www.lebanonfiles.com Open in urlscan Pro
2606:4700:20::ac43:441e Unlisted Scan

URL: https://chat.whatsapp.com/H6TsL1NeLkQ5srUnYpLpLQ
Title: اشترك في خدمة الواتساب

URL: https://www.facebook.com/LebanonFiles/

URL: https://twitter.com/lebanonfile

URL: https://itunes.apple.com/us/app/lebanonfiles-2013/id681443972?mt=8
Title: Available on App Store

URL: https://play.google.com/store/apps/details?id=com.lebfiles.coddict
Title: Available on Google Play

URL: https://en.optad360.com/?utm_source=branding&utm_medium=display&utm_campaign=www.lebanonfiles.com

URL: https://web.whatsapp.com/send?phone=&text=%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A:%20%D9%82%D8%B5%D9%81%20%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A%20%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE%20%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1%20%D8%B9%D9%84%D9%89%20%D8%AF%D9%88%D9%86%D9%8A%D8%AA%D8%B3%D9%83%20:%20https%3A%2F%2Fwww.lebanonfiles.com%3Fp%3D1221956

URL: https://vidverto.io/?utm_source=vidverto.io_branding&&utm_medium=www.lebanonfiles.com

URL: https://widgets.mgid.com/?utm_source=www.lebanonfiles.com&utm_medium=referral&utm_campaign=widgets&utm_content=1189476

URL: https://www.mgid.com/services/privacy-policy

URL: https://clck.mgid.com/ghits/d/10961461/i/57522646/pp/1/1?h=DM1eBwNo70iJgBMsNhUoUkJIWkHDBujtyQp18bxMPD_mNivCouaJpuy1ePCKH1G4Nc6htAZ8fb8rwUUBoWNlaA**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&u=9YxAkCXJ8nznJSvjVHNYDUxUu46FGZe-t-gFIHTunC-53NUyaKMXArXnbCuOLDZe3cDYUbjcSQHpMm79CGHljFhqJkh0iameQO_b_QasVWIDBhNug8rdD9AffYI-c7gwQU3IqtsifaygeETmqhEDGNRVOGOdzwji1A1TQjwslwGt0A8Mp-b9JBbDYix7a7QPzf8Dr-_xx51W6dZzQDDCBJBFvxFgopg3-GSzcoInBusevJwrLci1inh7p4JobKv3w9RwL2w6QiJric3eGQRg4WwLsqjXbXQgAYdh_1s0V7DlxFeTf43hJJMM7_il6e46&tt=Direct&att=3&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/d/10961461/i/57522646/pp/2/1?h=DM1eBwNo70iJgBMsNhUoUkN6cVum27tKxYRrkKtOp-a3RVaPvv_x8QcS7RDqWVwPzRc8akByHTi0RzlUYSmCQg**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&u=9YxAkCXJ8nznJSvjVHNYDZF_Q4ZU0jwhWOoW-qwciIwfP91PpqvqU3pNP0mN2QD0nzzOOuFFukDJN9VgbDyrjFhqJkh0iameQO_b_QasVWIDBhNug8rdD9AffYI-c7gwQU3IqtsifaygeETmqhEDGIaab0b6Uvd3arv_llgP3KGt0A8Mp-b9JBbDYix7a7QPzf8Dr-_xx51W6dZzQDDCBJBFvxFgopg3-GSzcoInBusevJwrLci1inh7p4JobKv3uKZGpmlf8GI8axzkqxM9Uj8rjzElZGbJn2H08AmMZow6LSg2gAEijfdfnUEllsIk&tt=Direct&att=3&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/14242859/i/57522646/0/pp/3/1?h=DM1eBwNo70iJgBMsNhUoUl_6BjAX3vodN9NIrmz4rAg6PTwgoYwDZGrS6lYRZB3ZxPh0s7VLVTuCieuwgY1tjA**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/14242857/i/57522646/0/pp/4/1?h=DM1eBwNo70iJgBMsNhUoUrd7rxPTto-ibdodWVAcRAIfDvej-gEYFNSpn42tJNhKuVKYeDFtVB61EWMmC76qng**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/14647894/i/57522646/0/pp/5/1?h=DM1eBwNo70iJgBMsNhUoUmbg0SfeHKKmatDhAnm1or43Ow0zY9krUKylCjhSMCzKJh9Dno8188_n0A4wtw3ovw**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/14562890/i/57522646/0/pp/6/1?h=DM1eBwNo70iJgBMsNhUoUuZgCM2ttP_ULketxAgxR4RgnpMp_9FO3_peRyGLbnNJ2Fzzl9wf9isJVRT5CC2uUQ**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/12658887/i/57522646/0/pp/7/1?h=DM1eBwNo70iJgBMsNhUoUoiJtaiwUxnbivKV49vAk0ceN-HVaZWvf6L74BD8SbTzSfLSqtSG6IDI4q0LJ5LFpw**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/14242860/i/57522646/0/pp/8/1?h=DM1eBwNo70iJgBMsNhUoUtePtM8GwYvODYrB-FR8yRLopLBWUiQiJCdvl1RUpLsdVHYx75CYDa9ZQJeHZFe0Uw**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://clck.mgid.com/ghits/14701459/i/57522646/0/pp/9/1?h=DM1eBwNo70iJgBMsNhUoUkhICtn3W11rbzOQV5Qpl4Fk_uCTBV8_WZySinpJy8WWfmzysxr4SkH8_f17DWHiig**&rid=9c15a788-6fcc-11ed-8be1-e43d1a2a96ec&tt=Direct&att=3&cpm=1&gbpp=1&abd=1&iv=11&ct=1&gdprApplies=1&st=60&mp4=1

URL: https://www.trianglemena.com/
Title: | by

112.128.160.34.bc.googleusercontent.com

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 97

https://csync.loopme.me/?redirect=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D54%26partnerUserId%3D%7Bdevice_id%7D HTTP 307
https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131

Request Chain 100

https://ad.turn.com/r/cs?pid=65 HTTP 302
https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7264211468766995553

Request Chain 101

https://sync.srv.stackadapt.com/sync?nid=161 HTTP 302
https://cs.lkqd.net/cs?partnerId=93&partnerUserId=ipt5K85ZROx8MSoxVcoLxbnVm6Y

Request Chain 109

https://x.bidswitch.net/sync?ssp=vidoomy&user_id=709324198.69833361370811764.98181236 HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=vidoomy&user_id=709324198.69833361370811764.98181236 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=vidoomy&ssp_user_id=cee4ed4f-9f95-473b-a9d7-9b81db31a389&gdpr=&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=74&&user_id=171315692&expires=5 HTTP 302
https://ih.adscale.de/adscale-ih/sium?tpid=57&tpuid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&gdpr=&gdpr_consent=

Request Chain 110

https://ups.analytics.yahoo.com/ups/58610/occ HTTP 302
https://ups.analytics.yahoo.com/ups/58610/occ?verify=true HTTP 302
https://a.vidoomy.com/api/rtbserver/cookie?i=YAH&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A

Request Chain 116

https://csync.loopme.me/?redirect=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D54%26partnerUserId%3D%7Bdevice_id%7D HTTP 307
https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131

Request Chain 119

https://ad.turn.com/r/cs?pid=65 HTTP 302
https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7480102775904068705

Request Chain 120

https://sync.srv.stackadapt.com/sync?nid=161 HTTP 302
https://cs.lkqd.net/cs?partnerId=93&partnerUserId=qV2zhX0vR-dvM30ptMSHH7nVm6Y

Request Chain 228

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 277

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 278

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 279

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Request Chain 280

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Request Chain 281

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 282

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 283

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Request Chain 284

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Request Chain 285

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 286

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 287

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Request Chain 288

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Request Chain 289

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 290

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

Request Chain 291

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Request Chain 292

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Request Chain 296

https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0 HTTP 302
https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1

Request Chain 308

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=0PrQ8nwrRWo5MXdYVktXNlhUL1BwU2gxOEp0ZlZXKzZHTk1EdVJzbzhJaERPUEdvWTFQZ0dmNDRXaXkwUWpvU0t2bWNnRWV2RmxoWExCYXg1SDRVNEZkYTlrNTd0R3E4dUxDbFc4RWc0ZFlmU1RSQ3k4TVU3OEEwemVzdHNDWmlNazV6YVNpN2kvVHE4T21KWE5rODJGcGpEaHpncW5XZnF6bytOZ083SFZyOXZkSXhmYUQ3b2o0SXBsWDIzM29EZjhZamhLR25HVjE4MXM0ckRybkNmTEtjcUo3MXh2c0ZCc0dPWkV1Zzg2QXI0R2pLVURPS0FOdlBvYVUzYXFtbUI5K0s2fA&cppv=2

Request Chain 314

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=aw50M3wzL015b0VMR3JnU3BLZFZLekZPWXY2ZW5Eb2hsaWRRdmpZdUErSlRmb3VROWYxTWhBWXNvRjlpdVFXdkRRQjRVKzl1SmRpQTNFSzdvQ0hnTE8ySGtySmZkYVlJUUh6cURTRU9UbVY4c2l6eklmb09oUUErdi9oUStValZjWkJnMmc1ZUEyMXhtOG02MW5Sd2xndkhieEtYMkJuRWMwOVhtQUJJNFZRSmRwc09qL3ZFYytzRTVSYmxGYkpMTTZwaXo5YUtUdC9ldXVmb1duek5JTnhyZ0dpWkpJQWhhdWdXYWFGOG91eHpmS1EycjdlcDNvQ1lHRzdTNVJhVGZKY2tCfA&cppv=2

Request Chain 316

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 358

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=73293100054213004444644012158004&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=73293100054213004444644012158004&actionid=981741&produktid=&dt_url=

Request Chain 363

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=73293100054213004444644012158004 HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 383

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEKflh4hg4jIr7gsDrO7C0vE&google_cver=1&google_push=ASkJ3FbC-vsSHmzrkUFdpymBIw0mV_MrqVh7cG14KReITEogaecE43LA_BnI1mkX5Tpo2lMz_2hex5Qv6cSqYjp7p6_qyfMrX0iiIQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbC-vsSHmzrkUFdpymBIw0mV_MrqVh7cG14KReITEogaecE43LA_BnI1mkX5Tpo2lMz_2hex5Qv6cSqYjp7p6_qyfMrX0iiIQ

Request Chain 384

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENYTOts17ZU9oWN_00MRXYI&google_cver=1&google_push=ASkJ3FZePKF3zfx8jTo8dfaljTkRGJ3SaFyYdBhbGCZbspz0KQ9KijEc1qexvZLgtUbvfhcDwzrQev7Yrgk6tez1oYPA7okoi0Op9g HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENYTOts17ZU9oWN_00MRXYI&google_cver=1&google_push=ASkJ3FZePKF3zfx8jTo8dfaljTkRGJ3SaFyYdBhbGCZbspz0KQ9KijEc1qexvZLgtUbvfhcDwzrQev7Yrgk6tez1oYPA7okoi0Op9g&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rSA1byXUQXGOLkMhYTvTnQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FZePKF3zfx8jTo8dfaljTkRGJ3SaFyYdBhbGCZbspz0KQ9KijEc1qexvZLgtUbvfhcDwzrQev7Yrgk6tez1oYPA7okoi0Op9g

Request Chain 385

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEMuW0CkqNRRIFEW4TWi6K7Y&google_cver=1&google_push=ASkJ3FacOBASeANpZz_Wdb0WJAC5SWyjrmN4VVEw7XcDTYS3SMPKGASTn0UW-H5YrDh9_JqePqPYwuSZ9mgzl-Dra887PlTiZXx8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FacOBASeANpZz_Wdb0WJAC5SWyjrmN4VVEw7XcDTYS3SMPKGASTn0UW-H5YrDh9_JqePqPYwuSZ9mgzl-Dra887PlTiZXx8

Request Chain 386

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEBQSH6UV5H-jlxYFgF52_4M&google_cver=1&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2W HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2W&google_gid=CAESEBQSH6UV5H-jlxYFgF52_4M HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMyMjI1NTIwOTQ2OTUzNjYyMjE0OA%3D%3D&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2W

Request Chain 388

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESENeTj9SFZih8eFnN1HKbotY&google_cver=1&google_push=ASkJ3FYESskVFTKMjbsVBMKXaLVlrTRBs6bKWjqbpam34qIPUcxfv13iKAJjrBm0QZzITGZf9G0Ybw-o--qFih8opAxZBqDLefbZRxk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1hMjhyUmFoRTJ1SEJWaVV2S0ptb0JmQWpUSDZ4b3A1ZX5B&google_push=ASkJ3FYESskVFTKMjbsVBMKXaLVlrTRBs6bKWjqbpam34qIPUcxfv13iKAJjrBm0QZzITGZf9G0Ybw-o--qFih8opAxZBqDLefbZRxk

Request Chain 389

https://sync.inmobi.com/gob?google_gid=CAESEF4W4nUYvGVEh4fGOsgxxyI&google_cver=1&google_push=ASkJ3FZ5wF6_qjmGQnuIXQcCHIKfTzwtU9Ff-uE78C2tKHv2WqjZEhUv5boJf7maIoOwY9ajyDLe3qT-5o8SrqDAxAhlQHIlEpgy8ZE HTTP 302
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DASkJ3FZ5wF6_qjmGQnuIXQcCHIKfTzwtU9Ff-uE78C2tKHv2WqjZEhUv5boJf7maIoOwY9ajyDLe3qT-5o8SrqDAxAhlQHIlEpgy8ZE

Request Chain 391

https://fw.adsafeprotected.com/rfw/st/1269461/67381783/skeleton.js?adsafe_url=https%3A%2F%2Fwww.lebanonfiles.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.lebanonfiles.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:841e14c7-6476-964f-cc4a-adf43ca24c4a,c:vlHBbQ,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5dc864c74-txdsf,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:563,mot:0,app:0,maw:0,fm:tozkdOt+11%7C12%7C131%7C132%7C141%7C142%7C15%7C16%7C17%7C18%7C191%7C192%7C1a%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1e*.1269461-67381783%7C1e1%7C1e2%7C1e3%7C1f1%7C1f2%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1h1%7C1h2%7C1h3%7C1i%7C1j%7C1k1%7C1k2%7C1l%7C1m%7C1n,idMap:1e*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:na,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:590,oid:9c8c5fc3-6fcc-11ed-b6bf-2a0d554c6f12,v:19.8.366,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/skeleton.js

Request Chain 396

https://gum.criteo.com/sid/json?origin=publishertag&domain=lebanonfiles.com&sn=ChromeSyncframe&so=0&topUrl=www.lebanonfiles.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=0D8U_3xvbXo4a1VXRytXWG4vQXZ4emRGSUJZOXZ5SGFyQzRzV3dFMW1DejhMdmJJL1R6UVRTZEg3bEVWUXRNeFhIY1lZZExEMDhrWE4yaHowa1VINEtvNVVrekZ4V0dZN2dXaVhhMnhiK1lTbllIL0JQSzd5NHhINVMwVWNOUTY0aFRGMUpmRnhSOGlhVGp0aWc5d0VudG5vUEJodWd2dkxKajdWM0FIeWFqektHSzhKWnJyR3Z3c2xRVmZpT01KY3JFaWdBVExDM2NkTWI1QWh2RWQwVldnY3FjckpWUHZaNVJwSnVHMEtoakozeTQ3c3RLbXoxZHI0ZUNoWWFtdFNSR25xK0V5b28vSjZCUXBudW1EOGZPblUwK3EwUmtMc3l1aHBRNmoveTFkVCt3WT18&cppv=2

Request Chain 484

https://pbjs.e-planning.net/pbjs/1/58d04/1/www.lebanonfiles.com/ROS?rnd=0.23348629279783029&e=21105888%3A300x600&ur=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&pbv=6.6.0&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F HTTP 302
https://pbjs.e-planning.net/hb/1/58d04/1/www.lebanonfiles.com/ROS?ct=1&r=pbjs&rnd=0.23348629279783029&e=21105888%3A300x600&ur=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&pbv=6.6.0&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F

Request Chain 508

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&pbt=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=BAGfmnxUOVVZQjZuTUFoaHhCclRlQWd2ZmdEUUc0by92SnI2Zjg0K0FDbW10ZnNlWFMrWitubXFPYlpyNHRZZko2REd2RnZxeDlONlVvV0dndEltNGFYZ3V6U2RubERvUFJGZ2M2SGlFTFh6eGNsMDJnQnJOZmoza2lkWVJvNEZ5ZExSYUZXcFlYUGJzMFo4MUpuUXdVVjVxRllMUTA0R1ZKWWNJcGxJMmJXbVlCVFdmNDZJWWpDVUc1dVZGOVhSMlN5cFAxTlRsOURZZlBMdVZvUGIwWXNCOW9oSnlYQjZQQVk0SElmQ08vZDd6R0s2cHordWR1QW94cG9PZ0FHMUU2UGRlWWdKL2FodUZaeXhaZ3g4NU82VlBhd0lPbzlEQ2ZURUg5M3NRaTh4NjE1ND18&cppv=2

Request Chain 513

https://csync.loopme.me/?pubid=11378&gdpr=${&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bviewer_token%7D}&gdpr_consent=${&redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bviewer_token%7D}&redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bviewer_token%7D HTTP 307
https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=ef3ad599-7afb-456a-acd1-dd01053ed131&gdpr_consent=${&gdpr=${

Request Chain 517

https://x.bidswitch.net/sync?ssp=vidoomy HTTP 302
https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=cee4ed4f-9f95-473b-a9d7-9b81db31a389

Request Chain 518

https://ups.analytics.yahoo.com/ups/58531/occ?gdpr=0&gdpr_consent=undefined HTTP 302
https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A&gdpr=0&gdpr_consent=

Request Chain 522

https://ib.adnxs.com/getuid?https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3Dundefined%26uid%3D%24UID HTTP 302
https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=undefined&uid=7999702989176737213

Request Chain 536

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3Dfcb616ccaf9c767b%26uid%3D%24UID HTTP 302
https://u-ams03.e-planning.net/um?dc=8103fa85295fbe60&fi=fcb616ccaf9c767b&uid=7999702989176737213

Request Chain 537

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3De64f73568d2b3c34%26fi%3Dfcb616ccaf9c767b%26uid%3D%24UID&partner=eplanning HTTP 302
https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzczNGMQ____________ASp1aHR0cHM6Ly91LWFtczAzLmUtcGxhbm5pbmcubmV0L3VtP2RjPWU2NGY3MzU2OGQyYjNjMzQmZmk9ZmNiNjE2Y2NhZjljNzY3YiZ1aWQ9dWEtMzdlYzBjODMtYWFhZC0zOGQ5LThjNzMtOWQ0NzdjMTc3MzRjMgISBjgB

Request Chain 542

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=eplanning_eu&endpoint=eu HTTP 301
https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu

Request Chain 553

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dmedianet%26uid%3D%3Cvsid%3E HTTP 302
https://sync.quantumdex.io/setuid?bidder=medianet&uid=0000EEA

Request Chain 555

https://ssp.disqus.com/redirectuser/?partner=valueimpression&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dzeta-global%26uid%3DBUYERUID HTTP 302
https://ce.lijit.com/merge?pid=279534&3pid=ua-37ec0c83-aaad-38d9-8c73-9d477c17734c&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzczNGMQ____________ASpgaHR0cHM6Ly9zeW5jLnF1YW50dW1kZXguaW8vc2V0dWlkP2JpZGRlcj16ZXRhLWdsb2JhbCZ1aWQ9dWEtMzdlYzBjODMtYWFhZC0zOGQ5LThjNzMtOWQ0NzdjMTc3MzRjMgIMBjgB

Request Chain 556

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID HTTP 302
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=7999702989176737213

Request Chain 557

https://ups.analytics.yahoo.com/ups/58424/occ HTTP 302
https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A

Request Chain 561

https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D HTTP 302
https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D&crf=1 HTTP 302
https://sync.quantumdex.io/setuid?bidder=between&uid=cafdc05c-8c5a-524d-9211-2f1af194f737

Request Chain 564

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-valueimpression&endpoint=us-east HTTP 301
https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east

Request Chain 573

https://pixel.tapad.com/idsync/ex/push?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=11a965a9-be4e-43ef-9b0c-aaf66beecd44&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 579

https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361 HTTP 302
https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&s_h=1 HTTP 302
https://mwzeom.zeotap.com/mw?cid=067733f7-8960-4179-96ed-2b583cca373e&zpartnerid=317&gdpr=1&gdpr_consent=

Request Chain 580

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=000cce0c-25f4-479f-6dd5-4755453376aa&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=000cce0c-25f4-479f-6dd5-4755453376aa&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=39549946983054876980845119877463050484&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 583

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%25%25COOKIE%25%25%26env%3DmWeb%26zpartnerid%3D563%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=7171375673745340571&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 584

https://pixel.tapad.com/idsync/ex/receive?partner_id=2885&partner_device_id=000cce0c-25f4-479f-6dd5-4755453376aa HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=000cce0c-25f4-479f-6dd5-4755453376aa

Request Chain 585

https://idsync.frontend.weborama.fr/ids?key=zeotap&value=000cce0c-25f4-479f-6dd5-4755453376aa&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://idsync.frontend.weborama.fr/ids?key=zeotap&value=000cce0c-25f4-479f-6dd5-4755453376aa&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361&bounce=1&random=2218887437 HTTP 302
https://mwzeom.zeotap.com/mw?webouuid=cd7g/F2JM37ux3Pi/3kVOu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 588

https://cms.analytics.yahoo.com/cms?partner_id=ZTAP HTTP 302
https://ups.analytics.yahoo.com/ups/58697/cms?partner_id=ZTAP HTTP 302
https://mwzeom.zeotap.com/mw?cid=y-KUZKirxE2ooiFcol4Ez2yN9qN4tj_dkPMA--~A&zpartnerid=570&env=mWeb

Request Chain 589

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=DEU&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1361&cid=h6O4Jsk0KNFP0pxU4ngPit6f%2F0F29XFy%2BS41iYitP1U%3D

Request Chain 593

https://sync-tm.everesttech.net/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361&_test=Y4XYLgAAAQWkKgAF HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=Y4XYLgAAAQWkKgAF&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&_test=Y4XYLgAAAQWkKgAF

Request Chain 594

https://pixel.mathtag.com/sync/img?mt_exid=10092&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%5BMM_UUID%5D%26env%3DmWeb%26zpartnerid%3D979%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=a0c26385-d82c-4500-b987-c9e88ac67507&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 595

https://usermatch.krxd.net/um/v2?partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=768&cid=POkKfy8T&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=000cce0c-25f4-479f-6dd5-4755453376aa

Request Chain 596

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361 HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&dcc=t

Request Chain 598

https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/zeo?url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1395%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 599

https://pixel.rubiconproject.com/token?pid=41544&puid=000cce0c-25f4-479f-6dd5-4755453376aa&gdpr=1&gdpr_consent=&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=LB21SX9B-T-CTIZ&env=mWeb&zpartnerid=1770&gdpr=1

Request Chain 600

https://x.bidswitch.net/syncd?dsp_id=461&user_group=1&expires=5&user_id=000cce0c-25f4-479f-6dd5-4755453376aa&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BBSW_UID%7D%26env%3DmWeb%26zpartnerid%3D1771%26gdpr%3D1%26gdpr_consent%3D%7Bconsent_string%7D%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361 HTTP 302
https://mwzeom.zeotap.com/mw?cid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&env=mWeb&zpartnerid=1771&gdpr=1&gdpr_consent={consent_string}&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Request Chain 603

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGjVNouTngN0GQ4t18pTGBE&google_cver=1

Request Chain 604

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&dcc=t

Request Chain 607

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7999702989176737213

Request Chain 609

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1669802414

Request Chain 610

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=4e7ed0a4-1d90-6a08-34110529

Request Chain 614

https://creativecdn.com/cm-notify?pi=admatic HTTP 302
https://creativecdn.com/cm-notify?pi=admatic&tc=1

Request Chain 618

https://sync.console.adtarget.com.tr/csync?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D318342%26extuid%3D%7Buid%7D HTTP 302
https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=95ad902d4f7993ec

Request Chain 619

https://c1.adform.net/serving/cookie/match?party=14&cid=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent=

Request Chain 620

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0c26385-d82c-4500-b987-c9e88ac67507&gdpr=0&gdpr_consent=

