.net
stat.optad360.mgr.consensu.org
sync.teads.tv
tpc.googlesyndication.com
us-u.openx.net
vasgenerete.site
www.cookieconsent.com
www.google.com
www.googletagservices.com
104.111.242.245
138.201.63.145
142.250.184.194
142.250.186.66
142.250.74.194
142.251.5.155
145.239.2.103
151.101.65.195
178.63.52.121
18.196.233.38
185.177.94.108
185.33.220.240
2.18.234.21
2001:4860:4802:32::3
205.185.216.42
213.174.135.24
213.174.135.25
2600:9000:20eb:3400:c:a9b7:ddc0:93a1
2600:9000:2190:b400:c:abe:f440:93a1
2600:9000:21f3:b200:11:a4de:2580:93a1
2606:4700:3034::ac43:cc49
2606:4700:3035::ac43:89ba
2a00:1450:4001:5e::8
2a00:1450:4001:809::2002
2a00:1450:4001:80e::200a
2a00:1450:4001:811::2001
2a00:1450:4001:812::200a
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2006
2a00:1450:4001:82f::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:830::200a
2a00:1450:4001:830::200e
2a00:1450:4001:831::2001
2a00:1450:4001:831::2004
2a00:1450:400f:80a::2002
2a04:4e42:3::485
3.124.181.115
34.98.64.218
46.4.91.20
65.9.73.65
88.212.201.198
00a13aaedbe3f03428cb62a646dfd5b157923df36e1508f1e6cc017452537408
01e51940762b45561e5a0c1ea5e5ad122f4c732178d0cb428f8f4409030efb13
0239bfd43728e85cc93174d290d229af26b978e2a325070598bbcee72d075b90
03032b7414541a98aaa00a220920ce2980d55afcb45c4328c156737f9fb995e0
06e7f2917b7c8a36d7c170a4b80213b9d6f1a4bf266494aa083c5207ca286259
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
1121d7f8fb131bce05cbaf9b75a1272f9fbed57a53cd239d2fe91ece63ed9424
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13c3073a15f1fd4ea1dd512f48a88fec6b979cf2812e87a269c310b64ac2f4b3
145e535a116897a926b998fab94438d6902bbd6309aede144d4f4980e35832e3
190402f488a1616b47304ae066078580059ca6a5958b7f217d2156d0a73931a9
1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306
1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954
257579348172eb9f739308373580772054c0b671f63e8f002aed9f9774a6272e
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e46488663e925c9ad557a7f0c427e47f331a48e050b07274871ad9a3856395b
2e874225f7f8c8d6f2c8f3c6db0a2e4ed30410548114496260d3ab45b9381c3b
2fa06661a3d8360c53e9efab58c7ca0396a589b2d7ddfc56570f3d34924c26a1
3085321cac4d11009cd0a8f0db8241e1b012dda3a6817547e14b96f4cf2921fe
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
35dfcb01734a60a61747c210a2f762b5a6421576bcdb65ebc912fd5d520c422e
398b4849b670aa5659a8fe1d8a925591d3c581176db6313a9ef7208d77310ede
3e43d592d0aa592f24ad510ef3f453a51bba24a9534a07a55a9685b4d4b3f2cb
3fd76622a2a4239c03b2ee1e968ea25c04510ff17d8d77398c25ad4cd9b721a0
43677abbcc50b9f3d621c9134d28237cfa6d66c61bf970cdfcf2a3ec31928ed2
461a8b47cc2f47a256f3b98f71de2706d1d2673701ad17b61f0cc3e211e1c2aa
48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7
4ab7918478793ceb022d3f5449e401b44b78d87bc4429058ebb8b64163640da2
4aedadeea0464ebdc596a23facf171d24c974aa1d89ca897bc23831ccb6dd132
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bb6f53895da3cfe7ef0e813289039054d08b77515b3ededd0e2d110dcd04896
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f9bc21de359659367b891227e48303c7daff14cefb2a1e677a8c8e6f22340e0
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
505370e336a18b80e7de8a982d319c2cb7e76fa17103cd48514e32514d7c4b9d
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
54a7df35a8c8e4c046fb79e095b6ea595e76c67e07997dd5b864d0bbe00cf192
563ba273cbb08c3b4e9df2feb9e822a7cae0bbd5c6ec388708482d7a13057234
56b14b6ad7538ba37b7398ef0cfc7bcbf42fd723a943e72ab746a42dc15fb91f
5ae0dd79ac2d1f4c513cba15e222cf52b4e7cd5f7ddc83a89e39d6a675536605
5eb75ebbe618db4339b39a1bd18bfc9213183fdc5f4fa1ef98bdf7d6010907c2
5f326d425eb729c44346ed04c6d645df7674684679d2a835ab07e538c7f8a2e0
616b28e4f5d4ac64577d0c9362eb1b7e68e88f13779d994d895ff3d6fa7a06c5
61fe4436f1d882b3acd98fb2763984bacd382664582f4918647b89894f46b871
63ed4c66bf3ba06512f7028be62a4bd53295e1ba68a919a7591f5fd392e72b90
6b0a41340d5c21cc6093bd231c6ae6b60c719ecaa4216b8f518abd585a84ac1b
6c09ce42dbd9d0a0627fa60474846b47bd87699fd76ae6bedf0313b628af5ab6