Request Chain 621

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7481387539608134079

Request Chain 622

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

Request Chain 623

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=AD20356F-25D4-4171-8E2E-4321613BD39D&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=AD20356F-25D4-4171-8E2E-4321613BD39D&redir=true&gdpr=0&gdpr_consent=&dcc=t

Request Chain 624

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7999702989176737213&gdpr=0&gdpr_consent=

Request Chain 626

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rSA1byXUQXGOLkMhYTvTnQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 627

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a0c26385-d82c-4500-b987-c9e88ac67507

Request Chain 628

https://pixel.onaudience.com/?partner=214&mapped=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0

Request Chain 629

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUQyMDM1NkYtMjVENC00MTcxLThFMkUtNDMyMTYxM0JEMzlE&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 630

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIaZfK6zhE10pK2AR9ssIGE&google_cver=1

Request Chain 632

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5215114327849427938

Request Chain 635

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=a0c26385-d82c-4500-b987-c9e88ac67507

Request Chain 636

https://match.prod.bidr.io/cookie-sync/ie HTTP 303
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1 HTTP 303
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABBQE7HC7AAACB8T97bhA&expiration=1670925614

Request Chain 637

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://pr-bh.ybp.yahoo.com/sync/casale/Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB

Request Chain 638

https://csync.loopme.me/?redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent= HTTP 307
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ef3ad599-7afb-456a-acd1-dd01053ed131&us_privacy=null&gdpr_consent=null&gdpr=null

Request Chain 639

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y4XYKpVfU9au-VZsFZ28PwAA%265136?gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y4XYKpVfU9au-VZsFZ28PwAA%265136

Request Chain 640

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=Qu20XxDmvg9Z5-gLEeqhUxG67ghZvbtSFe4ZXcQL

Request Chain 641

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e HTTP 302
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd9302ba-e1e0-33b3-365d89b6

Request Chain 667

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=XPkKkSz1QzuJSDFcB6279Q&rk=usync-na HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XPkKkSz1QzuJSDFcB6279Q

Request Chain 668

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIyMVNYOUItVC1DVEla

Request Chain 670

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEClEyr1kc1Y-FrGoyXwdMo0&google_cver=1

Request Chain 671

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTZlOGEzMjEwNjNkOTQyZDY1MWRjYzVkZjRmMDljMzJlOGVlY2NmOA

Request Chain 672

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id= HTTP 302
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=M0kyiTDjRNugg2d4y7lLgA&rk=usync-other HTTP 302
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=M0kyiTDjRNugg2d4y7lLgA

Request Chain 673

https://token.rubiconproject.com/token?pid=36584 HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LB21SX9B-T-CTIZ

Request Chain 674

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/v4KRMZ3QFb_mwa3bqZGH7Q?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8071136893386460582

Request Chain 693

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEO32l2EatB6ehw_eKQ6pWYA&google_cver=1&google_push=ASkJ3FarktD9zXROS3fhMTURi3QRqTzE-E3Ufljpse5zTS2cJuWLwaruzbCQ_HWIDFz4NtICZMEY5nEl4lC-PRVLd7E9jpLOzCKciA HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FarktD9zXROS3fhMTURi3QRqTzE-E3Ufljpse5zTS2cJuWLwaruzbCQ_HWIDFz4NtICZMEY5nEl4lC-PRVLd7E9jpLOzCKciA&google_hm=18NBBXgh-BlKR2QnOtRDvA

Request Chain 707

https://ad.doubleclick.net/ddm/trackimp/N773418.3417549O2_AFFILIATE/B25220131.345081615;dc_trk_aid=536683351;dc_trk_cid=176936761;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=;ltd=?https%3A%2F%2Fwww.telefonica-partner.de%2Ftpv.php%3Ft%3D117703V1226132702M%26subid%3Dreach_SUBIDTEST_view HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N773418.3417549O2_AFFILIATE/B25220131.345081615;dc_pre=CKyw5O-Q0_sCFUfQuwgdD6wCiw;dc_trk_aid=536683351;dc_trk_cid=176936761;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=;ltd=?https%3A%2F%2Fwww.telefonica-partner.de%2Ftpv.php%3Ft%3D117703V1226132702M%26subid%3Dreach_SUBIDTEST_view HTTP 302
https://www.telefonica-partner.de/tpv.php?t=117703V1226132702M&subid=reach_SUBIDTEST_view HTTP 302
https://www.lead-alliance.net/tpv.php?t=117703V1226132702M&subid=reach_SUBIDTEST_view HTTP 302
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117703&s_id=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&gdpr_consent=&gdpr=0&cons=0&spid=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&wfid=117703&partnerid=12218

Request Chain 710

https://ad.doubleclick.net/ddm/trackimp/N773418.3163536BLAU_AFFILIATE/B25532621.345088000;dc_trk_aid=536454876;dc_trk_cid=177082088;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=;ltd=?https%3A%2F%2Fwww.telefonica-partner.de%2Ftpv.php%3Ft%3D113752V1225131106M%26subid%3DviewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth%26gdpr_consent=%26gdpr=0%26gdpr_pd=0 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N773418.3163536BLAU_AFFILIATE/B25532621.345088000;dc_pre=CJ6v5O-Q0_sCFVGK_QcdlnMJjw;dc_trk_aid=536454876;dc_trk_cid=177082088;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=0;gdpr_consent=;ltd=?https%3A%2F%2Fwww.telefonica-partner.de%2Ftpv.php%3Ft%3D113752V1225131106M%26subid%3DviewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth%26gdpr_consent=%26gdpr=0%26gdpr_pd=0 HTTP 302
https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=viewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=viewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022112911001578991501655X113752V1225131106MSviewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&cons=0

Request Chain 713

https://www.awin1.com/cshow.php?s=2470185&v=11354&q=377129&r=412871&pv=1&pref3=oneidD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtVoneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
https://www.conrad.de/ztpv.php?awc=11354_412871_1669716015_9f355f01-6fcc-11ed-9792-223985e9a9b7&insert=AW&&gdpr=0&gdpr_consent=

726 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%... 96 KB
19 KB 422ms
262ms Document
text/html 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81b6d695f5477c7e954477e2289434a87d88c064925be1f3934ce8b6098bd110

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 771a7e95dbf591e9-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:07 GMT
itw-article-cache: EXPIRED
link: <https://www.lebanonfiles.com/wp-json/>; rel="https://api.w.org/", <https://www.lebanonfiles.com/wp-json/wp/v2/posts/1221956>; rel="alternate"; type="application/json", <https://www.lebanonfiles.com/?p=1221956>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=27YSGlkelY6fQM1Xcs0%2B3r94UEeMpomS8YtmNJm66G4YL63DTPs5LXUcY5vWjjnauPlTdc1byUx57xCuJ5PNsdEiJaBR3cCWeScs6eU3pnaYKJ%2FHxrZ9EOXBqmo90cOeO1YbUEttGXLl6QYpCJoGk1b4"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-cf-powered-by: WP Rocket 3.4.4

GET
H2 200 styles.css
www.lebanonfiles.com/wp-content/plugins/contact-form-7/includes/css/ 2 KB
1 KB 54ms
53ms Stylesheet
text/css 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6.2
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb12708d973e6b9354f367a6780e5a166b0da7d2721d856da7f9d57130883eaa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6495273
cf-polished: origSize=2731
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 23 Jun 2022 19:48:45 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CVEjqMFHPQJ%2F4wxqOWap7UGBA1izB0NmQwlM5aktQTNyYaLXCL9e1mzUYf3IqzBRwfn5aj9PMc6PmREkOgwNxFtQ8vBSbAuALpxEVWqMQVFQfKqC6sQqNH%2B%2FPcts2Xz4nYNgbC3K%2BBPtUIgjnP3LE6zI"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 771a7e97880e91e9-FRA
expires: Fri, 15 Sep 2023 05:33:05 GMT

GET
H2 200 triangle-mena-news-coverage-public.css
www.lebanonfiles.com/wp-content/plugins/triangle-mena-news-coverage/public/css/ 0
382 B 37ms
36ms Stylesheet
text/css 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/plugins/triangle-mena-news-coverage/public/css/triangle-mena-news-coverage-public.css?ver=1.3.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6495476
cf-polished: origSize=98
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-bgj: minify
last-modified: Tue, 28 Jan 2020 12:11:23 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8vsv9lVToq5a%2FHcOoMaLz02nETEOEh2FklO7UESxtqd81boIpvw1kGJHLxIKw4MY1sVLnfwUEkzfmQ7i4YpETi8iWJ1Ey3%2FHluPYBzKlTohSY5iHbq6oZCABiwTbguJuUJpOxOt44II2IldRQu2rKbAR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97881391e9-FRA
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H2 200 plyr.min.css
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/plyrJs/ 37 KB
6 KB 48ms
47ms Stylesheet
text/css 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/plyrJs/plyr.min.css?ver=9.0.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c3718a6ae4f2eb59d54458122825583392158ad8664f85806610271ad31f392

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 23 Jul 2021 08:55:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2936124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GeO%2BCNstg%2BibPhvLps90vm5nzym3XvJ%2FMr7c7YlJuDyGAKNAK7ZY6WFEr2CVOLqORiEQn4Jk2py0IYNb4TzlKi%2BIrS9%2BDJjHBnCVv98CEIP8AeoQ3DEhl3wSu9VvhySNt7xbDuRk3aOBYeb5TCf4rVJW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 771a7e97881591e9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 26 Oct 2023 10:23:48 GMT

GET
H2 200 style.css
www.lebanonfiles.com/wp-content/themes/lebanonfiles/ 306 KB
48 KB 60ms
59ms Stylesheet
text/css 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19b6ca0d4f90a82fa372d5ce48118f5a4e6f307df610c43b27aa322a4e9b5c2c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2936124
cf-polished: origSize=377499
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 26 Oct 2022 10:23:40 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PXtkOo3tcLaMtisUbDirGP9QBjjvJsG0PHD4%2Ft%2Fj8gJMpZpxSFPT7zA3NdxBpYa0ofhb8IXkmEoHkn79d56Ac1QdervM4nlZ3maNxlA0FW2LOkOT%2BeUFxmpBqeqkQ2FebikChvFPkOTEq5QLYWsKfbaX"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 771a7e97881991e9-FRA
expires: Thu, 26 Oct 2023 10:23:48 GMT

GET
H2 200 simplebar.css
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/simplebar/ 3 KB
1 KB 49ms
48ms Stylesheet
text/css 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/simplebar/simplebar.css?ver=9.0.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 398479678a61a08fb0c4c6608eb274f3ff3900e40d6008f5d4b90c8d06efd331

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2936124
cf-polished: origSize=3819
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N9E08MkymSLdlFtPiPYjMm40GLtLmc2LzD%2FV27scZ2jVT%2FGFfJ1T6mB8wbjnSbUngBTtmqB%2F5hKd%2FfZ0yB81mGpZbzfPgKFmm9m8BrLtKpJT5fR4ZGU0JJS177Vup86k%2F%2FEzLH568nmp3IVcDJsTW71j"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 771a7e97881c91e9-FRA
expires: Thu, 26 Oct 2023 10:23:48 GMT

GET
H2 200 swiper.min.css
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/swiper/ 19 KB
3 KB 83ms
82ms Stylesheet
text/css 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/swiper/swiper.min.css?ver=9.0.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 67b6584af0fff14908d8f05c0eb9d59cb809da113feffd197f3ddb38a779ea45

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 05 Feb 2020 22:12:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2936124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbKNgkipf4ZgAGuKxtTxDTQxXXTWAoHnkVQtHMWOO0%2BMYY49NQE4tmqZthby0RIZw5Yy80YHIkzTygvalMPCR1cSiboAlgMtMOKf%2F6LIyyzG4GWe35DJBPjdCMDYkNm7hxn2lCq61FGxysrAs8hyYDWd"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31536000
cf-ray: 771a7e97881f91e9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 26 Oct 2023 10:23:48 GMT

GET
H2 200 dollars-150x101.jpg
www.lebanonfiles.com/wp-content/uploads/2022/08/ 4 KB
4 KB 36ms
33ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2022/08/dollars-150x101.jpg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfcdda63e026a6e3e42a9a049694bf3f260c3763ba17e7ad18d24e372ef2e69a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 75470
cf-polished: degrade=85, origSize=4247
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4066
cf-bgj: imgq:85,h2pri
last-modified: Thu, 11 Aug 2022 16:56:59 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lh89peV%2Fv8Bfz%2B9v6pdfgXpmoGSB1eL%2Fm80%2FfH74ffp7c11fDSAyG6C2owCfCyiN0Kz0%2BkDWyHA4RSlc%2F8EtNxN4MbPRvOUmHV98rZxhV6I3f6KUalYBYO3J%2B0ATcEzToyDx9QjLrLW3bvCQ3h18CEe4"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a85191e9-FRA
expires: Tue, 28 Nov 2023 12:59:40 GMT

GET
H2 200 430424Image1-150x101.jpg
www.lebanonfiles.com/wp-content/uploads/2022/11/ 3 KB
4 KB 39ms
35ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2022/11/430424Image1-150x101.jpg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f67bc9e28fdb94ef94edd4182fd45011a683752f62ce5778b87e2934b5074ff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2230
cf-polished: degrade=85, origSize=3519
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3423
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Nov 2022 08:57:52 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD1o3DrabMcoR%2F7XbzyI3BZWEHth8b2WMEWkRB382CGhO7BnOfx6GYii6ppmVRMyrAvBEIJlxhtlYQAg8TY6EnKCl3T9C0Uy1oeKm%2F6ncoAK5QP6xyvVgwh%2FBjyENPDoK1tXzhRTheVMmo74Uq9lsNUa"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a85491e9-FRA
expires: Wed, 29 Nov 2023 09:21:40 GMT

GET
H2 200 109_Moteur4-150x101.jpg
www.lebanonfiles.com/wp-content/uploads/2022/03/ 3 KB
4 KB 47ms
44ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2022/03/109_Moteur4-150x101.jpg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae60760593d2e94cbb31a4729deaa67c22a076fb7b1b1a08610f5658319fb1e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2127
cf-polished: degrade=85, origSize=3581
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3453
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Mar 2022 12:39:21 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iB0OeOKikwZkWrqMO3APsoGIMRERESDUeDMjyi2maB2bzW%2FVCHjpZwtKj%2BjN8DbPP8IFGESoa%2B%2BNKmHoxZqTe0Xi55tKHYhZPoqkv8YktebMUz1CXU3xRN8xY9R5n2LZNW1ZGSLZU3%2FpzNiDu%2F8yCO9l"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a85b91e9-FRA
expires: Wed, 29 Nov 2023 09:22:38 GMT

GET
H2 200 balenciaga-150x101.jpg
www.lebanonfiles.com/wp-content/uploads/2022/11/ 5 KB
5 KB 54ms
51ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2022/11/balenciaga-150x101.jpg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58ccdcff0958ffcc9dbf18f61b7bd6e41c891d1329a7081da1729fb063d01330

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3072
cf-polished: degrade=85, origSize=5180
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4808
cf-bgj: imgq:85,h2pri
last-modified: Tue, 29 Nov 2022 09:01:38 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1c1n8QZs2jQEeFaCQR2JXpL0jSWNifkffksA6KQJ3ZILcTsdX2hcVoBrBbG78g8cUi6Yot%2BjGU3FpQe9QCx%2BYNJh8JOui6zBD%2B6OCD8D8v011ZgBp2Ijn3llnFv8D4pvBE9Iee%2Futuc2Rzh4udbwg%2BJC"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a85f91e9-FRA
expires: Wed, 29 Nov 2023 09:07:35 GMT

GET
H2 200 bdl-25-3-2020-150x101.jpeg
www.lebanonfiles.com/wp-content/uploads/2020/03/ 5 KB
5 KB 54ms
52ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2020/03/bdl-25-3-2020-150x101.jpeg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f6d275209402c3d952300899151b3a9baca8975a8baf161fd3805efe3ee83d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4175
cf-polished: degrade=85, origSize=5501
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4757
cf-bgj: imgq:85,h2pri
last-modified: Wed, 25 Mar 2020 05:38:00 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rntEsSzHwA%2Bv%2BiKe7ZocmImW0Q9NEfYbtLGE7%2BnVGQzl8b9iCddvrAif49ltb1fF5Yr9zf0bDMRCnen1yQdtIYGDosmFBcKwbS8vFslHrbzfcKhTXLFAHAqRQc6RNTxsHB8PzfB2O6pYcmfKvobFBTiz"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a86291e9-FRA
expires: Wed, 29 Nov 2023 08:47:22 GMT

GET
H2 200 %D8%AA%D8%AC%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D9%85%D9%8A%D8%A7%D9%87-%D9%81%D9%8A-%D9%84%D8%A8%D9%86%D8%A7%D9%86-150x101.jpeg
www.lebanonfiles.com/wp-content/uploads/2022/06/ 3 KB
3 KB 61ms
59ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2022/06/%D8%AA%D8%AC%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D9%85%D9%8A%D8%A7%D9%87-%D9%81%D9%8A-%D9%84%D8%A8%D9%86%D8%A7%D9%86-150x101.jpeg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d9286000dd7fe186dff0d65f02a4173793c0cc0ae3f1501adec1e8ac2d2e375

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5616
cf-polished: degrade=85, origSize=3192
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3087
cf-bgj: imgq:85,h2pri
last-modified: Mon, 13 Jun 2022 13:51:56 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wsk7xQUQbas8A5QwHSISc%2FhCMoGZYXuXJnOQj1UtgPn54AyOwPJ%2FvbSFMaC7FdX72M4JRZ3A9jXzQr3N4WjS%2FamQRIuoi7pz1RZJM4T34vhHmhAWVEPO%2FpJtimvFt86b5iusvGJkD2jnrs%2BmcM4TKj37"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a86591e9-FRA
expires: Wed, 29 Nov 2023 08:23:11 GMT

GET
H2 200 %D8%AF%D9%88%D9%84%D8%A7%D8%B1-1-150x101.jpg
www.lebanonfiles.com/wp-content/uploads/2022/05/ 4 KB
4 KB 50ms
48ms Image
image/jpeg 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/uploads/2022/05/%D8%AF%D9%88%D9%84%D8%A7%D8%B1-1-150x101.jpg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8db0e61a9f2f116e5032f49caf0d23e48bb8ff4849bbdd9bb1ca2f59c9cc3713

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 7481
cf-polished: degrade=85, origSize=4158
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4015
cf-bgj: imgq:85,h2pri
last-modified: Sat, 21 May 2022 16:51:39 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zy7dz0Z9FU5dUEIMw6Uz9AtM1qFDlA4u3kbmkhp92pCY5xlDkARhRGxtt3HZYooq%2F1OTpDHPMz4K4gOj%2FE%2B5VhBkK1OpPb6tuVIoKJB%2BNL7XdKLBmsIpQFxJ1AqFAMpHdueJ%2BgGeiPmX4d2Va1SRVtX2"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a86891e9-FRA
expires: Wed, 29 Nov 2023 07:55:07 GMT

GET
H2 200 cholera-icon.png
www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/ 2 KB
2 KB 52ms
50ms Image
image/png 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/cholera-icon.png
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6abba1cf06410cdd84f90627cda608320e7e1065e8135afc9c6c2aecb0b511d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2936013
cf-polished: origSize=4399
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2001
cf-bgj: imgq:85,h2pri
last-modified: Wed, 26 Oct 2022 10:23:40 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dQCuuu322oSBjBKUELRrhqtHI3qYwEyvxJ2G5cEoL3dOnLwmZwRkLjP2kIoz5alIbdKLK5mEOe0swD%2FqxbQXSiCPTL4QtwkiuHz4j%2BWaYSfYc52TMIU7J0yajTlyiTlfP%2Fq8Ii%2F7JJwucutuBmFofNAl"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a86d91e9-FRA
expires: Thu, 26 Oct 2023 10:26:06 GMT

GET
H2 200 trianglemena-logo.png
www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/ 4 KB
4 KB 47ms
45ms Image
image/png 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/trianglemena-logo.png
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db5d999e356d97a5cf821870429655191d582cb778c71312215215751b922eb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6495476
cf-polished: origSize=6872
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3837
cf-bgj: imgq:85,h2pri
last-modified: Wed, 29 Jan 2020 20:48:38 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3o5ZC6kUElZ05giIuUQn23meDeFZkPggLB2%2FFIsqUYnJz%2BiFu%2FvwqDvarDead%2BIk0pb%2FC9D8sW8pKM%2Ba8IQjFpSh99XNLA5j%2BfEyB2g1EUlMhmj7J%2BSxAF5AmFq8fu7i1Pi%2BLQBCNYUb0gUXec82EHSb"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e97a87191e9-FRA
expires: Fri, 15 Sep 2023 05:33:04 GMT

GET
H2 200 rocket-loader.min.js Show response
www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 29ms
27ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Nov 2022 13:35:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"637cd00d-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mA%2F7S9XHfk%2BsQHgTPk0lRJ5ZlYZ%2BANJEDD6s%2BGkdWPRdq5t4XD0vRaIGHLSZ1DOb980JcxgBEDJyksiPyXNDc3Xo0ssxe%2FJ37RcTTEEZecQrj3wRtbC6b4Z5k23%2BJ3XhcCTA1R0zkwgRGFiXsLlmJsVl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 771a7e97a87691e9-FRA
expires: Thu, 01 Dec 2022 10:00:07 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 198ms
163ms Script
text/javascript 2606:4700::6810:3865
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 771a7e97e8286937-FRA

GET
H3 200 logo.svg
www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/ 14 KB
11 KB 57ms
57ms Image
image/svg+xml 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/logo.svg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b545867fa76275afab94da71ec2e4059d9694e77e7e3f3a879d16e677f0ec2d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5468758
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CeRp8hyupiFVagUdf9%2FnrZAF%2BtXZCiaYtDfc0xEL9QErn%2BuZZM3UA9l7Z7eHYEZIG1u0oAl4BQkLeKeargDyAqzGSfuKpyX1LqY%2Fl3W%2FVdRdTjzGnk1MCZnDj2CxY6fqG%2FJca0AMiwdjH2G%2Bz08EHPQX"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 771a7e9829e79223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:06 GMT

GET
H3 200 ticker-icon.svg
www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/ 1 KB
932 B 86ms
86ms Image
image/svg+xml 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/ticker-icon.svg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c25f17d25f76448906480fb83546ad8d0f7bdcb900a172c1d3f7488f34db723

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 03 Sep 2020 10:11:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5464045
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8dZjdoVrnGRfTq2gDmJWNI%2FJXlp1TClhnapAR5DkiDHPifgGAbVA2Jps0bf2FRji72hzXRPyoKtKTZyBfD5VK9sC1wJTVi7PgwSN0kE3KSgKXkR9leSg5lX7VzrHH6NvJeGKRrkRsCDJrWcyeru12YBz"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 771a7e9829ed9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 lf-small-icon.svg
www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/ 6 KB
3 KB 87ms
87ms Image
image/svg+xml 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/images/lf-small-icon.svg
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b791d9b523b9be4615eed3ada77b540ecb01bcdbec149b19d7b3a323300662e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 03 Sep 2020 10:11:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495476
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iARNKcBH32fCdj5TqeW4fwG%2FQNZr61KQbsBbJH0rb1BvuONfb8sMhfWnvvp5vF%2BhdpFZk5n7ovAVsWlMaPzb2%2FVQpUSYHIV6Z0u5yc7Ic4FFap%2FTiJ3WGE4Q0095LIth11%2FvnOd9pBaw6JqoXLssrtXj"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 771a7e9829fa9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:06 GMT

GET
H3 200 /
www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%... 64 KB
64 KB 233ms
233ms Image
text/html 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Gh2HcI5R4ox8HLdpIzlTYLF%2BDzd9m4B85rCyFjbcTjpjPpkB0jOYeSAsHeNICnlBZg8ZoAeVr%2BEk8WwoHFisX5p5%2BCT1phb7K48YCE7UhGEhLadfz3jL%2FYpElGu3zm%2BVf1xWOgNC3%2B79qaMzyQzYUcW"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
x-cf-powered-by: WP Rocket 3.4.4
cf-ray: 771a7e982a009223-FRA
link: <https://www.lebanonfiles.com/wp-json/>; rel="https://api.w.org/", <https://www.lebanonfiles.com/wp-json/wp/v2/posts/1221956>; rel="alternate"; type="application/json", <https://www.lebanonfiles.com/?p=1221956>; rel=shortlink
itw-article-cache: EXPIRED
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 ArbFONTS-The-Sans-Plain.otf
www.lebanonfiles.com/wp-content/themes/lebanonfiles/fonts/ 59 KB
59 KB 85ms
85ms Font
application/octet-stream 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/fonts/ArbFONTS-The-Sans-Plain.otf
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6f14410f46ae33b84e0707dcf7bb436b153e7ee83485b583592052a48e983b6

Request headers

Referer: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6495077
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 60160
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n5aHZ6g7QP5zdUhnhbN5ivEw6PGnGP9ZKUuZhxr%2FsDgMy0d7O0gyt6195k62koS3NUh1AdUOuX1fByuVkgqntKhehJFKAKrw6%2F09K7sLiCcUUopZE2Xje36eTPi2Dep%2Frrcp5kHtnBHyZx1b3VpU0cf6"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e982a049223-FRA
expires: Fri, 15 Sep 2023 05:33:06 GMT

GET
H3 200 fontawesome-webfont.woff2
www.lebanonfiles.com/wp-content/themes/lebanonfiles/font-awesome/fonts/font-awesome/ 75 KB
76 KB 107ms
106ms Font
application/octet-stream 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/font-awesome/fonts/font-awesome/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5466490
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XD3NTU9cgPN6yMCdAGXjGozru5J%2B%2BPTQV1xJmXwIbW13gzYkn7TtHA1rAmoHGGMfvj5qc4z%2F2djSX4xkjqt%2BorE1fycwrT0APomA5lOVIljOzkl0SYu%2BtgyhNa%2FmC6%2Bn0XN88VZag%2FUpczFKiRJcMe4z"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e982a079223-FRA
expires: Tue, 19 Sep 2023 19:30:43 GMT

GET
H3 200 ArbFONTS-The-Sans-Bold.otf
www.lebanonfiles.com/wp-content/themes/lebanonfiles/fonts/ 58 KB
59 KB 81ms
80ms Font
application/octet-stream 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/fonts/ArbFONTS-The-Sans-Bold.otf
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 707d47e8f794caef2636919f7e4a1ee998ee9280fa0798af057c605a5894d569

Request headers

Referer: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/style.css?ver=9.0.0
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6495077
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 59664
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKEvnjKZKUYQJmvO6yauXHtQSbQqD5ASI8v%2FM2ZnOKcS3YZWtT%2BR9Pz0XXGmpZuZ7%2BafBDPbIuQKCMvrVFm1%2BhwC6BU9F941PlOcztRjybzXzXfsPmGcFG8CPeAmeHDVPeEzH2YjEz1HHwscg2X5DlVV"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 771a7e982a099223-FRA
expires: Fri, 15 Sep 2023 05:33:06 GMT

GET
H2 200 bundle.js Show response
tpx.tesseradigital.com/dist/ 26 KB
27 KB 51ms
19ms Script
application/javascript 35.157.179.180
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tpx.tesseradigital.com/dist/bundle.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.157.179.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-179-180.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2c355b83c326a1a516c0639e60c36e46559bc0a3c160df6059020f4f26a4a7ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
server: nginx
etag: "6f59829f8e9438f09f41187b368f2ebd78a44be6"
access-control-allow-methods: GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
content-length: 26906

GET
H3 200 lazyload.min.js Show response
www.lebanonfiles.com/wp-content/plugins/wp-rocket/assets/js/lazyload/12.0/ 5 KB
3 KB 87ms
79ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/plugins/wp-rocket/assets/js/lazyload/12.0/lazyload.min.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3bbf2a6d9503811213baca9f5e309618ca968136199ca532a0a5167c0b0f1c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 31 Jan 2020 14:10:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QhyEAB24lvMuWCe4IZXSClOylixIDWq%2FAm%2FyzonlmyM8cuq1wpbkXSg484C%2FpBeG9mYlx6F3DckdNubjnTBddfsKbnHsxF5xVgykBDx8%2FX2TQB9c%2BqPfdJ5D%2FTdccb5Poby%2Bvbz7VgAZMA%2FzoBBPpWkf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988abd9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 lebanonfiles.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/js/ 42 KB
9 KB 105ms
96ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/js/lebanonfiles.js?ver=9.0.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78797b518e0df3bfe55a1edfca1a70d0009ab6d210aa1f46097bccf11343c84b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Jun 2022 19:48:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2936124
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FO2wREHv67d9kbHYGvzYiCl0eiuARLlqRYa%2Bwq8MmWzRZQzrEWPUnPGnmMjugZBiNY3TKqES5xqmEjGBR4hGfu2hdoao9ovXQGKsQuYz5Tsl1rDyGOfkEFLjYzyPImIba4DhQs34YbCPj%2FX5fCoWuP8w"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ac29223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 26 Oct 2023 10:23:48 GMT

GET
H3 200 simplebar.min.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/simplebar/ 44 KB
14 KB 109ms
97ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/simplebar/simplebar.min.js?ver=1.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e5be5b6e3ff509bba2f9ee8a7dd4ebfd8016d1a0b2f085d980df240b10d25bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6496026
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OFHNOQ0gn3LqvWXjYbJLHQhWqFnx9wnXN5B%2BSkZauGsmya5RNqdrsC%2BwNG3bOl65s4ZhquX%2F6CPrelufCLYTWqRI8XEWUPI8R8PZ4t7yQstobI5XJUUf62IP0XvvxvmezMfLsdsNNSB7HZWBd78cJpkh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ac39223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:08:46 GMT

GET
H3 200 slick.min.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/js/ 42 KB
11 KB 110ms
99ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/js/slick.min.js?ver=1.8.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VbcuAUwKprbKw%2BkKRIIhM%2BBiV22dOoCiZKXgNyZjstpDgGKP286gsI4LamvRLyvdNfaCJcy3U4cmOV%2BLkcf5Kn15qmi1eDze94B40GohiMz7SD%2FQZtxPhnZARqsKtMkWeQ6NU7%2FJME5lNQH%2FKvgQvF45"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ac59223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 919 B
994 B 174ms
47ms Script
text/javascript 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=renderInvisibleReCaptcha&render=explicit

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b00ba8889182d54d37c4e2f8be08e53ef684c437f63d733ed0a019b481381e04

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 581
x-xss-protection: 1; mode=block
expires: Tue, 29 Nov 2022 10:00:07 GMT

GET
H3 200 index.js Show response
www.lebanonfiles.com/wp-content/plugins/contact-form-7/includes/js/ 21 KB
7 KB 110ms
99ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.6.2
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32dd00604df8db3415240d450341558b6827b1e02dc0f211d8a6d9a4287c522e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 20 Aug 2022 18:20:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6496026
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fYzsEWNSVzqURZ4ZdUdJL9PI5EiHGj%2FVqi8Z7rmri818Ddmxc%2BjVUKl8AT5LkmltWWHGp1Qr8h3%2FNdKuIKvBuQcRz4lFeRLybAnZl07HTEuRWlq4%2BNSpz94E%2Bp2L47yuidBXAy3SrZaqm7P2x0k9LF%2FE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988acd9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:08:46 GMT

GET
H3 200 wp-polyfill.min.js Show response
www.lebanonfiles.com/wp-includes/js/dist/vendor/ 19 KB
8 KB 111ms
100ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Jun 2022 19:48:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6496026
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OFulERxk%2FpMNfcp6FQIeuBJ6Mx23BMOUWUFRRrvYSaxL15EZcV1IKYU%2BEGQ7tqqBvXJ96ou%2FU9Uu6dLbNWDTAjpQpdbOoKrG8Vxrr2CV2ACP8b2fJGRpnEzUiIBa9clmBEl5g7991vMLqoikyufNIHHC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ad59223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:08:46 GMT

GET
H3 200 regenerator-runtime.min.js Show response
www.lebanonfiles.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 112ms
102ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Jun 2022 19:48:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bZTZ52LiiSJMks5L%2BngSp65n3pGtWiYHu2K78b%2BaFUoP0EF9R0qF70t4O9gLaQBv7YQaqy0qYNzY%2FeFEyos5UXmePX6RHYRSsul%2FnW9Dvrtdag5UFPGI3nQbsUYWQdpUIa1iQvU1UnnckWJHa1CjeOsB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988adb9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H/1.1 200
OK mc-validate.js Show response
s3.amazonaws.com/downloads.mailchimp.com/js/ 140 KB
140 KB 363ms
131ms Script
application/javascript 52.216.112.158
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/downloads.mailchimp.com/js/mc-validate.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.112.158 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b15aceb04dbf5604df5617cfe984f48479cb131c1df02825d1c24e9f35d01857

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:09 GMT
Last-Modified: Mon, 20 Aug 2018 17:42:38 GMT
Server: AmazonS3
x-amz-request-id: 0917WCV0KRD8XZ1Y
ETag: "6465dd4a8331265e6629cd069e03504c"
Content-Type: application/javascript
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 143249
x-amz-id-2: GrebN8KY7VgtB4y9rspCi0Sbt5C/uMmMTUvh4/oywMNDj1cNDzPo9nzpHCYykpgL70WTHPGzEqc=

GET
H2 200 lebanonfiles.com.1189476.js Show response
jsc.mgid.com/l/e/ 2 KB
1 KB 104ms
41ms Script
text/javascript 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c1c91dfc427c1b3b56e847cf83b1016a561711726e091bf697ed25396a24cc52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
x-amz-version-id: ggImLS2Egf_l8SMHyyYrcCp3klri_YT7
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 1ZQ47HTA8RHPJNMD
age: 4591
cf-polished: origSize=2350
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: ldhJKRQG9nhh5lWiHbl6ysAFyapOkTtd5tKvMCEVoEDpdQaZtpzBBtuptNV2nJMo+zGWrD1v/JE=
cf-bgj: minify
last-modified: Wed, 23 Nov 2022 11:47:53 GMT
server: cloudflare
etag: W/"f9e35a8569520baf65928b4e96831f3a"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 771a7e98ecef9bd4-FRA
expires: Tue, 29 Nov 2022 13:00:07 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/ar_AR/ 3 KB
2 KB 37ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/ar_AR/sdk.js

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ac0c7cdba88b3c9c96bc6dddbbc1922e574cec051f3898811ca99ac26a7438ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 29 Nov 2022 10:00:07 GMT
content-md5: 0N1VvUZQPT7uXZQknZ1dww==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: hgFbbr1fkcWYyuDtEFOhV9mYXY/Q4Uoec7VGX3B29dqpNZjmg+WjCnch9k7bTCxYf/HBvLZzDjxjpLrwdVyIyQ==
x-fb-trip-id: 686109401
x-fb-content-md5: adb0407477b0b6488fa5a59397fdd635
cross-origin-opener-policy: same-origin-allow-popups
etag: "3ba6c84d6857e402ac3c80e0fa019abf"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
priority: u=3,i
expires: Tue, 29 Nov 2022 10:12:53 GMT

GET
H2 200 RV0UR9OI.js Show response
cdn.insurads.com/bootstrap/ 7 KB
3 KB 128ms
4ms Script
application/x-javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.insurads.com/bootstrap/RV0UR9OI.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, DE),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: 6d3e8aa04471ca235093290325bcf511af7c9ced7cccfc2ee6d6ed2a2198fe0c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: gzip
cdn-edgestorageid: 1055
x-amz-request-id: 00XEW125DEWPY9BM
cdn-cachedat: 11/15/2022 11:35:57
cdn-pullzone: 55316
x-amz-id-2: Zr0wvwAr4cG7xlGrWV4xpuXLhm6bUBgkITY0QallTUrUJxMk3CK3bVUNgZ1BlvJ1Xn9oBPG9LTE=
last-modified: Thu, 14 Jul 2022 10:18:39 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: "0f37fbdf419c5bd29bb16eea13de75ae"
vary: Accept-Encoding, Accept-Encoding
content-type: application/x-javascript
cdn-cache: HIT
cdn-uid: 56a941db-1de6-4dd7-bd60-f93546463707
cache-control: max-age=86400, s-maxage=604800
cdn-requestid: 75096600be9e03589b35916e24854c0e
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 plugin.min.js Show response
get.optad360.io/sf/8b2de328-d178-47b2-bc5e-74cf6a08de97/ 264 KB
57 KB 72ms
11ms Script
application/javascript 2600:9000:225e:8800:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/8b2de328-d178-47b2-bc5e-74cf6a08de97/plugin.min.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8800:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ed960ba035536d1f5cc7968bbfe216824804ce907e7607fc6ea0f8fe64f4d94e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sun, 27 Nov 2022 17:58:23 GMT
content-encoding: gzip
via: 1.1 8b360b28aeb67c1982fcc466a05eef02.cloudfront.net (CloudFront)
last-modified: Sun, 13 Nov 2022 13:20:44 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 144104
etag: W/"c72db6a68cf21e93421ebbe65b3a3770"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=604800
x-amz-cf-id: 1Tm1ZobIDS6JgtljsBTk2Jw2fSxFJvdcd57fRQaFuZusT7RQvNG3bA==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 185ms
62ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc0c954e7dee4a71fc76a1f9437bf0303aa2882a7b9ee99e4803702e535804db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27211
x-xss-protection: 0
server: sffe
etag: "1406 / 430 of 1000 / last-modified: 1669715139"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 29 Nov 2022 10:00:07 GMT

GET
H2 200 sa-script.js Show response
cdn.bidder.dev/clients/21894097782/lebanonfiles/ 165 KB
48 KB 167ms
32ms Script
application/javascript 34.96.69.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bidder.dev/clients/21894097782/lebanonfiles/sa-script.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.69.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 62.69.96.34.bc.googleusercontent.com
Software: /
Resource Hash: 4b72b85b9d16b8c10a1f33b857ba56470a568cf4c0b619fe8479c65ac221b656

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:07:28 GMT
content-encoding: gzip
via: 1.1 google
age: 3159
etag: COzB5MT69fcCEAE=
content-type: application/javascript
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48920

GET
H2 200 lebanonfiles.com.js Show response
htagpa.tech/c/ 17 KB
3 KB 103ms
30ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htagpa.tech/c/lebanonfiles.com.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eeda7925eb93361af985434c517d19c4e5acbd2c64736ccf43856e9ca8ea8292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: KT1ZSX9N9KBYRAPD
age: 6661
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2649
x-amz-id-2: GUJGL54p4GK51piVk1woK0OXg0dyfqU797Lw5TLGaoigHlt7+ctHrBBKIKQNFyNvx6RgNPZCvRE=
last-modified: Tue, 22 Nov 2022 11:30:08 GMT
server: cloudflare
etag: "e2379020b22ce6ec08289f1ef3ccf523"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pWIufLtqOOT1reitedqgOb5KzTFpHSEBDLC%2BQQ6rzqIhDuN%2BtquFnLvR9xOcOFUHSrVuAY76vZ1HxOUUi0tBGYUBxH%2FREmOwTazMG2psaPCqFsUV9Q4f3U0U%2FtSnBywt7D8e2ECqi73VWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 771a7e98fbe0910c-FRA

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 89ms
39ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 229
etag: W/"ae63ef8ff03da61fffaa7f165729897a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 771a7e98cb01bb47-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 02 Dec 2022 10:00:07 GMT

GET
H3 200 gtm-f608d464e88a255a9975ccdc5b37b7fe.js Show response
www.lebanonfiles.com/wp-content/cache/busting/1/ 109 KB
43 KB 110ms
103ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/cache/busting/1/gtm-f608d464e88a255a9975ccdc5b37b7fe.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff001622a1b30c70f237d70a0decf279e9707e67027cac999f9b6e63b6a25645

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 15 Sep 2022 05:10:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495985
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=atZY0BRe621A7tq5ebv0G3zh2hbryTAVEcSxdYm5i24Sfy7lABiXEVoM2%2BPa0Q0gNCWkGcPPwCyXY5CEuo0E%2BfmqYH1jwUWZJXx6bMCPOr1u1yBF7LHnZ9pCw3rFXiy2iRpF7EAIfuuexulzvEEBQigW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988adf9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H/1.1 200
OK lebanonfiles_11820.js Show response
ads.vidoomy.com/ 5 KB
5 KB 398ms
146ms Script
application/javascript 3.19.54.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.vidoomy.com/lebanonfiles_11820.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.19.54.139 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-19-54-139.us-east-2.compute.amazonaws.com
Software: Apache/2.4.54 (Amazon) OpenSSL/1.0.2k-fips PHP/7.0.33 / PHP/7.0.33
Resource Hash: 2b70bc8468e35f8a98bf9f6aebd2f5a230fcc4b20bc726416e1eefba099d5689

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:08 GMT
Server: Apache/2.4.54 (Amazon) OpenSSL/1.0.2k-fips PHP/7.0.33
X-Powered-By: PHP/7.0.33
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=300
Content-Length: 4997

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
49 KB 184ms
63ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e29a5284c85d1773a118ae45250d5f4c2216721f6b7b2258bb265d73b9f6212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49259
x-xss-protection: 0
server: cafe
etag: 9154586444276397852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 29 Nov 2022 10:00:07 GMT

GET
H3 200 swiper.min.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/swiper/ 136 KB
36 KB 119ms
113ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/swiper/swiper.min.js?ver=6.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 770008a560398e6ab513700705e2431fce9e999b8e10c299ad9c4dafd0c9010b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 02 Mar 2020 09:09:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YwG2yb4hOTN7bLYge0KlRTtQj6f4GbMUCSxgL4G9Q7CEZTmBZrlfvGyoKgO8kDebg%2FyrmVagkYhMxEJ8J%2BqH5T5Dc%2BZfQRSU0eYY2MMG%2BJnuAKgZ%2BZHIo5PA3vbG4Mdad%2F2nojEv6pSaGBoHzJUxXpAd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ae39223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 iscroll.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/iscroll/ 49 KB
12 KB 112ms
105ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/iscroll/iscroll.js?ver=6.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ba5939372549192a9866bf2c9d828e9c7f16487c080a5339b2355601fd292c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xZkkzavMbsZSRUb%2BIFL44qIFzXbvln2IhBzRDakuV9sJ50aH37QUS%2BG2Gl8BRX6umJeiPITWIs5tAMy37CXs5nQuz4GCp6oxjRHXWA9QBhW2HJEWFaRDr9vkNRnXw%2BCoo8Q30693c8f4kj%2BeZ6Sl6bs3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ae79223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 jscroll.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/jscroll/ 4 KB
2 KB 115ms
108ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/jscroll/jscroll.js?ver=6.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca296812f114107fa083d5231d83f2f12264be3f0fddf1e270b41f849fbfa8be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 28 Jan 2020 10:33:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0UtOLAsnloFU%2BSncbfCfPiDumgycBNhGVDwKheDa0vOjLyDMJszWPgzmZIaZm6cd9Sw7A67gE%2BINFZvCItzqGTwDZMibmoTLqrO4RrFsEJB8ovwAcGs0%2FeVdD9AwykyxAQfGLN1SnrQ1vDsEEwokU5lx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988ae99223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 plyr.min.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/plyrJs/ 117 KB
34 KB 116ms
110ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/libraries/plyrJs/plyr.min.js?ver=6.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d4e557fae260566d3a44d3b94eb31158760bf12fb0b8b3d0359b78a3110fb52

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 23 Jul 2021 08:55:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=14CiEvxW1FiHHwCS%2BN7B93FXQSLD36Vng3W%2FlXjiOMaLrmgXFMEap6wF2bUvKCJp404s6eMgDJIW8HmP7Tskws2wvH4uBahYU8fis6VA3e%2BJ4qJNFDgdc%2Fu%2Fh41Ou6G2yaKoA3L5jtWMmBJ%2B%2BkUpbdsf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988aeb9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 anime.min.js Show response
www.lebanonfiles.com/wp-content/themes/lebanonfiles/js/ 11 KB
5 KB 121ms
115ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/themes/lebanonfiles/js/anime.min.js?ver=6.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7813f21ffc8ab5a9c4808a33cae9e6234b4ab3b14245a8900bdd62879642077c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 25 Mar 2020 10:08:07 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xZDu9TX1OgltpHud9GNBsUUsiUWat4AK3X5r%2Bv%2FFSyRhm1Q0U5H1SZkvCn%2F8HzOpKyGeQn7%2Byl2aByDC8L2VChsoKvQSD2d3Aa%2FDDssxRFCDhaKM3bU9imefc1FrwtPzeGDB0M8NuNnaIaMln8W0wIxK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988aec9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 triangle-mena-news-coverage-public.js Show response
www.lebanonfiles.com/wp-content/plugins/triangle-mena-news-coverage/public/js/ 3 KB
2 KB 121ms
115ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/plugins/triangle-mena-news-coverage/public/js/triangle-mena-news-coverage-public.js?ver=1.3.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7efd359cd7418393a4a48a1bdc760a0ca0562da42bbe89b8cb48cab89225a471

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 25 Mar 2020 10:08:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4323382
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BZfTwKGdnFe6YVfGV2UvtByLkTzl3iC%2BfV20kGrwua5zu5KLGrtKPn1bJWI297FjEiWpE7ZOjSfhnUJZpw2LWN5VPrVkGa0DCBi9GR6t%2BTVFDCf8rP6tFVa%2Bpc61%2FDPlvnTnk050Nf3Nun1xHd29ASU3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988aef9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 jquery-migrate.min.js Show response
www.lebanonfiles.com/wp-includes/js/jquery/ 11 KB
5 KB 122ms
116ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Jun 2022 19:48:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D2pfk5EzB8fZzIiebgcwcS7CadC2Dpj2HC%2FP%2BTGo%2BUulISGpEPB3468PrM70lJihdEiMkpCZJv08VNFQk4164DkoT0WNtwzFNpPievy%2FDMz%2Bjn29dwOrbcSSb58kzOTvtOquKF%2FwJPcA83Jumun1lM50"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988af09223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 jquery.min.js Show response
www.lebanonfiles.com/wp-includes/js/jquery/ 87 KB
32 KB 127ms
121ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Jun 2022 19:48:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495240
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qkg2sLBb%2B1ZBIgFAxPrx5Zoz8ZXiQfGE9Pa9DM%2Bt3HEwsxVKAfdXcX4xYxRkOMJtxHUlVrCLNLlcz9tAE9hsbym9qZV0KF7Q2sNFKcRUSgVYSprN8L%2FfSCaIiK2Zjc6WJLOR8%2BzYQ%2FHHB%2BKDAr0V%2BjR7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e988af19223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:03 GMT

GET
H3 200 invisible.js Show response
www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 1082 36 KB
15 KB 38ms
23ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1669708800
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acf934bac4b75cce591c4c7090e5a976e07cf4c74bdac238d9114c6733e8e3f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WsVTB7rMQHRHtMJ5%2BsXpakKqkkUmDixHFf4dxWWOTNyTW3f83x0hYVZhx4ono0pArPDYr2hdg%2FXUSX6S14MIe6xPQ3FyrvB0sLjet3YZYtH%2BdnpBfJxXPzekqqR%2Bu4Ix0BvDWV7v%2BTV4po9cP1gyPYVk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 771a7e993bf89223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 pica.js
www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 1082 18 KB
8 KB 38ms
38ms Other
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f30f5e23b933cef2417a42f101ba7b0af2f24c0a25206a254ef2b3bd0e4b257

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:07 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KQXvZIhKzMr5%2BzYPMy%2BZJSD9WE1XBxa50mwa0XsgIXhOKuXwVkljOSwlP%2FNVLEU%2F97VIYnjQ%2BCi6vwFtrD%2FuRt%2BlfusyKBmtP1BE2VpeP%2F%2BaIC%2BZjZDX0RvnGHN0igBDPHQCyfLRtWqtWrl761NnrsdH"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 771a7e996c6e9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 js15_as.js Show response
s10.histats.com/ 11 KB
5 KB 77ms
9ms Script
application/javascript 46.105.201.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s10.histats.com/js15_as.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:55:44 GMT
content-encoding: br
last-modified: Thu, 16 Apr 2020 10:44:16 GMT
x-cacheable: Matched cache
x-cdn-pop-ip: 137.74.120.0/27
etag: "-375139978"
content-type: application/javascript; charset=UTF-8
x-cdn-pop: sbg
accept-ranges: bytes
content-length: 4364
x-request-id: 909738800