703ab88d0482fd397d46d9595b4ccd156b82cc60a3eebbb7bfbdc24a3a24f812
744b144a1c71e20f0abbd0169cda5a929525b8a6446895322efeb987f82b9bd9
746589ecfb4406519933a6aea5f1149224afcba81e3c3ef0541e7ad6c8111b7e
7731d577c5dfa5f38e9bf82dedae51174c9ddd4d3d4668eea9d1e51d6ce13d66
79ce62849b956c8d7b315fd18445b733c20dc5dfc2f9614004681bb476151817
7cbedaf4d01c2b49cf1eab36979755222f1525f7424ff2b03a98b83830301288
80f5cd7e58eac60ed06a804d88dd0b32c0d973cd44bd30535602009af770dbc8
81ad7185e5948313fcdb09d75a9a5308ea5955ac81adaa6bf6cf0fc963eb5df9
81ed7e5d0fec417e9a01b2fd5fd99591b7571f074492e133dd087355a2722c17
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8671001593b9b6be023648a644f0d679c3b04b532f66f1d8924973e454d61ef4
872b3f1ffaeb3cddb7fd789f3d83975d76826fc53977f88d867be2895b9e2da1
8b2d63b492d59d6852d7539d2a6d9e01a250c09deaff56a056cc03a88bae7650
8bc62c9ef81390af989b3829ace60aae916e299dab9df7ec5e49db2d07a956b6
8dc446970b78c504c520fa08da9cc8fc76f40de8dcd3c0bd5e845db5687c7872
900e0d4503dfe926c2d74a1944f4e383d9d7573ecfcccba2dbb377f3be116a10
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
975a10ed42941c10306d1962a1110b784988d68db600f4a5772866efd2e8c8fa
9be45d830a633e050edaa82361e4ecac3cc189b3a3975a41aa01ae3cb4e4120b
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a689d270302f566a62de3a558b0bbd5c4b345025ec97b1a27f84b7ff16d967b8
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ad27b83e8542e635f68e415ed1e8180bc0c332af48be92bb375bdab187d5c601
af371cb0526d291c2821ffb5a63fb1c3969c3ebb22781c08032226c75ea2ab40
b0a91d53d6be7643e4f45a784cd8d3cffa6b23542b76a36e9546ec4a80be886d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
c0b92a29f043cd4af8c7a5bf6f8782dadbd9d53f75da60df99407e466f18946a
c3c48ad290a46eda56ea9897bf96038e1d5e209ace2877eeaaf782ee3bb03cda
c8f43ca59b5c9d938363eb5c52a57ea760922788ce212e5f4d037bcd048c42ff
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
d2fa83bbc70c843df2edd43096821128aa1f4bd404237f614c49cd48e7d5cfa3
d58f45d43c64a9e74e1c5dbcfd0e1a4f9470b3e0370acefc41cfc0413dbdf09b
d66e8fa87723046272ec70096a2089355c29474796663f65f2fdf9a27a1d4bc6
d734d7cac9ee378c70d4ce345bdffe188d2b8fa5d90f117047afd863b97d1e7b
d7ea26b93c08451c3b36edf3aeed10447fcff13d7cd7fab7a8b9284d6af53185
db80a17f39d8cd2ad5f8f17548eb20bfd67f6f987f611690dd71759850407302
dcbbbdae7b45de58a813dfb53f18f037e156c3359555e3922d1eeb9b6f4eb063
ddee3b7550624c244258abdcfc2824ce6327e652d31a01db50d35083290d5326
e090280320be0f1b08e3afdb1773a5856ac4622bb536012d9c0fc47909255096
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e503441024b68c5ac145c5580cd7b4c1dcd9dd71eb9814b5292ca1bc719af273
e8555c2efb865b560a600d4f51859d57aa7fb0c595a57ee6bcbcd964d1cfeae6
ede999c022b04dae8bed4c7898eb9c23794c70cbd07d4569dd72e43e195c66ed
ee513a593bfdf11b5ad487228634ca0278032204b4c885e835a721fd4529587c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f64872de90e08a3d7ea1d1ffff973fc88f983afd6d7d545d447fea5305c6fdc1
f7697cdbdb20e0d5d8fd4ef811c57418dcdcace4012fa556ca66c41f8d2be01c
f9165ad714c4df111cdcb043ff64633a24905fcf9069ad9c860a7bad72023e6c
fbf04c13bed8be2265361dbdf20b10726f755910f01af479fbb146a35434f58c
fc5414fc8c70a4f758c08d9a455ce95aedfeb3c1afb385a6d964edaeca52c550
fe1b12827d390be054afbe03c42584fffb7f606c42b35e10928a4f4e5411e1ba
febc5c128078aeb9daa4a4470a5a618f98fdb0c296480b83ea48840c5994ec25
ff0ae836e78e254c691d18c04b2068e14419275cb170cd7c09587f1795114fcc

ja.nex-software.com Open in urlscan Pro 2606:4700:3034::ac43:cc49 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

170 Requests

100 %HTTPS

51 %IPv6

28 Domains

47 Subdomains

42 IPs

7 Countries

5981 kBTransfer

8244 kBSize

0 Cookies

1 Outgoing links

Redirected requests

170 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

ja.nex-software.com Open in urlscan Pro
2606:4700:3034::ac43:cc49 Public Scan

Screenshot
Live screenshot

Full Image

170
Requests

100 %
HTTPS

51 %
IPv6

28
Domains

47
Subdomains

42
IPs

7
Countries

5981 kB
Transfer

8244 kB
Size

0
Cookies

170 HTTP transactions
5 data transactions