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 52ms
29ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 230
etag: W/"2f96824aee4bf927e734cc519e3e726d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 771a7e9a2bdd92a5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 02 Dec 2022 10:00:08 GMT

GET
H2 200 projectagora.min.js Show response
aghtag.tech/libs/ 297 KB
88 KB 86ms
33ms Script
application/javascript 2606:4700:3030::6815:1b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://aghtag.tech/libs/projectagora.min.js
Requested by: Host: htagpa.tech
URL: https://htagpa.tech/c/lebanonfiles.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:1b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d24911150a4799bd44093e6b1f657b908faa4e83ecc3bb8b1a05c7086dc6a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 5VAQA6CDNMT4HW5W
age: 3032
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 88966
x-amz-id-2: hQpw0MzHc9yoacvgpEZpKoK6un8HjGQWnNNwTTOA4gx5hINluRG0h2Hp0tCx+hg4lm+WWYRPQk0=
last-modified: Wed, 23 Nov 2022 15:08:19 GMT
server: cloudflare
etag: "e55b32a563b2c91d9c73b854188caa72"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hlWaP46E0z%2F6G%2B2yIJuqnylegJJSZ%2BqZJx4%2FdmheqgEhhbkawAL1yp%2F1fX69P9hblgLFe%2F6FW8P6iyK2i%2FL8DdTmUxzosg%2F2pjtpLUIN2mdLeIVKgHi2u1v1rFpgiN%2BCuies1URuNL7DpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 771a7e9a6fd8bbc2-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 214 KB
75 KB 148ms
60ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G4EQ7NKTZM&l=dataLayer&cx=c

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/cache/busting/1/gtm-f608d464e88a255a9975ccdc5b37b7fe.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

51a284d56d0c4fbb081c4945183259ee4484bbcbba4ed000211df9a63d580f94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76552
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 29 Nov 2022 10:00:08 GMT

GET
H3 200 ga-d40531c5e99a6f84e42535859476fe35.js Show response
www.lebanonfiles.com/wp-content/cache/busting/google-tracking/ 49 KB
21 KB 52ms
51ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/wp-content/cache/busting/google-tracking/ga-d40531c5e99a6f84e42535859476fe35.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/cache/busting/1/gtm-f608d464e88a255a9975ccdc5b37b7fe.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 15 Sep 2022 05:10:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6495272
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6KoMRL95%2BxDwoqvPN5ZXn7FZtRzQHOKW1Ptro7T45ibCAKbiod5wbVAEZMqqtcg4dvLeXAMB12xr%2B7KYmnuCUCoITB14u2stp5LFXbblALzAg38gfCtiYTnwkfo12G%2FY7dLp90xFfIbrD6SQeeKwmCGu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 771a7e9a1d7a9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Fri, 15 Sep 2023 05:33:06 GMT

OPTIONS
H2 200 floors
api.floors.dev/sgw/v1/ Frame 0
0 90ms
36ms Preflight 34.160.128.112
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/floors

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains;preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin: https://www.lebanonfiles.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Tue, 29 Nov 2022 10:00:08 GMT
expires: 0
pragma: no-cache
strict-transport-security: max-age=31536000;includeSubDomains;preload;
via: 1.1 google

GET
H2 200 4.23.0.js Show response
cdn.jsdelivr.net/gh/bidder-dev/prebid@master/ 359 KB
110 KB 104ms
67ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js

Requested by

Host: cdn.bidder.dev
URL: https://cdn.bidder.dev/clients/21894097782/lebanonfiles/sa-script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d56f50130039a9148a433fef8b688032afbfda0e6cf590594546913434e068e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 36476
x-jsd-version: master
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19173-FRA, cache-iad-kiad7000043-IAD
x-jsd-version-type: branch
server: cloudflare
etag: W/"59a64-U8CHrkDcnv5SfhljaVI67CWLEA0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MfiPvcyQpXNqIKJ2hL0e7R5lqmezQ4etmZMnETq0ZsG8WU9WxfKtVF5Qhrl3BGGl7f50GQA5MmU9cw9P3mWfueqtHXWz46JsR1vQB8BN9NZN2ZYmLcKa0JUEXDVlvnem5KLavMGviDcR2BgQD2Q%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 771a7e9a8bf1bbf1-FRA

POST
H3 200 floors Show response
api.floors.dev/sgw/v1/ 2 KB
2 KB 113ms
50ms Fetch
application/json 34.160.128.112
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.floors.dev/sgw/v1/floors

Requested by

Host: cdn.bidder.dev
URL: https://cdn.bidder.dev/clients/21894097782/lebanonfiles/sa-script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.160.128.112 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

112.128.160.34.bc.googleusercontent.com

Software

Resource Hash

206c2b009ceab96ac63d3cebbbf0e097fb3ba2077197ef00d455bf967248ecd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains;preload;

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
x-api-key: ab4375d6-5074-4f75-8bc8-1019cf85d964
content-type: application/json

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:08 GMT
strict-transport-security: max-age=31536000;includeSubDomains;preload;
via: 1.1 google
access-control-max-age: 3600
access-control-allow-methods: ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
content-type: application/json
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: 0

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 162ms
85ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc0c954e7dee4a71fc76a1f9437bf0303aa2882a7b9ee99e4803702e535804db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27211
x-xss-protection: 0
server: sffe
etag: "1406 / 508 of 1000 / last-modified: 1669715139"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 29 Nov 2022 10:00:08 GMT

GET tag.js
t.effectivemeasure.net/ 0
0

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/ 354 KB
116 KB 195ms
94ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8745593945608202&plah=www.lebanonfiles.com&bust=31070969

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8833f7d490882a64e4f53ef446e81ddbf4962073052d526b00a35a92193061b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119174
x-xss-protection: 0
server: cafe
etag: 1244074714821168921
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 29 Nov 2022 10:00:08 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/ Frame A577 10 KB
5 KB 164ms
41ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221110/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 83881
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 28 Nov 2022 10:42:07 GMT
etag: 10353107486223812946
expires: Mon, 12 Dec 2022 10:42:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ 381 KB
129 KB 83ms
58ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:31:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1690
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 29 Nov 2023 09:31:58 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 613 B
233 B 164ms
55ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da16efd51e0697eee352deb5b81a0cb302ea86c6ae682b9747aee889a870a77e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 208
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:08 GMT

GET
H3 200 lebanonfiles.com.1189476.es6.js Show response
jsc.mgid.com/l/e/ 268 KB
77 KB 92ms
63ms Script
text/javascript 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d6ea6b74b009eba4adb7ce819e8097a0041230ff06bd93a99a6d28dc62912d9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
x-amz-version-id: 9LtSknhCtn_IkRVxYlGRVOh7HWGTb9y3
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: KYRMXQXC5010E4P8
age: 6815
cf-polished: origSize=274163
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: 2m1+BC6N3zjuowBvW8Lu2ejxAe1Ex2365PdLTPLLKCmIvYSJ4AqzxD74ZU+gTXd7QDy2YTqmJLA=
cf-bgj: minify
last-modified: Wed, 23 Nov 2022 11:47:53 GMT
server: cloudflare
etag: W/"6bac4fbb50a4b7f90c56f329b85745fd"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=10800
cf-ray: 771a7e9aea41bbcb-FRA
expires: Tue, 29 Nov 2022 13:00:08 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
410 B 177ms
44ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=606078623&t=pageview&_s=1&dl=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&ul=en-us&de=UTF-8&dt=%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A%3A%20%D9%82%D8%B5%D9%81%20%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A%20%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE%20%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1%20%D8%B9%D9%84%D9%89%20%D8%AF%D9%88%D9%86%D9%8A%D8%AA%D8%B3%D9%83%20%7C%20LebanonFiles&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=928871907&gjid=846782786&cid=1219796233.1669716008&tid=UA-60620050-1&_gid=874002939.1669716008&_r=1&gtm=2ou9e0&z=749631443

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/cache/busting/google-tracking/ga-d40531c5e99a6f84e42535859476fe35.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 0.php Show response
s4.histats.com/stats/ 52 B
186 B 322ms
96ms Script
text/html 149.56.240.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://s4.histats.com/stats/0.php?1238494&@f16&@g1&@h1&@i1&@j1669716008182&@k0&@l1&@m%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A%3A%20%D9%82%D8%B5%D9%81%20%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A%20%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE%20%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1%20%D8%B9%D9%84%D9%89%20%D8%AF%D9%88%D9%86%D9%8A%D8%AA%D8%B3%D9%83%20%7C%20LebanonFiles&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:122886875&@b3:1669716008&@b4:js15_as.js&@b5:0&@a-_0.2.1&@vhttps%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9%2F%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84%2F&@w
Requested by: Host: s10.histats.com
URL: https://s10.histats.com/js15_as.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 149.56.240.130 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns534298.ip-149-56-240.net
Software: /
Resource Hash: 1aad2467e079feff729653375833eace307bafb246ef3cf2c319546140e2a3b6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:08 GMT
Connection: close
Content-Length: 52
Content-Type: text/html;charset=UTF-8

GET
H2 200 web Show response
onesignal.com/api/v1/sync/526a87ee-0554-4141-869b-9284da88eaea/ 3 KB
2 KB 52ms
33ms Script
text/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/526a87ee-0554-4141-869b-9284da88eaea/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

73a545e6fbb2091b65c6b7f47f16806d064f1b1cf3cac00d3399cbbb380f92c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
age: 3246
cf-polished: origSize=3427
status: 200 OK
x-envoy-upstream-service-time: 21
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 2bf91487-b0ca-4203-9f34-07969f9cbe37
x-runtime: 0.020219
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"274f38c14444015460117ab4d8dcf486"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 771a7e9b688cbb47-FRA
access-control-allow-headers: SDK-Version
expires: Tue, 29 Nov 2022 11:00:08 GMT

GET
H2 200 prebid7.17.0.js Show response
get.optad360.io/sf/ 492 KB
155 KB 25ms
9ms Script
application/javascript 2600:9000:225e:8800:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid7.17.0.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/8b2de328-d178-47b2-bc5e-74cf6a08de97/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:8800:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 529d5a06e1e90ceadfad7e6c2eaed6e9b868a35798345d5431c90f6024f15b55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 08:55:17 GMT
content-encoding: gzip
via: 1.1 8b360b28aeb67c1982fcc466a05eef02.cloudfront.net (CloudFront)
last-modified: Mon, 03 Oct 2022 06:53:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 4928692
etag: W/"840fa482840c0b1f014b3c14f6e0ab2e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=360000000
x-amz-cf-id: mxjn8v4mP9jMdNQ31B-5jiehJUfRkwXE6279h_29U-PBMkNbWNbPqg==

GET
H3 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 67ms
39ms XHR
application/json 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83c45d2a8b0133c0c10802abb2510b8ee51f1bb2a745288a1944af4f9a508fda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 25143
x-jsd-version: 1.0.1538
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4526-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66a-zSB71lydrnWHanna+LyL9m8KH40"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hdcdR26o8Jj9NvnINo0DKHMUScvb4mS2Gb%2FUnztncwppUqsZhHQvhZ%2F9Arg12rfrUaivyFCOi2LsgYHQ2Dpd%2BSO51SRnGXZAz5yks0JfyLk5%2F980srFJFEbj0fXou1K7HWQ7P3HMxFBVpoe%2FEZI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 771a7e9c2fea90d4-FRA

GET
H2 200 xtb.min.js Show response
cdn.exitbee.com/ 58 KB
21 KB 86ms
31ms Script
application/javascript 2606:4700:3036::6815:3242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.exitbee.com/xtb.min.js
Requested by: Host: aghtag.tech
URL: https://aghtag.tech/libs/projectagora.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:3242 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd3526ddba0514315d1dfabd7413c70fa2295b04c7c2b7764c7117803af3ea58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1995
x-guploader-uploadid: ADPycdsHDf1YccZM5hNAqA15_5c5V6deLXMROV7Flf7nRotHvSAaHWMTxQ2fzx0IlPjmMqVt2JaFK60OSWD0RJvxOkr-y340awfX
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 19 Oct 2022 12:26:43 GMT
server: cloudflare
etag: W/"903b1d44ea177befd6f3c248cf8208fd"
vary: Accept-Encoding
x-goog-hash: crc32c=iVmvWg==, md5=kDsdROoXe+/W88JIz4II/Q==
x-goog-generation: 1666182403691268
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zUyHIecSwnwBCPgQBjSdjn4exWWg9k17nvmNoSgz9UjKxLlquAOOrh04Jodt%2BrqOyLzSqyME4qIk9PF6kYhn3KkX7t5BsjCJtUDIAMeu%2BgdIOqFT0TddTO7KNXCwUKBp%2B6wGaiQPhiPgYhRePfw%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 59559
cf-ray: 771a7e9c584090ec-FRA
expires: Tue, 29 Nov 2022 10:09:25 GMT

GET
H2 200 formats.js Show response
ad.lkqd.net/vpaid/ Frame A696 118 KB
35 KB 79ms
17ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/vpaid/formats.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 7cfe458faed6fe5c3094bd51f1f10174604be983739ade9d828b0aad190043e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: gzip
last-modified: Fri, 11 Dec 2020 00:09:23 GMT
etag: "286704660baa2c113268f28385080796"
x-hw: 1669716008.cds297.am5.hn,1669716008.cds264.am5.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1209600
accept-ranges: bytes
content-length: 35765

GET
H2 200 formats.js Show response
ad.lkqd.net/vpaid/ Frame D325 118 KB
35 KB 77ms
33ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/vpaid/formats.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 7cfe458faed6fe5c3094bd51f1f10174604be983739ade9d828b0aad190043e5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: gzip
last-modified: Fri, 11 Dec 2020 00:09:23 GMT
etag: "286704660baa2c113268f28385080796"
x-hw: 1669716008.cds297.am5.hn,1669716008.cds264.am5.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1209600
accept-ranges: bytes
content-length: 35765

GET
H/1.1 200
OK auto-user-sync
ads.stickyadstv.com/ 43 B
541 B 281ms
18ms Image
image/gif 2.21.20.202
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/auto-user-sync
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.20.202 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-21-20-202.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:08 GMT
Server: nginx
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
x-sticky-vk: 1669716008589039-332
Expires: Tue, 29 Nov 2022 10:00:08 GMT

POST
H3 200 771a7e95dbf591e9 Show response
www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 1082 2 B
676 B 42ms
41ms XHR
text/plain 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/cv/result/771a7e95dbf591e9
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1669708800
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z9s9TCMSymXjOEDRitf64T8a13T71MSuiRbCv4cH754GgfOUs4tTIDWpemHH8pZNIkkhJWCTL%2Bm%2FPFwQz1MoPo0kCuCQ7E3qWtTPJMimUE6kglLuPIvI67jYKZqK4sNj9QQQTjuTBUTj66%2F4a8YLxblq"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 771a7e9e6c809223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H2 204 collect
region1.google-analytics.com/g/ 0
351 B 112ms
37ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-G4EQ7NKTZM&gtm=2oeb90&_p=606078623&cid=1219796233.1669716008&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1669716008&sct=1&seg=0&dl=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A%3A%20%D9%82%D8%B5%D9%81%20%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A%20%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE%20%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1%20%D8%B9%D9%84%D9%89%20%D8%AF%D9%88%D9%86%D9%8A%D8%AA%D8%B3%D9%83%20%7C%20LebanonFiles&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G4EQ7NKTZM&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
443 B 78ms
34ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-60620050-1&cid=1219796233.1669716008&jid=928871907&gjid=846782786&_gid=874002939.1669716008&_u=YEBAAUAAAAAAAC~&z=1834271696

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-content/cache/busting/google-tracking/ga-d40531c5e99a6f84e42535859476fe35.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 29 Nov 2022 10:00:08 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 5a6d3ecb-71cc-4b4b-8d58-8b2506cf93d5
https://www.lebanonfiles.com/ 0
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.lebanonfiles.com/5a6d3ecb-71cc-4b4b-8d58-8b2506cf93d5
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Length: 0
Content-Type: text/javascript

GET
BLOB 200
OK 521fe104-3c04-4a71-84da-ae3fcb535ca0
https://www.lebanonfiles.com/ 250 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.lebanonfiles.com/521fe104-3c04-4a71-84da-ae3fcb535ca0
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e37071398d21f18dff2370ee0885f38811bb69bb465b398100ab3101fc521d6b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Length: 250
Content-Type: text/javascript

GET
H3 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 37ms
37ms XHR
application/json 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221129

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83c45d2a8b0133c0c10802abb2510b8ee51f1bb2a745288a1944af4f9a508fda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 25143
x-jsd-version: 1.0.1538
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4526-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66a-zSB71lydrnWHanna+LyL9m8KH40"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mVpQH4m8h9Z6Ra55NOBUC3zb12mualN3ie8eaSeGorlrVLNGv9WyxyP9I0sFR%2B%2B2SKHt%2F1GqsAV7lEfm6ZK9MT7AOUffNZUBXIKjFpIDM%2F9sfJmFDN5dkgwh1ozqacKcWpEMyWt8m3%2BP34O87gE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 771a7e9f3e8c90d4-FRA

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 399 B
703 B 152ms
51ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.lebanonfiles.com&callback=_gfp_s_&client=ca-pub-8745593945608202&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-8745593945608202&plah=www.lebanonfiles.com&bust=31070969

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07ae4ea39bbfb906d5f136464337ea38c11d67a5562bd106d8a519776d6ebb6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 163ms
52ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 140ms
50ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 76ms
72ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tn=HEADER&id=masthead&cls=site-header&ign=false&pw=1600&ph=1200&x=0&y=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5B64 96 KB
34 KB 674ms
594ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8745593945608202&output=html&adk=1812271804&adf=3025194257&lmt=1669716008&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669716008059&bpp=4&bdt=461&idt=799&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6088149852364&frm=20&pv=2&ga_vid=1219796233.1669716008&ga_sid=1669716009&ga_hid=606078623&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531705%2C44769306%2C31070969&oid=2&pvsid=242515980550670&tmod=1682384177&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=846

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15b68dd3f30f8a18e07cf57d86e0527bdf0a20c69152030fdc6520ada299baf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 35102
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Tue, 29 Nov 2022 10:00:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

HEAD adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 0
0

POST
H3 200 settings Show response
s.exitbee.com/7992/ 0
791 B 216ms
204ms XHR
text/plain 2606:4700:3036::6815:3242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s.exitbee.com/7992/settings

Requested by

Host: cdn.exitbee.com
URL: https://cdn.exitbee.com/xtb.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:3242 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
xtb-visit-duration: 120
xtb-eb-response: 21
xtb-country: Germany
xtb-visit-id: 6c49ad27-3d3c-4f55-a8d5-e38d0983c143
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
xtb-zip-code: 60326
server: cloudflare
xtb-city: Frankfurt am Main
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b9ibZLCmtrLZTehti%2BYo%2F7A2ya%2BkWt4Cdk%2Fll%2Fv9hKATRROMr40vUWN1dw6TJHBJhrv6wPFx3ICBgrDGQOf8rSgg4cOGG7qkbeaBvs%2BU4OP%2BGdrZXUg7CvqXMPrKBGHMhgkIJ6LnT5yQJxuu"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://www.lebanonfiles.com
access-control-expose-headers: Xtb-Vid, Xtb-Visit-Id, Xtb-Visit-Duration, Xtb-Country, Xtb-City, Xtb-Zip-Code, Xtb-Pageviewid, Xtb-eb-response
xtb-pageviewid: c16a7c06-7a76-48ae-adb8-d3df9dd915ac
access-control-allow-credentials: false
cf-ray: 771a7ea0c957909a-FRA
xtb-vid: d8abe493-b379-4d1e-81f1-8284df64a3b5

OPTIONS
H2 200 settings
s.exitbee.com/7992/ Frame 0
0 117ms
66ms Preflight 2606:4700:3036::6815:3242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://s.exitbee.com/7992/settings

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::6815:3242 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: false
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.lebanonfiles.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 771a7ea049cd9104-FRA
content-length: 0
date: Tue, 29 Nov 2022 10:00:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2F%2FI3KytS32YhA6CfEsBRHkFYjdM7YpW9UAScjGQdLF7QJgjbhW2IJSC5nXH0D%2FWviOn23Mdi%2FevppGkMA3XOEguQnv%2FXowxNKdmveAKz3Kww0hyZk38bBcMFKzlgxoR3jwPcuylNf9QeYJX"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15724800; includeSubDomains

GET
H2 200 usync.html Show response
ad.lkqd.net/cookie-sync/ Frame 74CA 4 KB
2 KB 17ms
16ms Document
text/html 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/cookie-sync/usync.html
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: a09fb04841151074c73e8daf6edb12da7ffd8b5e7812492a6d9f3ae977fe3d31

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 1882
content-type: text/html
date: Tue, 29 Nov 2022 10:00:08 GMT
etag: "952dcfd8e3703b5a7e78418d51009535"
last-modified: Fri, 18 Feb 2022 17:38:44 GMT
x-hw: 1669716008.cds297.am5.hn,1669716008.cds313.am5.c

GET ad
v.lkqd.net/ Frame A696 0
0

GET
H2 200 usync.html Show response
ad.lkqd.net/cookie-sync/ Frame F7DC 4 KB
2 KB 19ms
18ms Document
text/html 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.lkqd.net/cookie-sync/usync.html
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: a09fb04841151074c73e8daf6edb12da7ffd8b5e7812492a6d9f3ae977fe3d31

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 1882
content-type: text/html
date: Tue, 29 Nov 2022 10:00:09 GMT
etag: "952dcfd8e3703b5a7e78418d51009535"
last-modified: Fri, 18 Feb 2022 17:38:44 GMT
x-hw: 1669716009.cds297.am5.hn,1669716009.cds313.am5.c

GET ad
v.lkqd.net/ Frame D325 0
0

GET
H2

200

cs
cs.lkqd.net/ Frame 74CA
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D54%26partnerUserId%3D%7Bdevice_id%7D
https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131

43 B
308 B

165ms
94ms

Image
image/gif

146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

location: https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131
date: Tue, 29 Nov 2022 10:00:09 GMT
server: _
content-length: 0

GET
H2 200 cs
cs.lkqd.net/ Frame 74CA 43 B
309 B 323ms
93ms Image
image/gif 146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=103&redirect=https%3A%2F%2Fevent.clientgear.com%2Fcookie%2Flkqd%3Fpartner%3Dlkqd%26cookieid%3D%24%24rawlkqduserid%24%24&r=if
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

GET
H2 200 cs
cs.lkqd.net/ Frame 74CA 43 B
308 B 323ms
93ms Image
image/gif 146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=102&redirect=https%3A%2F%2Fcs.krushmedia.com%2Fcd607442bfdf172cfcec45014a5f4ece.gif%3Fpuid%3D%24%24rawlkqduserid%24%24%26redir%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D102%2526partnerUserId%253D%255BUID%255D&r=if
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

GET
H2

200

cs
cs.lkqd.net/ Frame 74CA
Redirect Chain

https://ad.turn.com/r/cs?pid=65
https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7264211468766995553

43 B
308 B

104ms
94ms

Image
image/gif

146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7264211468766995553
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

location: https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7264211468766995553
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:08 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

cs
cs.lkqd.net/ Frame 74CA
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=161
https://cs.lkqd.net/cs?partnerId=93&partnerUserId=ipt5K85ZROx8MSoxVcoLxbnVm6Y

43 B
308 B

93ms
92ms

Image
image/gif

146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=93&partnerUserId=ipt5K85ZROx8MSoxVcoLxbnVm6Y
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

Location: https://cs.lkqd.net/cs?partnerId=93&partnerUserId=ipt5K85ZROx8MSoxVcoLxbnVm6Y
Date: Tue, 29 Nov 2022 10:00:09 GMT
Connection: keep-alive
Content-Length: 104
Content-Type: text/html; charset=utf-8

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 2 KB
2 KB 94ms
54ms XHR
application/json 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

20f82b3882b4224c211c5e77dbbb208645631a4b313b02b0c2595990192f81fa

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 29 Nov 2022 10:00:09 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 06511018-19b4-4dec-88fa-b7bd4fd815cf
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 367 B
1 KB 91ms
50ms XHR
application/json 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b30280d572fa3a93c2f973ade19f784b419320bd05cff3053488076005669317

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:09 GMT
AN-X-Request-Uuid: 73f7fe68-941a-40eb-8739-94b90b970963
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 367
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 / Show response
hb.emxdgt.com/ 0
163 B 103ms
13ms XHR
text/plain 52.29.105.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.emxdgt.com/?t=1200&ts=1669716009123&src=pbjs
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.105.140 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-105-140.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:09 GMT
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: security, Content-Type

GET
H2 200 / Show response
adx.adform.net/adx/ 90 B
493 B 192ms
76ms XHR
application/json 37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/?rp=4&bWlkPTkyMzU0NiZ0cmFuc2FjdGlvbklkPTIxMTI5ZTM5LTNmMGItNDJiMi05M2NkLWY1MzQ5NzljODJiMyZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1NiZ0cmFuc2FjdGlvbklkPTYyMWY5MmVjLWE0MzYtNGQ3Mi05MTM0LTYxZWFmNWMwNzA0YiZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1NyZ0cmFuc2FjdGlvbklkPTYyMWY5MmVjLWE0MzYtNGQ3Mi05MTM0LTYxZWFmNWMwNzA0YiZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1OCZ0cmFuc2FjdGlvbklkPTYyMWY5MmVjLWE0MzYtNGQ3Mi05MTM0LTYxZWFmNWMwNzA0YiZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ3OCZ0cmFuc2FjdGlvbklkPTY1NDViZDhlLWRlOWYtNDUzNC1hZmVjLWU2YzU0MDIyZjUxMiZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ4MSZ0cmFuc2FjdGlvbklkPTcwZmUxY2NiLWYwNmItNDJiMC1iNThjLWE0ZTMwZDRjZWMyMSZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ4MiZ0cmFuc2FjdGlvbklkPTcwZmUxY2NiLWYwNmItNDJiMC1iNThjLWE0ZTMwZDRjZWMyMSZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1MyZ0cmFuc2FjdGlvbklkPTJmOGI3MzRjLWQ0ZDQtNDc5NC1iNzQ3LWE3YjU2YjZlM2ViNSZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1NCZ0cmFuc2FjdGlvbklkPTJmOGI3MzRjLWQ0ZDQtNDc5NC1iNzQ3LWE3YjU2YjZlM2ViNSZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1NSZ0cmFuc2FjdGlvbklkPTJmOGI3MzRjLWQ0ZDQtNDc5NC1iNzQ3LWE3YjU2YjZlM2ViNSZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ3NyZ0cmFuc2FjdGlvbklkPTI3NWIwOTIzLTcyNWEtNDBkZi1hNjFkLTI5OWUzMjM4NDc1YiZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ3NiZ0cmFuc2FjdGlvbklkPTEyZjg5NDAxLTY2MjItNDMyYS04ZjhmLThkNmYxZjk3OWZiZCZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU0OSZ0cmFuc2FjdGlvbklkPWY4Y2YzNGYxLTQ0YzgtNDFhMC1hNWJmLTZlN2E5NDg2YzcwMyZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1MSZ0cmFuc2FjdGlvbklkPWY4Y2YzNGYxLTQ0YzgtNDFhMC1hNWJmLTZlN2E5NDg2YzcwMyZyY3VyPVVTRA%3D%3D&bWlkPTkyMzU1MiZ0cmFuc2FjdGlvbklkPWY4Y2YzNGYxLTQ0YzgtNDFhMC1hNWJmLTZlN2E5NDg2YzcwMyZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ3NSZ0cmFuc2FjdGlvbklkPTEyNDM2MmE5LTM0YWQtNGFkYi05MTVmLTRmM2VlMDc1MWExMiZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ3OSZ0cmFuc2FjdGlvbklkPTJlM2U3YmZlLTY1ZDYtNGNmMy04YTRhLTE2ZmNhOGNiNWNjMCZyY3VyPVVTRA%3D%3D&bWlkPTkyMzQ4MCZ0cmFuc2FjdGlvbklkPTJlM2U3YmZlLTY1ZDYtNGNmMy04YTRhLTE2ZmNhOGNiNWNjMCZyY3VyPVVTRA%3D%3D&pt=gross&stid=f3f04b2f-b842-4c98-8762-fc6cbe2f553f&fd=1&eids=eyJwdWJjaWQub3JnIjp7IjI4YjY2ZWIyLTFlZDAtNGJjNS1iY2NiLTM3ODA2MTg5NzNjMiI6WzFdfX0%3D

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

04db1928cac9786ab103fd8921943f73e1e58330f9894c7b908cb9d6b962da4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
content-type: application/json
access-control-allow-origin: https://www.lebanonfiles.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-max-age: 86400
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

GET
H2 200 arj Show response
adsparc-d.openx.net/w/1.0/ 73 B
382 B 125ms
46ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://adsparc-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=21129e39-3f0b-42b2-93cd-f534979c82b3%2C621f92ec-a436-4d72-9134-61eaf5c0704b%2C6545bd8e-de9f-4534-afec-e6c54022f512%2C70fe1ccb-f06b-42b0-b58c-a4e30d4cec21%2C2f8b734c-d4d4-4794-b747-a7b56b6e3eb5%2C275b0923-725a-40df-a61d-299e3238475b%2C12f89401-6622-432a-8f8f-8d6f1f979fbd%2Cf8cf34f1-44c8-41a0-a5bf-6e7a9486c703%2C124362a9-34ad-4adb-915f-4f3ee0751a12%2C2e3e7bfe-65d6-4cf3-8a4a-16fca8cb5cc0&nocache=1669716009128&pubcid=28b66eb2-1ed0-4bc5-bccb-3780618973c2&aus=728x90%7C728x90%2C970x90%2C970x250%7C300x600%7C300x250%2C300x600%7C728x90%2C970x90%2C970x250%7C300x600%7C300x250%7C728x90%2C970x90%2C970x250%7C300x250%7C300x250%2C300x600&divIds=LFiles_728x90(1)%2CLFiles_728x90_970x90_970x250(4)%2CLFiles_300x600(2)%2CLFiles_300x600_300x250(2)%2CLFiles_728x90_970x90_970x250(3)%2CLFiles_300x600(1)%2CLFiles_300x250(2)%2CLFiles_728x90_970x90_970x250(2)%2CLFiles_300x250(1)%2CLFiles_300x600_300x250&auid=543842992%2C543843004%2C543842998%2C543843007%2C543843000%2C543842994%2C543842991%2C543842996%2C543842987%2C543843003
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 6164c6e66717c5b7e271bbf5e62882002dbea807c0374444edf5e5411d42c4a5

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 invisible.js Show response
www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 1082 31 KB
13 KB 20ms
20ms Script
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1669708800
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b3d903ea1db70be9ab93f7e6e8430315641a5aa3ab0949f8c715765a96a5ea2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TW2I4BfRtz9Yvlh8HJWSPlOfslnEmKPBccs1C%2BmbhuB5TuLAZoU7JlkdjRVehrgwI1CzrDiZD28xNMgWDurRclmEOdOQohZ2CpRyke2Qj3dnUZXZJekmGnFnBpL30H1dpfRzWP%2Ffp%2Blpe8iUmgEH5%2B3q"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 771a7ea118dd9223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 85ms
84ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1e0930db90ea729a33b0899c8f321a9b4ddd27e68464c277e94c872041cfbaeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11084
x-xss-protection: 0

GET
H2

200

sium
ih.adscale.de/adscale-ih/
Redirect Chain

https://x.bidswitch.net/sync?ssp=vidoomy&user_id=709324198.69833361370811764.98181236
https://x.bidswitch.net/ul_cb/sync?ssp=vidoomy&user_id=709324198.69833361370811764.98181236
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=vidoomy&ssp_user_id=cee4ed4f-9f95-473b-a9d7-9b81db31a389&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=171315692&expires=5
https://ih.adscale.de/adscale-ih/sium?tpid=57&tpuid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&gdpr=&gdpr_consent=

49 B
361 B

177ms
8ms

Image
image/gif

54.93.142.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih.adscale.de/adscale-ih/sium?tpid=57&tpuid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&gdpr=&gdpr_consent=
Protocol: H2
Server: 54.93.142.150 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-93-142-150.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 68986dd8f1ef6b05cbc0a2f532b87ea2f93ebe9ccd06f8265b15044dd1f4ab17

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

p3p: CP=NOI PSA OUR
date: Tue, 29 Nov 2022 10:00:09 GMT
content-length: 49
content-type: image/gif

Redirect headers

location: //ih.adscale.de/adscale-ih/sium?tpid=57&tpuid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&gdpr=&gdpr_consent=
date: Tue, 29 Nov 2022 10:00:09 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

cookie
a.vidoomy.com/api/rtbserver/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58610/occ
https://ups.analytics.yahoo.com/ups/58610/occ?verify=true
https://a.vidoomy.com/api/rtbserver/cookie?i=YAH&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A

43 B
357 B

112ms
8ms

Image
image/gif

18.184.201.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.vidoomy.com/api/rtbserver/cookie?i=YAH&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A
Protocol: H2
Server: 18.184.201.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-201-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: none
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 43

Redirect headers

location: https://a.vidoomy.com/api/rtbserver/cookie?i=YAH&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A
date: Tue, 29 Nov 2022 10:00:09 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 imp.js Show response
fd.tesseradigital.com/ 0
196 B 166ms
16ms Script
text/html 18.196.91.239
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fd.tesseradigital.com/imp.js?_pid=163594704&_ouuid=WME0Ljwlsmhq4SxLCrWdBjYzrr1a26wVc3BouhDWEJnI&_oprio=0&_oref=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F
Requested by: Host: tpx.tesseradigital.com
URL: https://tpx.tesseradigital.com/dist/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.196.91.239 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-91-239.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:59:57 GMT
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
last-modified: Tuesday, 29-Nov-2022 09:59:57 GMT
server: nginx
etag: "da39a3ee5e6b4b0d3255bfef95601890afd80709"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3 200 sdk.js Show response
connect.facebook.net/ar_AR/ 302 KB
85 KB 18ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/ar_AR/sdk.js?hash=5958544c1f05a0e0f3c7b1e9dfbb5b3e

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/ar_AR/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ed73684fdc79f5019a8f5f79d8665673dd7a6bd3d42971cbe7758fdb558aa099

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 29 Nov 2022 10:00:09 GMT
content-md5: W9RYTD0Y/dmEwtN8JXz//w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 87142
x-fb-rlafr: 0
x-fb-debug: SQ3Yh3HlrQu5W9QfmCT33C6IASPjT5AM+PsPIF0fT929PgaIw7s18173Qtjau6hMoK+cEEQ3DHUQtKU5J80VNQ==
x-fb-content-md5: a47f7dfae868aac9980bb27935f99a1f
cross-origin-opener-policy: same-origin-allow-popups
etag: "96ac5271f9d3a5631849f19d5039da3e"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 29 Nov 2023 08:40:32 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/Km9gKuG06He-isPsP6saG8cn/ 402 KB
162 KB 127ms
37ms Script
text/javascript 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/Km9gKuG06He-isPsP6saG8cn/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=renderInvisibleReCaptcha&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5773240cdcd07b20f60e178a5d1bdbec55783aba224236be6a40429d1cf44998

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:17:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2573
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 164812
x-xss-protection: 0
last-modified: Mon, 14 Nov 2022 03:01:59 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 29 Nov 2023 09:17:16 GMT

GET
H3 200 admin-ajax.php Show response
www.lebanonfiles.com/wp-admin/ 28 B
647 B 125ms
124ms XHR
text/html 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.lebanonfiles.com/wp-admin/admin-ajax.php?action=get_breaking_news&nonce=5cad3a3295

Requested by

Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

772b6412479aaa7d946a63e7cf3780cd3fcf40efb90ea3154ff2bacd2b01f3cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cf-powered-by: WP Rocket 3.4.4
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uVYGB0Hp6lMhUDX1sg3OZEQL41yfS8fQdCZhDLK%2FFW207K86z10xpiN12pawi3aczrfDC0X2INQbv6vuQG9pF1gyFN4skKMDHZIbP7qmSN4hF%2BYEiWa04%2Byxew25D02uMTvdP%2BKctuGsA6Ji5ecklRnn"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, must-revalidate, max-age=0
x-robots-tag: noindex
cf-ray: 771a7ea1897f9223-FRA
itw-cache: BYPASS
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H3 204 rum Show response
www.lebanonfiles.com/cdn-cgi/ 0
145 B 22ms
15ms XHR
text/plain 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.lebanonfiles.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
content-type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.lebanonfiles.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 771a7ea1a9ad9223-FRA

GET
H2

200

cs
cs.lkqd.net/ Frame F7DC
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fcs.lkqd.net%2Fcs%3FpartnerId%3D54%26partnerUserId%3D%7Bdevice_id%7D
https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131

43 B
308 B

101ms
95ms

Image
image/gif

146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

location: https://cs.lkqd.net/cs?partnerId=54&partnerUserId=ef3ad599-7afb-456a-acd1-dd01053ed131
date: Tue, 29 Nov 2022 10:00:09 GMT
server: _
content-length: 0

GET
H2 200 cs
cs.lkqd.net/ Frame F7DC 43 B
308 B 146ms
95ms Image
image/gif 146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=103&redirect=https%3A%2F%2Fevent.clientgear.com%2Fcookie%2Flkqd%3Fpartner%3Dlkqd%26cookieid%3D%24%24rawlkqduserid%24%24&r=if
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

GET
H2 200 cs
cs.lkqd.net/ Frame F7DC 43 B
308 B 145ms
94ms Image
image/gif 146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=102&redirect=https%3A%2F%2Fcs.krushmedia.com%2Fcd607442bfdf172cfcec45014a5f4ece.gif%3Fpuid%3D%24%24rawlkqduserid%24%24%26redir%3Dhttps%253A%252F%252Fcs.lkqd.net%252Fcs%253FpartnerId%253D102%2526partnerUserId%253D%255BUID%255D&r=if
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

GET
H2

200

cs
cs.lkqd.net/ Frame F7DC
Redirect Chain

https://ad.turn.com/r/cs?pid=65
https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7480102775904068705

43 B
308 B

111ms
104ms

Image
image/gif

146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7480102775904068705
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

location: https://cs.lkqd.net/cs?partnerId=94&partnerUserId=7480102775904068705
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:08 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

cs
cs.lkqd.net/ Frame F7DC
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=161
https://cs.lkqd.net/cs?partnerId=93&partnerUserId=qV2zhX0vR-dvM30ptMSHH7nVm6Y

43 B
308 B

94ms
91ms

Image
image/gif

146.20.132.162
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.lkqd.net/cs?partnerId=93&partnerUserId=qV2zhX0vR-dvM30ptMSHH7nVm6Y
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/cookie-sync/usync.html
Protocol: H2
Server: 146.20.132.162 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.lkqd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
server: nginx
access-control-max-age: 0
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Content-Disposition
cache-control: max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 43

Redirect headers

Location: https://cs.lkqd.net/cs?partnerId=93&partnerUserId=qV2zhX0vR-dvM30ptMSHH7nVm6Y
Date: Tue, 29 Nov 2022 10:00:09 GMT
Connection: keep-alive
Content-Length: 104
Content-Type: text/html; charset=utf-8

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 189ms
81ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:09 GMT

GET
H2 204 incoming
tpx.tesseradigital.com/ 0
77 B 7ms
7ms Image
text/plain 35.157.179.180
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpx.tesseradigital.com/incoming?p=false&a=false&b=false
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.157.179.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-179-180.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
last-modified: Tuesday, 29-Nov-2022 10:00:09 GMT
server: nginx

GET
H3 200 pica.js
www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 1082 20 KB
9 KB 32ms
15ms Other
application/javascript 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51e6533f42c95ad48ac515ab52bbcd7640b1afc249dd28f2e539adb45c481f7f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2BHJSPVLmPnSdQv2N%2BRvTFAX1zR2wwdXk69GlT%2FjPBcdr%2BQma32qrnJrV4W7RPt%2BcChN%2BiEdHCr0KA5M5kN%2BuIMP8OR37PzPge8s%2Bn80w%2BqFT8EvJA74xfZa2PRtXyq%2FHYt1VfLJDhDUvC68A0ddXvLy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
x-control-type-options: nosniff
cf-ray: 771a7ea25aa59223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 150ms
52ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 149ms
52ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 370 KB
74 KB 856ms
856ms XHR
text/plain 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=242515980550670&correlator=1416701363251131&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=21894097782%2CLFiles_1x1%2CLFiles_728x90(1)%2CLFiles_728x90_970x90_970x250(4)%2CLFiles_320x50_320x100(3)%2CLFiles_300x600(2)%2CLFiles_300x600_300x250(2)%2CLFiles_728x90_970x90_970x250(3)%2CLFiles_300x600(1)%2CLFiles_300x250(2)%2CLFiles_728x90_970x90_970x250(2)%2CLFiles_320x50_320x100(2)%2CLFiles_320x50_320x100(1)%2CLFiles_300x250(1)%2CLFiles_300x600_300x250&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9%2C%2F0%2F10%2C%2F0%2F11%2C%2F0%2F12%2C%2F0%2F13%2C%2F0%2F14&prev_iu_szs=1x1%2C728x90%2C728x90%7C970x90%7C970x250%2C300x250%2C300x600%2C300x250%7C300x600%2C728x90%7C970x90%7C970x250%2C300x600%2C300x250%2C728x90%7C970x90%7C970x250%2C300x250%2C300x250%2C300x250%2C300x250%7C300x600&ifi=2&adks=1850051439%2C3611282516%2C3237839583%2C2677343658%2C2205192521%2C4179594712%2C3352391512%2C2291320453%2C539932965%2C2342546863%2C348188995%2C85745273%2C924770649%2C3939129125&didk=953092430~3641825082~2120025922~470097312~972599023~209599808~2120025891~972598990~2938743786~2120022019~470097283~470097250~2938743755~4106390875&sfv=1-0-40&prev_scp=floors_hour%3D10%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775%7Cfloors_id%3Db9ab1f%26floors_hour%3D10%26floors_noresponse%3Dyes%26floors_responsetime%3D775&eri=1&sc=1&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&abxe=1&dt=1669716009369&lmt=1669716009&dlt=1669716007598&idt=1152&adxs=1599%2C290%2C-9%2C-9%2C-9%2C1185%2C-9%2C-12245933%2C135%2C757%2C-9%2C-12245933%2C825%2C-9&adys=180%2C10%2C-9%2C-9%2C-9%2C1052%2C-9%2C-12245933%2C1045%2C340%2C-9%2C-12245933%2C1072%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C-1%7C-1%7C-1%7C0%7C-1%7C-1%7C0%7C0%7C-1%7C-1%7C0%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&frm=20&vis=1&psz=1600x2510%7C903x-1%7C0x-1%7C0x-1%7C0x-1%7C320x0%7C0x-1%7C0x0%7C320x250%7C1370x0%7C0x-1%7C0x0%7C650x250%7C0x-1&msz=1x-1%7C903x-1%7C0x-1%7C0x-1%7C0x-1%7C320x0%7C0x-1%7C0x0%7C300x-1%7C1370x0%7C0x-1%7C0x0%7C300x-1%7C0x-1&fws=4%2C516%2C2%2C2%2C2%2C4%2C2%2C132%2C4%2C4%2C2%2C132%2C4%2C2&ohw=1600%2C1600%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1600%2C1600%2C0%2C1600%2C1600%2C0&ga_vid=1219796233.1669716008&ga_sid=1669716009&ga_hid=606078623&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d63e6090c2491f83f73d1ac8079e2c5a4c9e0989610be7ddea0e9e9446437a7d

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLeM_-yQ0_sCFSEL0wodIK8JEQ&gqi=&layout=/sadbundle/%24csp%253Der3%24/12231767363623583744/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLeM_-yQ0_sCFSEL0wodIK8JEQ&gqi=&layout=/sadbundle/%24csp%253Der3%24/12231767363623583744/index.html
date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
content-encoding: br
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75283
x-xss-protection: 0
google-lineitem-id: 5507213652,-1,6012624441,5436026142,-1,-1,-1,6012624441,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138381865323,-1,138392780829,138318435918,-1,-1,-1,138393259624,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 841E 6 KB
3 KB 259ms
45ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 comments.php
www.facebook.com/v7.0/plugins/ Frame DFEE 0
0 69ms
33ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v7.0/plugins/comments.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df384c294002167c%26domain%3Dwww.lebanonfiles.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.lebanonfiles.com%252Ff222ed8109afb%26relation%3Dparent.parent&container_width=650&height=100&href=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25d8%25a3%25d8%25ae%25d8%25a8%25d8%25a7%25d8%25b1-%25d8%25a7%25d9%2584%25d8%25b3%25d8%25a7%25d8%25b9%25d8%25a9%2F%25d9%2586%25d9%2588%25d9%2581%25d9%2588%25d8%25b3%25d8%25aa%25d9%258a-%25d9%2582%25d8%25b5%25d9%2581-%25d8%25a3%25d9%2588%25d9%2583%25d8%25b1%25d8%25a7%25d9%2586%25d9%258a-%25d8%25a8%25d8%25b5%25d9%2588%25d8%25a7%25d8%25b1%25d9%258a%25d8%25ae-%25d9%2583%25d8%25a7%25d9%2584%25d9%258a%25d8%25a8%25d8%25b1-%25d8%25b9%25d9%2584%2F&locale=ar_AR&sdk=joey&version=v7.0&width=

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/ar_AR/sdk.js?hash=5958544c1f05a0e0f3c7b1e9dfbb5b3e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: sAz9eRdAeCCupmqwuHV7ne+KjemfoBhqlX+76rBYsK9rfhfk1+SXEi5iCMPdTFtFiSohyzPUmJZmEOa/9zLSJg==
x-frame-options: DENY
x-xss-protection: 0

GET
H2 200 init Show response
services.insurads.com/ 2 KB
1 KB 370ms
109ms Script
application/javascript 44.194.188.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://services.insurads.com/init?appId=RV0UR9OI&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tcfc=1&t=1669716009444
Requested by: Host: cdn.insurads.com
URL: https://cdn.insurads.com/bootstrap/RV0UR9OI.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.188.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-188-152.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: b4d8bbf857b8d21364af15f25ffb84713ed2febb5c2bc8edd797bcaf766cf4f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
content-type: application/javascript;charset=UTF-8
x-nocache: true
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6B31 13 KB
5 KB 205ms
40ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1364
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 09:37:25 GMT
expires: Wed, 29 Nov 2023 09:37:25 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B548 783 B
534 B 212ms
49ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ebe192b812f35e82067bbb9141f3d754522d6ac62690af3e38db7db6158a1f09

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ztO05SvDyeobvXdUgHrKUA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-ztO05SvDyeobvXdUgHrKUA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Tue, 29 Nov 2022 10:00:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 / Show response
c.mgid.com/pv/ 0
66 B 139ms
129ms Script
text/plain 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.mgid.com/pv/?pv=5&cbuster=166971600953271183802&uniqId=01a95&lct=1669161600&niet=4g&nisd=false&jsv=es6&ref=&cxurl=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9%2F%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84%2F&lu=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&sessionId=6385d82a-010b0&pageView=1&pvid=184c2d4623c92cd89a0&site=742725&implVersion=11&dpr=1&tfre=1934
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 771a7ea3af899bd4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

POST
H3 200 771a7e95dbf591e9 Show response
www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 1082 2 B
675 B 30ms
30ms XHR
text/plain 2606:4700:20::ac43:441e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/cv/result/771a7e95dbf591e9
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1669708800
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:441e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMZqIt8rf6hjIeID4CGugZnFb9xEaK3xAzG8i3CvdlUppRxhE1lfhs%2BmQepRph59kafzmWIXFbezaUUDq1iSk9Vuhn2PMaDgVt59%2BNNmKHvx2N4MMSDQnJR2Zx%2B5z9ARniyovGZYyMEDdYUjlJHnZvG0"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 771a7ea54ed59223-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
BLOB 206
Partial Content 6511071d-07d5-4b23-9486-76c1143c18ad
https://www.lebanonfiles.com/ 1 KB
0 Media
video/mp4

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.lebanonfiles.com/6511071d-07d5-4b23-9486-76c1143c18ad
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60ddc774c7b5fd0c01d169321a444da403d60c0042f6bee01b0c96f6e1535fda

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Range: bytes=0-

Response headers

Content-Range: bytes 0-1492/1493
Content-Length: 1493
Content-Type: video/mp4

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/ 150 KB
51 KB 71ms
71ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/reactive_library_fy2021.js?bust=31070969

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96334ea6768451dc852e52ef1eac1bf959b5089d305a5ef8bc604dc483c1327e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52286
x-xss-protection: 0
server: cafe
etag: 10910868282446407421
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 29 Nov 2022 10:00:09 GMT

GET
H2 200 iat-realtime-6.0.9-ws.js Show response
cdn.insurads.com/ 62 KB
16 KB 14ms
13ms Script
application/javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.insurads.com/iat-realtime-6.0.9-ws.js
Requested by: Host: services.insurads.com
URL: https://services.insurads.com/init?appId=RV0UR9OI&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tcfc=1&t=1669716009444
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, DE),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: e882f744f96b9b2e2a0716144d5a520e488cfac42e8fdb9b6f4b1e1ca9ee731d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
cdn-edgestorageid: 1055
x-amz-request-id: 25Q4NFTHW5326TWE
cdn-cachedat: 11/25/2022 20:24:04
cdn-pullzone: 55316
x-amz-id-2: LLXhxlgNgJ+VRHmW7a1zbfFpjdrRJp75AJfMy2kv+jLJlTAzE7sGi4lEgQuQ8xoZBa8wQTdWTCI=
last-modified: Wed, 28 Sep 2022 10:19:03 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: "6f232966890b855c7b43f3882612f397"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
cdn-uid: 56a941db-1de6-4dd7-bd60-f93546463707
cache-control: max-age=2592000
cdn-requestid: ae57c4f71acc448af6d229d558312814
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 iat-1.7.4.js Show response
cdn.insurads.com/ 109 KB
30 KB 22ms
21ms Script
application/javascript 2400:52e0:1e00::713:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.insurads.com/iat-1.7.4.js
Requested by: Host: services.insurads.com
URL: https://services.insurads.com/init?appId=RV0UR9OI&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tcfc=1&t=1669716009444
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, DE),
Reverse DNS
Software: BunnyCDN-DE1-713 /
Resource Hash: 5248234ea23913ee7398e91e1e60a037a940999dea0233b64b5a8ba8376107d5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
cdn-edgestorageid: 1055
x-amz-request-id: NP59SD3VHSXP6JAP
cdn-cachedat: 11/22/2022 15:39:52
cdn-pullzone: 55316
x-amz-id-2: 1Vk7G1PW7kWAte7xpcDU6C8Te8zRQem35yqqVS+wIA7Jn/kvMBt/9bjxEH16UxQJTM3Bfx0Ve6gvJRhdqdepFg==
last-modified: Tue, 22 Nov 2022 15:34:55 GMT
server: BunnyCDN-DE1-713
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: "198930073b0c681d1673217687c9852b"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
cdn-uid: 56a941db-1de6-4dd7-bd60-f93546463707
cache-control: max-age=2592000
cdn-requestid: fbbc06e1ef834597ec4c64fea9fdf0f7
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 initcb Show response
services.insurads.com/ 288 B
494 B 117ms
116ms Script
application/javascript 44.194.188.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://services.insurads.com/initcb?v=1.0.12&appId=2490&vId=D6F956D6FB437E6A&s=2910&fpc=1&nv=1&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tcfc=1&lts=0&ts=1669716009917&iatId=59f7d4c4e4733430134bb9c040a3508d&iatIdB=0e2318e9432f7c194778b2cbf212c62d&iatIdM=11111111&iatIdV=1.0&lIatId=0&lIatIdB=0&lIatIdM=0&lIatIdV=0&lch=MMBBRAIIAA
Requested by: Host: cdn.insurads.com
URL: https://cdn.insurads.com/bootstrap/RV0UR9OI.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.188.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-188-152.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f02a6eaae7dedd59a53440a87814f677d015928a5b80a0eefd34f2fdbb3ff706

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:09 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
content-type: application/javascript;charset=UTF-8
x-nocache: true
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B548 0
0 73ms
73ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=242515980550670&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6B31 36 KB
16 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H2 200 mgid_ua.svg
cdn.mgid.com/images/mgid/ 2 KB
1 KB 62ms
53ms Image
image/svg+xml 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/mgid/mgid_ua.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d5c4de881e718d0b7638959680ba86722d44eecbe4058d20dd77b8d0d97155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: BQQZ016TJQM3CQAQ
age: 5822
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: H0ihdhm/EJhbcC+homFO+mab68DYYvx/mk6E6cpnOvsu3WasxL/t0xcMLjTuGMaSc4h2RuXW7vE=
last-modified: Tue, 08 Mar 2022 17:05:01 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1646759091/ctime:1646759091/gid:0/gname:root/md5:617c205137825561208ef7c1a2d8f319/mode:33206/mtime:1646759091/uid:0/uname:root
etag: W/"617c205137825561208ef7c1a2d8f319"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 771a7ea63e1d9bd4-FRA
expires: Wed, 30 Nov 2022 10:00:09 GMT

GET
H2 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
885 B 37ms
28ms Image
image/svg+xml 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: BQQP2P0ZGAY0CMXJ
age: 301
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: Cxr/h9GEH2cm2grnKHiXrIw5MioqY/kDhHlX9SIKfHkMPhFjrTu42FaOoPgYIABs4KQfQTtjm/c=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 771a7ea63e189bd4-FRA
expires: Wed, 30 Nov 2022 10:00:09 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 47ms
47ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 54ms
44ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/ Frame 855F 10 KB
4 KB 38ms
37ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 83773
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 28 Nov 2022 10:43:57 GMT
etag: 10353107486223812946
expires: Mon, 12 Dec 2022 10:43:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 1 Show response
servicer.mgid.com/1189476/ 9 KB
3 KB 231ms
220ms Script
application/x-javascript 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://servicer.mgid.com/1189476/1?pv=5&cbuster=1669716010049778702040&uniqId=01a95&lct=1669161600&niet=4g&nisd=false&jsv=es6&mp4=1&ap=1&w=700&h=1305&maxw_3=226&maxh_3=199&cols=3&ref=&cxurl=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9%2F%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84%2F&lu=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&sessionId=6385d82a-010b0&pageView=1&pvid=184c2d4623c92cd89a0&implVersion=11&dpr=1&tfre=2451
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1763d3702e272f5c462d55d4c76d17a26cc714c46a6c89c7fa94462ce9086a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cf-ray: 771a7ea6efb79bd4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 855F 0
0 85ms
84ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CRFjLKdiFY8ynAZiClgTD2b7ABZ_XzcdtkdS1nu8Q6J_Bgao1EAEghujldWCV4pCCoAegAYmqy5sDyAECqQJGWo98-mixPqgDAcgDyQSqBOADT9BEDzDjA8cLOhYgRkYhfNPxg7C8L6rhHhDUjcKyO5gIURpoulQfAhZBPo-NR46tx3pZJxXHBxMC0J3mr79PzCDhgFMmGRZF2w8RZOdzdDNgntQaDBOs34I5DTLvbOhWOvsk1cIXV106rJlvU6MrzQep9CJf29ET3CcQpeRIrAG-ncXqOmQV0lBg8hTIzGjcODiFopLDRAHHqdBrHKshqLzjOiQTCwICyks9hlUQugKY8QCS6iWz0fw6u4ObN-w9aXTfYmHKzG3yWY263rHsRzwmQcJFCEQVBqdfyWef3fix18Dn8876FNAY98wVJAqYN58CfGd5w41zSs_ropNThboXQGzYP4hja-hagXoSn7GBZLtw_A5VCzzBTD8c-WCLGtsaoytVju-dNaVFZjK5TyYIqaU6r5sjbqMenrCdlpRioYiSLb_kXtvmB04RQjDF7fCDdSwEeiHAkpOVN2NBF41Dhph54MGGq2UOD95ykV8sU3DTfuDoycyyy6DgBfuDz1X6xy3kFyTKqw49_WjR6qLNnu8rnL22ilZD1fXwLSn0X00wgtmN6DAg-xPeHQBF50TfCz9QwcVLIs4PI3diZeOoPHiPIsJ4Ah9BqdFRRFfvfvcUVVx-Vyol6vE3uNygwATFl8DRlQSSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAHzoa0ZKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEI3gBNIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTg3NDU1OTM5NDU2MDgyMDIYAA&sigh=zNND8kPm6NQ&uach_m=[UACH]&cid=CAQSGwDq26N95mG6F8KYbs3--LM30HMNG5es_9HbZxgBIBM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 855F 23 KB
9 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61651edfb03aae1c1007d6741f98171447ae7b1a67aaa520d8b0a959e0400885

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:49:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 624
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9428
x-xss-protection: 0
server: cafe
etag: 246362764157784863
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:49:46 GMT

GET
H3 200 8396427603546959143
tpc.googlesyndication.com/daca_images/simgad/ Frame 855F 58 KB
58 KB 40ms
40ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/8396427603546959143

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c3add08adee1f3ee4511e281cd8cf9b6b58cce2b1373c1fa9a91c9bf52df764

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 20:57:16 GMT
x-content-type-options: nosniff
age: 46974
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59065
x-xss-protection: 0
last-modified: Fri, 18 Nov 2022 14:32:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 28 Nov 2023 20:57:16 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 855F 3 KB
1 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 855F 18 KB
7 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 855F 154 KB
48 KB 231ms
54ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 855F 34 KB
13 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac67eba217cc24846f0d650dbf24e7e1f96928839f20a70ddeba99bfa284ca23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 17:43:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13669
x-xss-protection: 0
server: cafe
etag: 7011066814545187240
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 17:43:01 GMT

POST
H3 400 events Show response
analytics.leya.tech/ 188 B
207 B 149ms
48ms XHR
application/xml 35.244.145.108
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.leya.tech/events
Requested by: Host: cdn.bidder.dev
URL: https://cdn.bidder.dev/clients/21894097782/lebanonfiles/sa-script.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.145.108 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 108.145.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 2e7b572fb8c157fa128e3ca13f7c7f904176c4f59b010a8e498af74cd5891103

Request headers

x-api-token: d72dc3aa-077f-4497-9920-7fc4a89fa510
Accept: application/json, text/plain, */*
Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
server: UploadServer
x-guploader-uploadid: ADPycdtHWXZyXIkCAeKO3haqM9IV3OsCQXrG-YUOP5eZqv3tzgcbo300Ei6uwD4AOLGYwG6nYe0-aOZZSZ5Z0gjDELv_4Q
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/xml; charset=UTF-8
access-control-allow-origin: https://www.lebanonfiles.com
access-control-allow-credentials: true
access-control-allow-headers: x-api-token,Content-Type,Authorization,Origin,X-Requested-With,Accept
content-length: 188
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 ad Show response
services.insurads.com/ Frame 1175 131 B
353 B 110ms
110ms Script
application/javascript 44.194.188.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://services.insurads.com/ad?auid=929906&csz=%5B%5D&sz=%5B%5D&appId=2490&s=2910&dm=1&is=0&ct=%7B%7D&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&sid=D6F956D6FB437E6A&v=1.7.4&ts=1669716010053
Requested by: Host: cdn.insurads.com
URL: https://cdn.insurads.com/iat-1.7.4.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.188.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-188-152.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 28a8d7620b771bed4ff999f0d2381bac0d64bc4470b8e736fb3f4a1b180ba91e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
content-type: application/javascript;charset=UTF-8
x-nocache: true
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 branding-ads.svg
optad360.mgr.consensu.org/icons/ 7 KB
3 KB 102ms
7ms Image
image/svg+xml 52.222.214.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://optad360.mgr.consensu.org/icons/branding-ads.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-126.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 20:55:50 GMT
content-encoding: gzip
via: 1.1 77ba839b79ec0a8b2031c8a828e7fdfa.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P3
age: 47061
etag: W/"b0a3aa2e09d4ddd83150d7bd3347c5c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
x-amz-cf-id: n8Scg8S_njXlVgxzyg0UDkDcBxbjHaelbigawmktx0quTgvmqNrZ2w==

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6B31 0
10 B 53ms
53ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Bx23SA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E1E2 143 B
166 B 44ms
37ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1886
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 09:28:44 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 / Show response
d.vidoomy.com/api/rtbserver/prebid/ 0
215 B 147ms
52ms XHR
text/plain 18.184.201.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.vidoomy.com/api/rtbserver/prebid/?id=39667&adtype=banner&auc=oa-360-1669716010155_f4pztdyqk&w=300&h=250&pos=1&ua=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F107.0.5304.121%20Safari%2F537.36&l=en&dt=1&pid=62135&requestId=22ae653c089c39&schain=%5Bobject%20Object%5D&bidfloor=0&d=lebanonfiles.com&sp=https%253A%252F%252Fwww.lebanonfiles.com%252Farticles%252F%2525D8%2525A3%2525D8%2525AE%2525D8%2525A8%2525D8%2525A7%2525D8%2525B1-%2525D8%2525A7%2525D9%252584%2525D8%2525B3%2525D8%2525A7%2525D8%2525B9%2525D8%2525A9%252F%2525D9%252586%2525D9%252588%2525D9%252581%2525D9%252588%2525D8%2525B3%2525D8%2525AA%2525D9%25258A-%2525D9%252582%2525D8%2525B5%2525D9%252581-%2525D8%2525A3%2525D9%252588%2525D9%252583%2525D8%2525B1%2525D8%2525A7%2525D9%252586%2525D9%25258A-%2525D8%2525A8%2525D8%2525B5%2525D9%252588%2525D8%2525A7%2525D8%2525B1%2525D9%25258A%2525D8%2525AE-%2525D9%252583%2525D8%2525A7%2525D9%252584%2525D9%25258A%2525D8%2525A8%2525D8%2525B1-%2525D8%2525B9%2525D9%252584%252F&usp=&coppa=false&videoContext=&gdpr=false&gdprcs=undefined
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.201.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-201-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:10 GMT
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
222 B 113ms
21ms XHR
text/plain 2a02:2638:1::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.17.0&cb=76389866811&lsavail=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:09 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.lebanonfiles.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 2 KB
1 KB 136ms
45ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: b5be2b3bff14acbcc4bcb9a9f715f0348ed966f402cceba8557f73b1fa942641

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 29 Nov 2022 10:00:09 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 726

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
279 B 111ms
20ms XHR
text/plain 147.75.85.234
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.85.234 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:09 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
server: envoy
vary: origin, Accept-Encoding

POST
H2 200 pbjs Show response
useast.quantumdex.io/auction/ 4 KB
3 KB 417ms
327ms XHR
application/json 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16cd239be413c85f15de68961cd707eff16ae4154232b294ceeb7a84119c92aa

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: POST, GET
content-type: application/json
access-control-allow-origin: https://www.lebanonfiles.com
access-control-allow-credentials: true
cf-ray: 771a7ea848189158-FRA

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 139 B
994 B 16ms
15ms XHR
application/json 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

1656378cc194de7adcd6eef4b5e42ca0ef82148d9ccdda8aabac2ec5c29bce80

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:10 GMT
AN-X-Request-Uuid: 72759d2f-b344-44b6-a19a-7d7446800231
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 139
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 v2 Show response
i.connectad.io/api/ 38 B
356 B 230ms
144ms XHR
application/json 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://i.connectad.io/api/v2
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 308eb590f828a1d8a41aa0046a1a7a37f153fb845c8ce0b38162cc44a2e6fa99

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: https://www.lebanonfiles.com
content-type: application/json
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 771a7ea83a819b8f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 1 KB
1 KB 318ms
109ms XHR
application/json 148.251.44.111
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 148.251.44.111 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: sundoro
Software: /
Resource Hash: a30e2577031ecb3385cecdf26541aaacd2881797b8e78a4e661a178c94ee64e6

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
x-prebid: pbs-go/unknown
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 1192
expires: 0

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
183 B 100ms
17ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:10 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 139 B
994 B 15ms
15ms XHR
application/json 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

029e2bae177126367834541a194ebf0f7ccdefee5c864d35c0cc9d318824022c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:10 GMT
AN-X-Request-Uuid: 7dfa0577-ed8d-4080-8291-7344fbd40770
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 139
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 200 events
analytics.leya.tech/ Frame 0
0 223ms
49ms Preflight
text/html 35.244.145.108
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.leya.tech/events
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.145.108 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 108.145.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-token
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: x-api-token,Content-Type,Authorization,Origin,X-Requested-With,Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.lebanonfiles.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Tue, 29 Nov 2022 10:00:10 GMT
server: UploadServer
x-guploader-uploadid: ADPycdtbdi95RgydoMqO-sL-Ex4x9UajMf9BRj_BuvhQZKZflIPLeXhd7mdgLUcT9ypP1TUqyAA5xycE02RkYgolfOer7A

GET
H2 200 lb
services.insurads.com/ 0
156 B 109ms
108ms Image
text/plain 44.194.188.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://services.insurads.com/lb?appid=2490&acid=483&s=2910&sid=D6F956D6FB437E6A&auid=929906&ts=1669716010251&iid=p0edf00010afe141e7438609a11fb0b073c384d9316&is=0&m=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.188.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-188-152.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-nocache: true
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
cache-control: no-cache, no-store, must-revalidate
server: nginx/1.18.0 (Ubuntu)
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 73F0 0
0 75ms
75ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQ3vLbjmKmBcJLaHt1pj6SYkeWxFfHQV5OefRTitpnr3FgLUM9jywTofM9AHH_h3_qG4gEZFIY2U_jiO5rcrDDqJOGBkhGKA5HMksg0WlzWkD0BfSYaXLfIVaj1bzEfpBfjrRlOT3F5d-KrwXSxrYrwCzYPaXemOSXo5Ng6bViEhI0v97L282GGvl21YbsvFQzbXDJ6-Smn1QA-j4ooA7aSv5kbWbyHcHb5YnLKiW799i9P1fm2-RTLp_MxmZP679fvsvig3cXgbVo1h6jBTtUvW_agp5raBcc06Q4FGiZAY9I2IkM3HVwFOz1NHMQ-61mTqOzqNwxjWcnEnRWw9VNWS0aQw&sai=AMfl-YSKCycP93zONKjvcf03rI3lSgiwXwleAovnBGCECMmS2jovTHZBFWld4KeBOMbuwDsc3wpUflj34aaZp9EeX0ke8m_YsZ-_3-zm5LQ6ZmndYCajr8f1YfZMQ_jGptPiJgDPgywLSiOOPW3dlaBbR4c&sig=Cg0ArKJSzNffFCa971NGEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 invocation.js Show response
ad.vidverto.io/vidverto/js/aries/v1/ 25 KB
8 KB 61ms
15ms Script
application/javascript 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5ae2b18203325ac2876b69455e08e3eefa59a4dca46ee55b033f1fbd80b28b5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2022 10:57:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"6357c112-63df"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:10 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 73F0 154 KB
47 KB 84ms
84ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 81C4 6 KB
3 KB 121ms
43ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 25E6 6 KB
3 KB 94ms
45ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3F17 0
0 76ms
75ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstJ3N5d24J7wrj9DIEBBPpuYf8F8RP0yj_UHLQdqka99A0L8XPGR05oudyQ2711u4OFx0fL5pT06hjkUvfb-x2jYE8LdGNsMTeIshIUrJDleXhCzt9otZU8krOQn5NPKZDSrboD8u7M9XnPFrUPPpmCDwrsjFdAxkNXP1xvpypRhVAm7kp5bQgmRTQPlctlU-8JIq8cvL543qzq4Vdyiib86qlnBMfOK9W6zQXn_DkU9HiMfZ4fnwkiMVyBizthZDWHa1xFDwrx5l1vVOC3sRJgGolCRLbvgmM09EO_6E7AbH3-cuXq6AJJcwuxQoFrM-8Wt75myW6AO0jLKQ&sai=AMfl-YSLZ3ERVcT1JPAuz5do9OgZMz6P1YmKZF3qj4anUakjuVQNnm_bFYJxGLqb3e3aUhqgc1U0l31ePFYFB232LELncqh6GpwZM76bNGMJsVyB6fKwKM4IMin6GYeYJX1oZYbNd_fiG9jPuASronS66XY&sig=Cg0ArKJSzAUfPi4KWs1wEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 / Show response
ads.projectagoraservices.com/ Frame 3F17 6 KB
2 KB 80ms
8ms Script
application/javascript 2a02:26f0:3500:11::215:14c8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.projectagoraservices.com/?id=14314&schain=
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:11::215:14c8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 52799c39d821f55fe7ece5e312290e9ac8f100b6a0559ec4dc88e453aef4aef9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, no-store, must-revalidate
content-length: 1888
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3F17 154 KB
47 KB 128ms
49ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F093 6 KB
3 KB 75ms
41ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2DF8 6 KB
3 KB 64ms
39ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 056F 6 KB
3 KB 70ms
46ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FF06 6 KB
3 KB 46ms
45ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 855F 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b12d9b469a83766dc2f5ab12516f5b3b86919f28b8e608e2fa825b3f54fb09b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pav2.min.js Show response
cdn.projectagora-adtag-library.com/adtag/latest/ Frame 3F17 65 KB
15 KB 262ms
7ms Script
application/javascript 2a02:26f0:480:f::213:7ed0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.projectagora-adtag-library.com/adtag/latest/pav2.min.js
Requested by: Host: ads.projectagoraservices.com
URL: https://ads.projectagoraservices.com/?id=14314&schain=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ed0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: d7883714332ca4e9cec0d6098a64119ba64c50ad2e74c1f4722fec45b96948ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtWdY7khSInfkpTiXPo91baaBr2LkS9I9GEDKOH2RN-RBmeY9M5ja3iG53fASBR1B6YfGNOK4pp9mooexQcF9Lui3q_gTIr
x-amz-meta-version: 0.1.17
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 14977
last-modified: Tue, 04 Oct 2022 07:27:16 GMT
server: UploadServer
etag: "6bc0276348e1f7e3a7106315af056fdc"
vary: Accept-Encoding
x-goog-generation: 1664868436084557
content-type: application/javascript
x-goog-hash: crc32c=534wpw==, md5=a8AnY0jh9+OnEGMVrwVv3A==
cache-control: private, max-age=86400
x-goog-stored-content-length: 14977
accept-ranges: bytes

GET
DATA 200
OK truncated
/ Frame 73F0 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e116484609bbceed3188ea2729651b546c42c0a536d07c5708e2be518246988b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 73F0 0
0 76ms
75ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuB9tGNG8CSopGFQmeKamFTEqzBPNxbs4O3QQ3NNvKfOyBFGOfgMNeqW__fQ2Ib-euGi3rYdw6hqSpsu5y1N31xgdc0QDTQE4_e0HOxJtaaSmAZZhFzQ0SY89dWRdewPZ4jVWvMrVn5P0SWUBzp3Rm6rRIxA3HJmrUxZ9hHBo2GRaEHkV9jyVHUm-wH6aKzDBgWHBGkBB0XKO6_XxbRUgKh5y8J--AWqtMP4lsL_dYXfEpKKT7-bTJPEmIjUNt_Dquc5rVVPoip1JP3lHefYkA_gcXLRw6scEQrF1UU5PtVsUzkP8K01xQHCBhgKdl4wzbrlrPDza1Thw&sai=AMfl-YQnPYj2h0mHoJbEsmc5DNoK7jrAhGiiLQVfSwirEPlPqRwGhyrRsEBqslb1Smig8nIVLNEL3IUpM6fa9CU8iSf64wXphR4kBvqwYokxFTzW6WabrCkGV7SHj-ugtpfN_WwrxMB_Qt2juGQLzqz9DmE&sig=Cg0ArKJSzEdkXPeMFdfqEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 16B9 624 B
245 B 107ms
78ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY1eDDmAEwAQ&v=APEucNWY__8iFNnFtxtZIolKE7ovgOCum8ZNQZ4426g8CI9joGuxpXR1mG_UJ9v_8bq3Lc2aw33g7P67L_Z1GYqILxp4fnSkCmbR6G1XHtw0eqLFSW-GlCQQxbWvl4HhIAhIoDjPDcVCeYH39OhEMPK3ddjBJZLImS7mMgVsEMtcgiQHOoBzl4g

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Tue, 29 Nov 2022 10:00:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 81C4 81 KB
34 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cw9GDWt0umk2ObPtRza1tvoF_jD7M8-MqrfcowmQwJa6W6egSNWt_HCqT9loMTZZZquoiTdEKO7meXbFNZalti93keJQ&cry=1&dbm_d=AKAmf-Dw_tAgbf96Z4-GSgGE_eKnXZOrxhz3Jai6n-nD-_XSQocuB2h-Q4gWe6qK0sCrP2DtW2USJ8pJIwYEi9XVS36ZX6KM73PCJjOzQbNr3LIbIANK1052RALzRVErgk5kbc1jVToJ3j8P_nYq6hQqoJ20e8esKLPf0d60FAqoCnrE14pOYoJBZcsCSbGaHVtn_gCja1Hr2mnbIqjiUf6SCiXxTuBV1dQ0bQ-kWbAKAFCmK_V18CKbxGmHvLv5cAl645mcb0pjGpKxFbsgAEROzuqpiavu2Ra2nAD9JWqXWpwNLhGO0XAgjx2J_4XLkPooGL5nsvk6iikbY9bhiSFZmkSH548cMizMme2Zg0Nqmv1PRF2MZCPamycHhyYkAyt3hQ0mWLFJlR4lC0xKHH5LP-JouKWY_c1OwtcNxlrVrXWoODZR2QV-HDB8SH9g_hXdvFxDin3dtFs2dobgoSx02xa3DPUPSYuF53AKzSdwYEnWwegcfJDHmhJwevmUAMflkzvr7icZcPB-rDYKyoCZPfCvYjvtU242CpOe445dj4z4sBga8e6qaUvnHGPfMf6Kisx-d3W1O5CDKtbqtjddNhuV1RwFZDoZ81yXl5Z-O7uMaVS0EG3En2yOlB6AjISuCW1ue9MozLUDjgwEiGfNMDVTs7z8dDBmYLIcWuox0FrpmlBOEaloFubbylHcPwsuRTId_D9ZmSztAURzLFXPkPKQousfAIlGm1W2RE2ZB73ClqarW8rKdRkfR-uaEIgeNc1VNcDgwiVskIm3VC5cyStCcg07YxhEnRpalQsisF9FAHuo_X3Luh2ZajUcteGTXww5X3v5QDV7fxDuobzpjbQEjpuqQVWEKV9hPz3Hdf2kyPlP-SACrWrJzA7dSpGViNX_VoJH1Uq2QMkQNoIWTUJB2Xod8KPcoMeJ0S-wACjuR6k5Xdz9ogfy0eG8lqqkfqWxpKTBk-f6ssn0mSRHzW7h0OutW7RSKo9q4G9JxaNUiM-AfCyjf3criY8E_nk_GYIOPXSw88Y1HSq5KuHkYS9bfXDfyQ4Eb2xgZHfxzgJsYmm_G43sjHMEhCvkhuYrCgY7M9XC1EAMoTuQgr8rdGhPqR_yS419IeSDQNEfuZHxOVTAe9ThKdfK4sz4kdQezMVKDIF_M_ltZ-vwiLLKMl0-UO9O81MLChsfT4FAyTdD98z2JaivtF5itbnXASSmHcIctS-gddDSHSa7WKVqPtqNqjxv1N5VCZTp5Rdz7av1BZVvPogIoiqgWokZM83_J2vETRx6p2rwyN4MCcGA5WC5udYbF-BxG_xrOa9aWNCLAr0ZkXOphUjDgJrUpgT_pkGYG0KOYbl54eADKmoe-RO0LY0UIP4C0eXdaEAl7FEXGT6C94hYFaA-Bp_8k0MoAWZthl9xz4kR8Q470Lep2MjDSPVoIrLJhVGLtYFJ9Hlctag-l8DSiOlPaDQ3KjeaG4GPWqayN0z4xp2Y0pxe4KJq2fBqmNg4MVyMf57I5Zw6NwDGUsD3MRlQKZFbqWn3yvRH2nzknpMrFuc5Ki-8xvCdko5mR0_5EAHs90HVVZcy57bDddKtnM5KtSnrl2uFPKNQokkPhJdL0Of6lev3oHJkm5U_TpCYM7-9WTGuRo31XR79CrpDHxRx7LgVpH9G7UK3mRQJggrjehfGZ2fR1baOy6gloLAwll3MYME3LQwFtEViQpIGxMifnnrVYHQX47-WIvDKWtrLaL37eU5c9UVfZHKRcHBPWwc0LmKLAwkKyil4FwK5YYd6Zi-nCgD_lXqB4Ia_Pr9pWwe_Px23aPPDyLn7ZNwJy7NIvB2yMYjS59mizd0p7p9qoUyFzfloVVLUdqAjaiF6qKpB66yQ4PIRO7OtuqWbyTIdotcIuurn5TR_r7LhE6Qv_ifzGx8QO2WAf3c6jiAASsFuUtYTVjm-dsvKhk25-K86LouzWo9F9FzovpFfG3NT_wR7vIE6X01FoaTbT4wz53zJsC_W4uMNw5HvdYG2kfH6RHPmIrzrfJPL-rn5HrlN6PFxu1clS_lXgBL-xLtaC4DshBdOWLauVhulzf8keXRH06Zn_9WDG0LvS8Jb0hBr6cWV532B6aMMiMEoXtnJc36kyVXiaAKSwjvFVZ0dmZ5MjTjfGd1dPokk6i9rucqFCAl5TNmsXj39IkDpjd3pMAiVgiqxqfNtVNlX5qByJhbi7M0vwUvX5KKBS5pDydOQSl7-SUbtdf5Ujpv0bCAYh9GO4_paGrOBaoHNs6EzuUZQW4sK_OkSAaaI46ho_9OONwNbGLxFsnir3Ps7WXL2T-eQowhuycfiU6vYJKxfkoHOUbirVADhL4aUGY2PlF5PheT9pIJHXJjnDyS8a9iliRil03jdrEzEFAt97vCFcwpJyfKVpD6yPux9IyaDg0UUfQ6EZAOvmPKIOmWc4Sj84P6z4nvgOLE3z_mFZh1Qsz7N7NwFSyC1giWiXov75JJmXqPAm4CEeMJDhBaWGJ5Lvtx0V2Fa7nRNILgnwNJ2KKe5poAKaOnYpUyx-KNLeJ7LsEViRr3yUSgwjKIHohEC67cYsLGMgD58Hm0p7DmjOgP_bl-tAy3ZycQLCeUqd6j1yXPoXzjCuWiQ2VyMKxgSDbi9ViOgJLJwo5EHeecYJsv_db9mUt11i1Lm67yeI68UydAsPWeEEGTL6FLNXq6TsU3CxnA9OQt_fCP089hXP0JtwalZtPZhOFEevwhOBY_NbMJqYJfIs_GcrOwDYobCFBWQ2jiLwYgft5Vd0UZaiYk7QpvPwEhE0pfVR3nSu9G6--sliOHqVV_Oq3DRr0EMfFDcC8fTS2gOfLw42_XSUy65IvqjxWW18Gz5H9jPTeE4b_Z3XaFqU-rXHNPIjzXLWr0Hn2-jGTHmSrCYlecCnS93AUg4wsIY2MiPd4vw-ug7J5gj9lMJOcLlg2TxgYafYGxoUDfp-_zG_K2NYR4bo_slPqqkg12SbMLyEiR5xfD_Hijze0dPzXduAdrtymOv4iQqA83GWaXhcjeBHUNtWCEGC4Fgaad5H7eat-EIuRnqbF9VBuDL2D8RCffSAGbXEhlXL-SDKGaQMfiJAnc7iKnHFDNeTpb73APBD6UXMc2X0NftRnc0KNXF2zsACeE_ZResgc_ZIPgCAYRt4eVXa92MqfxA3qfocxoSr_7sTxtBndk3bZvFR9q2ZaMzpbtw5AnucGEdzUxi6CCkgZzT8xAk8Pl8WhQ1kEm-a_izl1L3FB64p4xW1HtVtDw1CikIomrliVJHwRAkuzyXWbSXC5vJQInUGdGgKsbrjnmawMaoeR9aD-51nApLjLU_cFjwoDrsHUQPaHWhv7CcK9bpj6yNkiTYf1cpcGAuNtnecUZfyrazIkNtGoDV-MFaaktKZIzDBBQbKi1t5-u1b1m28DcD62w2gXWAuhesALkueNe44rNhsfgrZVn8fcovAfdWZPDMVAeCVq9_X-zLfbyAgxm9lCne2vHHE_XQzqlDQ9L20BrWPyJK4FSBoPNCrtXTFGYbK_4HydxsMogZ3FmkK8WvauMXDR1t0ytc1gPf7GSvfQxD76V0ESm1bAEjjnFChA8tfZhaIEgBA6n8yEOyJG6mhkJSyRIpMMGu03ng_Q2mbp3U6O-4mCIT_n2qmYJVCC0ZMPNUXvE4Y_YcAaK4r-ycQ7mfE7JIe-qYB_eGAeIKV1pS3wrKEAXHsOPolYM9FZ_inwDBRMUTB07LqQ&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4b6df5b368786b0adb7b50ec40b01393d64960fdd0c9dda7340ce88510be0e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35076
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 81C4 42 B
63 B 82ms
80ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cr-FbLFz_RuNGNJeUAKTCZfya8tyHveXbVlUtrghReE1oRCmlFZ82r2e_D4aUot1-AV_uUtoFklUjXshiJKEqEBE40ttvvUw-NOCRWFGjehqBhwhE

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 81C4 3 KB
1 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 81C4 18 KB
7 KB 45ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 81C4 154 KB
47 KB 51ms
49ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H2 200 batch Show response
services.insurads.com/dfp/mapping/ Frame 6A4E 3 KB
707 B 110ms
109ms Script
application/javascript 44.194.188.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://services.insurads.com/dfp/mapping/batch?appId=2490&requests=[{%22eaup%22:%22/21894097782/LFiles_300x250(1)%22,%22eoid%22:3026446051,%22advid%22:4830452331,%22w%22:300,%22h%22:250,%22eId%22:%22main_lfiles_300x250(1)_0%22},{%22eaup%22:%22/21894097782/LFiles_320x50_320x100(1)%22,%22w%22:300,%22h%22:250,%22eId%22:%22main_lfiles_320x50_320x100(1)_0%22},{%22eaup%22:%22/21894097782/LFiles_728x90_970x90_970x250(2)%22,%22eoid%22:3026446051,%22advid%22:4830452331,%22w%22:970,%22h%22:90,%22eId%22:%22main_lfiles_728x90_970x90_970x250(2)_0%22},{%22eaup%22:%22/21894097782/LFiles_300x250(2)%22,%22eoid%22:3026446051,%22advid%22:4830452331,%22w%22:300,%22h%22:250,%22eId%22:%22main_lfiles_300x250(2)_0%22},{%22eaup%22:%22/21894097782/LFiles_300x600(1)%22,%22eoid%22:3026232221,%22eolid%22:6012624441,%22advid%22:4830452331,%22w%22:300,%22h%22:600,%22eId%22:%22main_lfiles_300x600(1)_0%22},{%22eaup%22:%22/21894097782/LFiles_300x600_300x250(2)%22,%22eoid%22:3026446051,%22advid%22:4830452331,%22w%22:300,%22h%22:600,%22eId%22:%22main_lfiles_300x600_300x250(2)_0%22},{%22eaup%22:%22/21894097782/LFiles_728x90(1)%22,%22eoid%22:3026446051,%22advid%22:4830452331,%22w%22:728,%22h%22:90,%22eId%22:%22main_lfiles_728x90(1)_0%22}]&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F
Requested by: Host: cdn.insurads.com
URL: https://cdn.insurads.com/iat-1.7.4.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.188.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-188-152.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: b46566c5f6ef45df0d0a2ad42d75c5ffcf65fa7f34464cbd2926d79396532eab

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
content-type: application/javascript; charset=utf-8

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 25E6 0
0 84ms
83ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C7EgbKdiFY4nLIKGWzAag3qaIAcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItODc0NTU5Mzk0NTYwODIwMsgBCakCLtwKvpttsT7gAgCoAwGqBPwDT9BQUWAFSdqyqOBXjQBcwJiQAVX5duXPB5hD0wFSfR1rjxwAAdnRRxg2leuZquiOP0OoDE4yTTSjJ32eymkvm6MskPfP1RRVGODIHnxWNRgzLjdPp1eW-8GUjOWM1CoUY8v-Rd0nZfVLdyFM1498qVw-M0LEDFjC4qZpx--sFjhrvXkA4qOI2xEvA_jo9Kr1k_gXph4l8lI6Xpp7-Ox-fSeQav9LypM-fS_W9UGYP-r_ma8cOynmZCfucDhhtmZeo8Nl9S-fS_OnkBAzVI2ZyZUjDosUPwpi3PrKmPB7gqb0pAKCcaU-nqrS2Afd0OEe4ZCM-wwSTtmJBg_iifFuhN6EHaMgJPiE-oI4OML_v4ozAAuRAJxl0sD1peOwLm8IqigwOdju5c1t4tQ7Vux42r8VBgUWYDanGCYUrF_wDSpkZ9H6hQZiNewxBhFJjTP5FGXTk6DicPrNRogPm5vhjxPm0tiTvueMd9Pz8r6Q8xZmxyXrv0dU8z1C5II7AQ7oe0Mb_QF1xXFd85UCoFtFykJqaL5F630qy8sDl0YqvR55JujTBJ0Rj1H2zRE08I_KpslPcUaG1vTZd11dfn_gUsXaiX6-VojPmwXaCGXT1o8dzAuAKTlzm7OGcBcr4A90Q5njKyVGmPoqtmxuxooNh1u1ieSSBbF6uL02g-AEAYAG55qZuuXY-7rBAaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItODc0NTU5Mzk0NTYwODIwMhiE_3Q&sigh=QY3b6fctxuE&uach_m=[UACH]&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 25E6 0
0 198ms
17ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=keLsEd-BMKwC2ASdg2ICAgAAAA3_avH3G62TcNRnexAp2IVjg-ij7mc3ATw3HNAAEgAA&wp=Y4XYKQAIJYkK0wshAAmvIB2F7w53QIjTwTf5lA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 251330
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 6B6A 113 KB
41 KB 101ms
64ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4XYKQAIJYkK0wshAAmvIB2F7w53QIjTwTf5lA&u=%7CH4%2BVDK1C6ormMH4QsP8CTufYx8uzElg2NCKolFkSIrk%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNWAfGoXO4nLFqnE480YHVHx7mz-K5ZBShjJasfYEbwaoSgg7uYPfNMr_Nd6DD_87BtITfVAWtbG3zYaNHdkeC_wBVV-DNZIhXWUCeSGam1zaEaHa7zu3_uVpOFE9c3Nunz_WSo4doKNiSGz-Wr-mJ38Rqh-gpu1vUMiN7-PeDZNstBSrlVDur3cowOi8dqw-l__ZIwDH9k0LPCbGY-n8qpRejA7-LLA0qKxHVDm2CuRQhTQ0b_dND6Yq8n9NhGdsu-yR50N-ZlWkEKPN5DEiPIAkGlDgLTdc9wwPvB4HIVp85hw08Lnf__88RmWXHR41Tep9ceK3DD5s3m-nZWk26vzA6xI8DVSV2S3Yz-RX9l0ygz_1g9nCepTC_3wPeMVhnT5JXl7ZpPvgaOaDrdGnCZJIP5HsZ2wGviA2wsgfhEX9CS9l3i--O_ZCLCnqjNv8FUjxhynb_MdDmJmYAtUvbKi_hrW15dArXaOBYPJioUtfT6QLDhg7fliIk9541xsHFLZfc2gZIRKHU8dnCNcvRVYt3VlyuN1ID_F-pXcqzFo16D7j1Laq8HpWrhTWqhpGmSbd5DPP9u0OuKC0WDj7MzSrApp_zdIXj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIF67KdiFY4nLIKGWzAag3qaIAcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItODc0NTU5Mzk0NTYwODIwMsgBCakCLtwKvpttsT7gAgCoAwGqBP8DT9BQUWAFSdqyqOBXjQBcwJiQAVX5duXPB5hD0wFSfR1rjxwAAdnRRxg2leuZquiOP0OoDE4yTTSjJ32eymkvm6MskPfP1RRVGODIHnxWNRgzLjdPp1eW-8GUjOWM1CoUY8v-Rd0nZfVLdyFM1498qVw-M0LEDFjC4qZpx--sFjhrvXkA4qOI2xEvA_jo9Kr1k_gXph4l8lI6Xpp7-Ox-fSeQav9LypM-fS_W9UGYP-r_ma8cOynmZCfucDhhtmZeo8Nl9S-fS_OnkBAzVI2ZyZUjDosUPwpi3PrKmPB7gqb0pAKCcaU-nqrS2Afd0OEe4ZCM-wwSTtmJBg_iifFuhN6EHaMgJPiE-oI4OML_v4ozAAuRAJxl0sD1peOwLm8IqigwOdju5c1t4tQ7Vux42r8VBgUWYDanGCYUrF_wDSpkZ9H6hQZiNewxBhFJjTP5FGXTk6DicPrNRogPm5vhjxPm0tiTvueMd9Pz8r6Q8xZmxyXrv0dU8z1C5II7AQ7oe0Mb_QF1xXFd85UCoFtFykJqaL5F630qy8sDl0YqvR55JujTBJ0Rj1H2zRE08I_KpslPcUaG1vTZd11dfn_gUsXaiX6-VojPmwXaCGXT1o8dzAuAKTkxmZIU95i387DoVzozFoO-ke4gAGZA3gi5T2YTe1uMKan_EjklPPKRueAEAYAG55qZuuXY-7rBAaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2yTIVmc79aWW_q6kGurIiEdTOOEA%26client%3Dca-pub-8745593945608202%26adurl%3D

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

1448327658bd6410680a427f06d230a0885f7d8cdbdc1e9532e418da168c2c9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=IVEMrS4gR2jBYbPaJobg4yKBwbmGhxZBpvdozd7IfBqSXTCQEVxpfFqs4FP4DXhewverRCP-kPpeE0Myo_HIpualqae4GZk4DuQwTDTSFn8YfHfgXvAIBBxUFP_H2NrI9aZ2pE9BoOR_sJfoiSCPkEyAfEnPZ0FjSQfdXkmQA_IDo_IC4f8f4gFqhHzfEdwcb8MRUWFmnSrvrYtylTcmrL6zd3oVDxAmONEJnzbB-tMCD4VDyht1H97byHrmB2wu0WxllQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 48403997
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 25E6 3 KB
1 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 25E6 18 KB
7 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 25E6 24 KB
6 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 20:58:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46894
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Nov 2023 20:58:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 25E6 154 KB
47 KB 77ms
77ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D436 624 B
245 B 105ms
78ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBCCoHQYoe7r2gEwAQ&v=APEucNVEuAmvLZIpqJlGGwgVv0EGkSMkowCxuLopdfDg66WD2UqVo5doM0Rcz67jHKfa_lC5pJopVGTsTwOZe2Kgo2xiqb-Gzd4vc-WFAIdG4dW9cspllW2u2YRGEpcnmkA-dHt5NBCHAH1Xe4tz-LymuIJmhCNqD4DDy2zo1vU-CD3OeINK0Ik

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Tue, 29 Nov 2022 10:00:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F093 95 KB
37 KB 101ms
100ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BrrkoRnJWmCl-QBBaSE6wrROrJF9hQvXR4Jh_kBQGH1KO2-IM1zf3tWH1jfJLOX5ZOunJ-oDBEzUyfeTw_3yffMu6f_w&cry=1&dbm_d=AKAmf-BKgP81ncRwWh6YH14M-cGjT9fu1aXPgQYNuWpa_O0Hbs9q33QTr1GmV_fWsuTxOK3y4YhsfvaLojCzXwL5WlCg1xXDJ9MWz4uGIxCCWX72K9VhT-Ly-prm4zCj3zWuqD0esJWqNp51S8M0bPVXTAY_8xUHnVZf_co2PXMLlkP3dBNnbZuvTk0F99hIqn2pi0FqXDaQwexahR-TVY10rRDoy365JTdakhmg4WgRjTbcOW-px4gKk0XFKa5ToHMGcx9HyKi9Db0oXwP5VNfkByqZ7inMMVVy_RWKaXYWhIILMo5ZLas5A6F0DEf_f9CRtm3PM5w9ylb75fFCnW708nLwIZK14yWNTJ6AZpSscvq2XQR7MyRgz2xQrwVbtHK6CMENxYTYzeW4dFrrqbaYvs0pU2_cM09C6H-I0GW100yN0IHVG0Q4ClGHpc81gES7d781v88LV72mYfrkiZGDRAXaGoZ5MM7kh7b1JOZxNnIa_aHMW6KUAS6CQvHTsGdvucK-FkRT8Jut-tJfg-kOCT9SMEtjl8IU1Y2WA5ZL8XY4ibTvCzo-HgrgJvt7WmRUsAnclu6XF9GkBp-oUDUfOBXmyAjcd2gvIGGKJiu5m_xF3HXky7nL5NqauzOuRuw1cKB9TlY0MpSEtJ3DdHg3kQCy13_vqDoP-FHXG2OATv7363vkgeVpiLQ1LKj2gzOTkCABcLoWdFD9WyinZYV3KI_PTlrfWzydISUI2vJbd0quvIkLKpB9Zf4oYKLKgX7Xxuw0-A6ip3VtpV7c6Gt_dbfKNOpMfB5lxRg5jsFyVddwy2pzKjb1Uki8ksMwaNFfVmzZdAnL1Wtu5eVwYjmtnZr1fkhnLrFFIvrNw8zRVDyRQ29vivZkyX6N27UaTJPTzwJ-y-B8KEliVHoY01kj_H7uXU4bo9b_FKY1_XDHrJqsHg0qPmOSJI6_mYBtW2ln7vrewOAgg0p9-CJ1esNrBFxCV5rJGU-b7eDxD-gc-y0uZTKMn97zb4bNFZPbbhY--unW66m8o_dBFGIMI24n0D9Q1cpxzyuAjh-UwihN0sdjCaXWy17CP_wMezj25vqQdcBuk0mwTZZAIIC-HgSRNPYiIhVG2NV7s4rLFXETLllPZxa7SMNy3G56paE0M_sA712bs8a2CRlLAogMzGTHLUGxFNTvfvLcbTzk00gtAEZfRk7eeJvahRGWkC5L-7TWfLVYoXr4nsxP9EqFRfOSZrFDGUlPqwxyUBJUDXiVqZ9AF6Jjxu5jZByjmQhrXOUNgZ0I_wuRhZO_xGS7iF1gBA8IJZe0qI5YnBkpRo0uIItFTMWbIamm50vrjP9Sr0rceqjebfCY1GWlQj9olUnRlEtQEDWxPzFKvWbN52d18xo3R_mtoK25--K1wSIfW03SzNjMJkmSYTJqfUSzqvRvXGzrj0-Lnnj2ZWe46okfadda2LOkmpDUAxQTLl5alH2oXL6_ptbdZvLLATEzpGueIaATxUZJnPGteEU5ehToxVMeaFd7LlAL71vL4MSmBPaw4iiIKrBGWoPZoq9VTkfrNgEJ18pue64Q3exJgQdxASbGHFvdjD_uf4OSIXXmKht2Tzl3xTZPYa6Rqn3NVd3a5tEnaHt6N8mQQl-xbZir8kfYP9r5qmdy-r1LIN9h5SySsAl9p9yodydIfY93w5ItCU5ExDy6vKy4tj-K_d3kRQs0dJ_gJ8yN-PwlYB3DNQwvQURMQlx9uEHBHpbnp0waVC3XRiKjEGwPUTiltywqm-Yc9j0xcUJia5BX6T9kerrxBFxWav7DZAVpvZPQlKFVuDBPE1IugjvdCHPiAWk2ievv3ZB5zLvjTb22g3tQb2G_bxEvkvMrmFGy2jk3LdutvVJp2oJSR1qQ4LOcQjmxrkoNoh-tup3SYOQYMA_WdegAr1InnImEc6Q3FNkUVcR4YjSf1c5Uo5p74F9nk_29ARaeh0ep31gYl3YxF2-8fdqlTXv0NuzV0DEV8I6pbwXnp-qXIuo93jZGes_UTwlA68ptKHUTbgcNNFabme5N1aJKGAnnjgriPNnXDwPsfG9L4ECy9kC2Rueok4M6qO2S8ERCYPRffSPjNWufcWV3AvxDoFJ9VYWxtvGakGuVMbhA7JVzRpldG1MW0EeA-o4U_6HrqaxUWRFHbSk4sBxHTlnWEutMgjI36LoLNNh0o7b_-pU4jc2b-Czf1kcxqyc96CprzzCahNnodJGS2oFHL1Yr2wnNF70E69fF8vFbK2E5_BLL4O3FeuuTblr2oDBaE-DOPkJ7fWIBI5AEicN559QecVN8uAl1FFP99nS2QJ78-BN2LxgFMB1n1kiBrE4w3pv7UsJpLZgRB2s-0o0NVWRFM_eE7BN6o7WqcbxrPorRMWO208jNS5ClidWhCC4gOLsgS_W_uNhErjShIVQ9e96ly12BHy-iwdq-HHjfgc3Tdz6p-kVmkPN2ndVLWNUGa1sS6tpfzE74KQO2bMTfvVr1vZInOLXhF0h-Hw-LkFM9dAkrMBpwp4qKSu_7PNTnk6wMoOnW4koMIdEeBHD9WBljNF86LMVTnlLfZ-LSk5Eb28cH8Caf48kdh-eifMyDd0oBKTWs9pYdtSIHgRp7fKT6qKIURwkc3TutUHqEv7r0PIoZoTrCpkxlh9bXdNUPk_FrwtdOwQX6mWkKexBDA0vjkk9_PdhBdUF9ApuEwDU1rP9fGPKLYOQUQBy9xKnfl04t1EamgAdakQuM4v_0fAnQixgUIfA5ZLWZEG0yaFsloQF_i7BaiaqetEOeosxJTt2jpMPMMHRIwnTH6ZJ870M1JHJQV3JuY1KBokxojqT4SZSt1Bcy5Xo2bXm1SieM7mYC_aEuYBPfisGOmkNlUWxZ244PqlEFao_VFjzR53Ne_ZxS-8h_jUAXyHGFKDnBGAJeQZY5GHx5v1-pg4ts_r5MSSZCih0DmDWVF44EAyEoyhZn3DgnO5lb6F_bbYgoGS68D4xobLgRh1mMoUl8e9qSvMpgbfAMP9-R3vozbEezHUGyMg3YcwmBlDCKKVVTwHTHxAwd8Na6XV7WOTiIK8kHNrv1BldFkRfXoZHUamwCxud_XKhpXOjj_YIkue0Zc1OFlgip1FxagrYsz6VihcWsADaPkY8kTw6vK4zbe_sqCnFwaeJ8xSjOO-ts1faHTQtdH3tmJkIb9ZhCzboggNi1QjPq5hrCTHMptrY0B2MRlu83caUTOwbXX_A-XmAy7VMAaGWX3DN2mzU1aWgf97slXXI4-pM-pX5EmhKg6oGcOcagtV1unG8ByBcmvwJ29cpJGkEbzXi5kiv6yTqIFKcoZIaDL87KUeqgTBsdTu7CEws5wN8bnXWML7chfJTo0PzGEoeqaKDd9_Rm6_WzTDSQQ477vpv5j2qszCtdrlWJnfpf4MSl_E9He2yLHHLJ8NYLCZ32wmFg_sFJFS7xWuyHBgM-U_hAkSvWESJ8qE7PRVywPHi5sPPCakUiDOLGo_OP9U6uPAXCxMLo5oBMURh181MMgbOU2gvqD3FBiFZMHhptYBrZeRcWhlDj2BVSStIGWCNkyVLUf65ziv6eMWKkIo5ZlRqVrzGfpT6nZwKmeRH6cennfleEJ4MwdqwBxeseRI-9lWb9ejBYT952xLsaa1kGBxt1GjUajNVDx2OCMP8FBkYtkfNAAxDh9qM86lN_czA5FAQt2G8wxQ9gHm_vALEvN9kRfYm6aFjV-x6AvaV9Y5gMO3Ew0xKILOJ38a_ITBp_DtNWIlNJI_Oa58vwZerq1wbP3F7qFuaov32lspDspmItmsJxmBWfXKjwsb1-ApM6faTVYILJSPSNZxQ20QO1N-O8_9gQyxFUBaOpi6cy6w0DLsUFMdTAZx_1P9s6xIcd-irNlNmhCyzO94jwAJK2GPVYX1EKgEZAkAu18V4HkfmL-6qbeaZjLYi-MBoSwdOaWETW4dGfhAaQ4WLdcZw__uD_&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c13094a008829c6017b594f192b648c779a1d431b8768d1b7c160d7dbd65fcc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38083
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F093 42 B
63 B 78ms
77ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DdfDXIM2HgzS8P4G0l_oRw8z7P8ij02Zj5RsI2Wo_LGEzpNrXiYo29M-XhiOkrzKzM9-FA38bMHqWuUitQpJTgDdbJ3zmErOWD9fVw8iCSdUNChdc

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame F093 3 KB
1 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame F093 18 KB
7 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F093 154 KB
47 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 383 KB
38 KB 66ms
41ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac4b432a1e28601ca08b5aa89f0ceb23aecc990d0e61aa81d7a38bfdb32331d0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 497522
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 38422
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 15:48:08 GMT
expires: Thu, 23 Nov 2023 15:48:08 GMT
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2DF8 0
0 84ms
83ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C5ooXKdiFY_fTIKGWzAag3qaIAbC1pdVt1PS3-osRqvz5lJQ1EAEghujldWCV4pCCoAegAbrV4-UByAEJqQIu3Aq-m22xPuACAKgDAcgDAqoE_wNP0Edtyi85VABJO2D7c6OlIXcQSEMFctRVOTLYnOm2ERVFaQMyscwLJv4nW31LwafjX5x8CdxTMvF_IytZKkbghATW0coGiHVOCWHf1pL3_0x_433mscrUSAq-eInVoIxkwPh-BIroD-MeQmGKZFPhydO8ckW9kRDlqFpooOF6HTb6YRhFscsXTs72Wm3MwLxTnHlKoDRABaY6EZP_oZ25Z6dHBzPY-mzcGfqAn94PkiPMFSsJq9B832MIeqgMm6s0jp3At7qU5hCib6dpsdMpxok_WZrK82XQPFO5bKFRiDbmabG_GtOjkaFxgbkoJ_sPMfKyaNDl6NakgfCLwIIkZHwNVQx6DLzMkN0yfiibBfYXz29gy19YSzaYgBgsXkmmfjks34v3zkuYoZK4RmycE30-OUAmSg_F-dKAk_8xv37mBBWButRN6aQ67FiievqATzkHOkbYwqt7x12x5edVMNremxLtgo8KL5GE3cVoLSaA5HyambpszcU83FidnOvmOCptgnWP56GJJfUOSntQ6fW1w6zggqumUQDv7kVl_lawI5AjcyWmXtsq_gBA5bclRi2zefhKX6IJ_EQegnAhj-X6vyLtRiQxjy4dBAuI5ycxKjpHDRlYz2cXmHdAfe6oky-No1H2t_H8l0vnzBGzA-s1mNxWrAG0AItoKkCYwATYvPuVpwTgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGXYAHrqqcmgKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCYxwLSCBEIgOGAEBABGB0yAqoCOgKAQIAKAcgLAdgTDdAVAYAXAbIXHgocCAASFHB1Yi04NzQ1NTkzOTQ1NjA4MjAyGIT_dA&sigh=mRy3XexfzQk&uach_m=[UACH]&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A5F6 143 B
166 B 61ms
37ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1886
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 09:28:44 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 2DF8 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 2DF8 18 KB
7 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4238 624 B
245 B 102ms
79ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxicrrvGATAB&v=APEucNX5-FhXy51hlKdoCdGzEP9YvZ4p6Wq7Z0tg0LNI80Zch9Zva1gfw0961qIwWBSylqt5HZSJR6TDG7Cp10-XJpab7N9QnYEvEsUjp-8NsM4KAUpSgYXI6883HSN3fwCY0-IHWxa7I_D7XInZI9yMQZiiX5lTuvvyMF8V2HYjSZ-5shnfvOE

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Tue, 29 Nov 2022 10:00:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 056F 15 KB
11 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwzIvHyT0z1MpE6nQDAlWIaHchf6Jb4-UyHnNILZ2liR5AoztcV139r4jcawtfTNOm0oqqoSrZNTUCdsu0QlTrgbtBBj5d69Wvz2RZTEf6oMW4neqcVefXB0-dcUC1KccToo-wQlk97-t5AofyX-VxvgTrLV1gkX7E5pWZM1GKzSCbLLY&cry=1&dbm_d=AKAmf-D4gjJvktvvnQtU-eMnL5eLP3MkAImgqQNrfCCiait7yR4mmhGju5pKM3m_L0J1F_oZItFWHWrGuLhllBFW5sk4MGdlTPooja7rmt4fYbSCvHBEY_ozbHfWvQ3GFpUt0Ftf7cWUuMM3iCZXfPSRQEuGH0LelvnurE_041muzv1N13_sVxtRikv_KalBH304ZaMqrha4PIbpLwOL-rYFVihGq-80ut9DDEcijhv7FmMxiBgdR2IDRdgatWJskuX7noIkUIE1tRh2tYO8GJEUATbkF5f-EL2HlD9-QtWwWinPt6yoFO8ELwxSRMkeI0oMO4MzhT2EDorPwQneaRM3izXZ6rUY5jlN7JFWHNwM0af60JXg6tioz70-YVoRMtB1v_26YFX7FEtu2B56VDXjOpSPMtxOs5iTXQyv_qJdDuRZo_12lXO6V--jTc8znzjUCIDrFBst9gWwxfSSmziE-jNhM8-tjh8EcF5jcs3IxuPghRiw53eUbLCLf2Ap1Nn8gwpexcz5Le-ZjqMo-asOPX-uCYscGr59kk23J4cVHJ6EEf6a7ttuAOl-l_h4qCYgzarccQ8tZBiEY35V4HMkoJlUhKnnsF-N6sfOfQxpaO2-OMoJ3QPHsgY3M-Bb1L4KBqfqKs7nGlhepGr3feHHrMsKSmsIh4Rn9sYunKlW58z-UNc7D_BioS9bbpcaScVkiXJs6xFt8YXivhAfDBlKGV47O0LSlZmvsF2gosUjNc935CkoIU6KlwUl9YScjRKaFq1z-OfIE-gRc8lc-ZY61CwW3MxrQJV2fZCXJKW2Cg_-n7NaP9x84lJ_SNAubnlsP9O1eKz59auarfHbVGVufAd12py3XblsNL86eP-O9xwAnrtI6eZfVmx5gsE26j_0YG5We8fsMHiF77vjxZ5Q8GXit16cxWYpU2pTMsnY3E4ItPyKWbjlM5Qbim7A7RlVCK-I9oqLmGBYUNy-Kwsxp_vLTrvk-TMP1TaNXPOcFXqm4O1AyUzsk5d5pb-X0UA6NSkK2GxooJ44XgWsSPly12oekLmVsT1-ABOUqItNCe-je2i7rbdG6QcH3LIZm_fJozzvYtDm2f2p7H-6K7OzqwBBL_pNYld4pD96JAGzdr1iNZwCMud8Qfykg9LrpWR4cNarvx2D6knufZgMSIyvVhPcARoz8tu_6sIEhZYqsPUMqrg5biibBw2gUueEz773D2Xd3RHGKdCZMZmxVNF5q-QnRiXBzxlDRYgNUAKlZIh1bruBL-jZnCLC1x8QP4i1sxsnnFrKm-jUKtTwHxgwy1regPguOvkABnjQ0SS78kAhUlkCrGPRkr4nosXTjCpYUalv4m0kf2cb5qLS4ZrXITDIoqT6tf7IxiWVt-tb0rHssrqwZAz5v_E4Rs_QOdS1a5db-4Orx2SRpciuF3M0xlzpRb7kjkZgk8hnO-RUpspjQJc-EqCGLcbOGvLOnwZger0oQuJijhQOT4P_pKGkE6rtJp8QTTM3dD-DfU9hW9DAdh6MAH-anMG1EFA5uICtFbeXUK_C14UIb1P3UIaaImSnRfaXEG6Dgj3NnEb9_oZK6WJzeMQpu-Pj68NVlftkip0F23cV7LNWC5FZSwGhLCa-ZcoQBu6KH0TJlatUctvyQiABKpELNHAH0aZx7APRS9znM7fB3Rn-Xh5_kKcXw75V8IR0PjqVnKSbZ1znfjBlvKKF0lDeCd1mc0T4pHh-Y5jJ6f2hpBEhXC2wgwZf-pfnjAoWWMN7qmqyBeXucdOJzIzs3RPw4ZKBOSxaFuhsOfb26-K0miH1ZB548hOawXNq3G4LN12P8JX7orA-ZJU5owYdgTZsbI96LWqvaHDSBRp0l84YuufmiTV3XlROo2aDCFQ87Q4CdSuPT0zZTei4IVZlMnaAElSgRisjS5EABC-S0W6KuCEBEFl9XaAy03UiBna2MqHEzR-KLeVHL12H78jqzL1HESxVO8GFzN81w5OgAZ4EGulyHnlQMc-iuSLmY4_JTIrgwXJu1C6CFwhhoCHHSIVVxWLnox8HXYo5rSYbGJ3Ou_rBf50MJMk-sd9QxKJztann-ceu1Gp1pMTt1gfPxq84lhJIahzo_Ex4dWSaOgg61LQ0E1QLRfuOOSB1ifOj_oInMYJVcvZoLUBlw6NtmuVV-S7Kh-HKzj6KPAMsmKwR57qc4xmdSxwrL1ZtV6MFEX-F_dXPUk4Amfam8guk40GalIFGDS0_2S7BYpFo6wINl2E4uVmByNlmuOE39JzRugGzga7g2okNC0NPiitw9ibZyjnX5CHZVykj1T8vv347OjIY89U6dJSci8DwT_q6JBvWwz9NhR9do9bKGPUU7MjNK6G62RjngijQSA86j_gqRcalfeV-YsWa50Xr-9wfbDraFfLac_VC7xFsON4oR9uvW39hM8LGlKGa8FQmlh6Frb_3eGm8twYp_KTlucTgFBoQ0QkWAcjtgMUbSWv7ncpKWrC107z9jNVBWY28-bdE1WNVf0yFMcGmW5BM0vipWRLxZ6tpOE2lCGImWLbWHefXhVTGp9NcSk7-sgeAaTXkU0yffkM3ygVksWG9hj2GHDXQAYQuJCiOITZsVoswYzYsJU0NVB4zabxn9cBkqx2XkkwSgq5rb4cTroi-CqE8Y1EOntgbJrKzE_PX7dVlHWTm3-M0lOHHzhMDUteb7o9QE0aIqKMb2gMOSF1TnlNeEUnEYvOnhyFYLMGuz7DeXRRfPvhk8Q4H70S0Ul4ulXhMerqVFNPVgtrdR_wSlU192nhQ9mkefdwAaSwyfcfzCfa1ByvgSSmsPFkXnF96XGIlzgUAMU9n0hJyl3hYBgLoXtMWV4MmvxalROSegBky_m-_HlKP-iWug73fMH3ONbwaPYXGq73UVpQyNGLniIGre-lQASQaykLKzd7wNHAbwEDfI4u8XHHxCMoWc3RlQ43Bt6Oojn7n0xmJlPGP646M6pWVHgedbE8cb0M_RvtGHmM8oRC0dCnhqTTqwJqxrLlOdDUew9riSkEpKmuJYexdt4M4mMDX15nEL8dBGGY2kfL1H9cIuy7dvzLwso7JaSUovitNm0oZc4lqjWpfL7trVuzCSiqRoCCGQRh_Hjl5Oh8rV_lN9zUuAa4dhfQiVT7vofTKL_tbPv8pS_UEwpTDcMDWHEqJKWo9ALvo6V68g3QzQklxd2gOgpADN0Qm2vAhuKhleDdKVAZkjWy34YQZghyswsRDKXNpAc6qfOEsQNCXBWzYwBu0HbUbJMzAxX32pWEqPXAqYnSPFWv0MXcHEqI34s-NKIfmqj0tSeujawog7e0U_Z8zTfMjhygCQryzgiLSK6WF_zdqwbNnrKsgtHybdj4B8voEWZ2NKPFe6yMSmR2YYnGmdi9CtD9e11kHmMw1bkZKCYX9m56dxf4eWUifcZJ2dJVhQQsOb_IWHZqA2hUlC1C8R9CYgaZmrSd-7BjCBh4MgxmHI9VVNucKwa2rAFuyz89ASbNJlBgmQ6vs3sEnFDntg58YZbpAkPISGiI0EbotNt1YN2zLRTmDu6Zx_oPtXWA85MzaxHGdUdx7hn8Nmqhae7GErQ3dhlEYWvVm3w-HdPWkh7CXqWY6CjDZR4bnZMhrlYzzurHDJ3xA6anOEcOCj6OBS_R3CTVys0v6tef5isZxDHGZAouvCx8aIIy63u4c1R-tlPP88dsHp4D4y3gyofaGb37Hog95FH4JNpq05QM0VY-bNOSgRuxrvC7ccAx4Ki77W3gCexjXHZI52jzLsQF_c9r9XXNsOBS2JA-DkYTnMy0b7m1FTwA8W-Z9AR5nDW8nfqecIK03kcnBE3G2Iu9Jqk4RXELWHA1CRUb8gEXqz1Dmih2VGukobSbAdCqkERz2KPCu7oJ7I4l7Rrmp79cCNAwyMDAAx5OJjo4zoOwd8N6vB8ldWQMVsRnshwS_eQR-ojW0cQBDQXe1iQKI2bY8WB0Q45mgxgLzl65jeA-rRPsHpMr05N5SEYXPi6wkaaWEhB8_qqWvqcEtQSkutldsawj02DA4g1VgwfdZ93_-WHoTjmJRjQ7s3RaKTb86UaqbsTy_zoNKyoONnOcmPH_IdKxTjLYP_KiF4L40UzA99XcJCdZtRQHHun7c3Odfag1cjCk8XCAJHCWl852nigImkA5Emqh_OGom3lRZwZt_ucskPkqQ4Q-vkbxCwxObf2xTTW9mW0pvhub6cDMbPbCFf2JH76XjRKuw9Clz6uPKshl0D7jlQQ&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

977f45c5980562505699598f863b2fe68aac6cd67b1f4650b6295d5307d1c137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11274
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 056F 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CzMHVgdd5o4KZ41pexaxevCSS1nXSebGMTInR5eadcApC6DAYFrUc4b7w6Tiq5xD0eq6XxbWtW5_bNNI_IZ_sRl3jyq-v5fV_cEHDCYPLCWoPe1QI

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 056F 3 KB
1 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 056F 18 KB
7 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 056F 154 KB
47 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 37F8 624 B
245 B 96ms
74ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiCsOjSATAB&v=APEucNUVU35YI8Sdgb3YXtr3R8rGHSB3WiKpaknCrYr71sh7iu8Wo3zYYmFGjYvF2hZ8ARyXjAj2qKW2qz3uPdNvp7vSlZfuG5mPFj32zdXl5zP_etfn3n4BmJArDA23p3Ld5z226xkgVw78QETFYlGdapZXWgRLupjhCFK0ZaW1V2zqRPmfS9I

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Tue, 29 Nov 2022 10:00:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FF06 86 KB
35 KB 95ms
93ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D4YZirlyyz5MixO8CFsHY25qLcmDSWk7jzttxpq5IXvVYM9ty2ldfQcI_VXvF-KACnv3AucLYpI4pzpdBAg5nm-yJWU__Lasff1cMed2PQgliy6YdELjGUWM4B8xTuH4zbvQNH-d_hXC4IBAReLmLHTtOoKODcGESt9k7sQsYt2Hx5Mv4&dbm_d=AKAmf-AzvmcI6QAjA8WqI4Jw7bw0SvA7ESno7kM3Yex2M0kIsYErRJ3mYEOBXJoOhsNyhxgqFol_5GpaLMCGaEI_8sSh4670oPtC-wgm4HB59P__P4pzKqm5t9nNpzfyGFQidw3nGhhM4cv4n7PZXCpZb7ekSRQA3kXIhXB9-WdaMdydiLvLa9-Ta3RJ3k6bJ7TAxQ2khBP1vu9kDFLcTL8YBGkmNO1V2hOsN3wy5fBWxPpGXy3QRIe3txwfaFrDl9agV5DCDwqV0xqT-V2QHyrRFrbwFh5zaQDqpU3zRvpZJuB4Z3jzCK4ShxwRVbBKAhzJtCJxS31bWyBriO6ga2TCILiPU-bPwrrYHet67vo6xn7dogbFP7kQA7zK6DRzyYOd2eEEdE_V46fPG7DvQBsLj3QEjpqjcagVwZYtPWD5UOx09tr5gB8igRhggZigjzQhHkUE4cOjfFfhvrpKdc-BdgUcO9JzeoK5WZxT4Uc2v8lCQls3epbVq-0iDmD1CbH0kFRED3gj1Zyz6inW0826KNttAC2IoyprhfbPQQtSADFqDakc9KCOcguWrnM6OCypLJmLH_zCrpaIrnGQufFK56xEdd4yWuO2tn4VMrKLKTgzyOk2jeItzxKKtnrwgi3zsX5Ce-0GeF3H_ghGF3FU2JaUUdR9QIuuwckb1PEj4kFe15_iz3JUgOI2ZVMxg-cFvNbZvFQ7nTS6KFiZZxqsABDuh_8RiLbN5Av040FNQNAbroS2fteU9nyNf83FmEF5Ji5DZPE1ETIYCzccMRcDscEQIBskb17oel7WcBYPIv5x4nxqCH-OX3DuI_fgm12JsdajUBhvoRLshSqDeha6TYgNL1RuInEUOJJjufQgfYwhs1w1etifmyO_6zobKR46HYoeGGilIdiQP5kaJaw3-HbwPHhEhP9XDQ5vK7DtvpKGo-ctdIwpzxN_ej9pZN43bBeb4Vbm20Sb7FmKlk7nDl81WoftLuqYMKpibtLKtZBQGkP_W2YqH5lkzSR5bkJ3AyH2xtCXn1g-25NoXx05T8SVHWtatASh9DXbEN3ahBQNetZDPZOQp4_xkyhkGNGptlmWQ5f8C3_4-3tBkQtIL2F4mGLm3exWfRQZb3CxLf3UFmLVf3dx-AFsi5KOTZXME9QuHl_rEpGY3bRDW2chdkjP1dApPX5V-hg_etm5fPqCKtiJCsRrxLfwnVmrLxByZDY6-1bvo-ud-fLzc4ij-as4DPkUEbTlPQqgH3pH9kg9UhqTg4aE4kHvMejnUb8MYbP2RHfVij5QIjld4dK_u-O9KzXvDeDdByMlTMUbDEilIUR5J7DGRelBUMLwqTfOvFR6-Se8XSXrcWEaRwpaiDxgRAkthoK6dLL7HPg2-OVlMgF1HNsb3zIc3KNjoDe8vTmvegTkdGuICPscO3FGMJzeQ1uSZR85-CIypF69BQ1d4dTh7EbjSuI4eWp8KaVKEnAQXURa3pHH0L_UhRfVhC0tZdh6_j5EmsC5-pCB2nGqeJHEe6Tw0Pu8I3IhMj4-qbmQGvzMAduXJvV1hHPpNNw1AsJff-_roKuZ-YuHYdCWJVtjVT4SqQQu0FWxfdv_KuWKg43ANmXc0_FjigyBVbRRLxAd14xUGXRv0Q14bLSY5254fpCU3cswOZowWVIbxMwAjfPY9OMf53QlO_64pf4RtPm9OnjOKTzqL0_KqertBzTtiwkSMN-aMz84wwPCqChij06mLgLe0mT4p04Z_G8hBmmzaVQLvmk79VjL6j05RSv37_Gx9coA_JqtV_5M9J2Jz7L4sPZ5jY8ZV_iItgj1zEa73zCxxVuLh0rRJH8iaORPGGjeQHRm3VUDDhHhqqcvJjyEDSNADXIbKUiYhYzxXAtzr09nMvjmdXugaB8dUC1XAyXG2bj1braT8a6jNe-CPpuEVEJ6thjxsmWqX5H7uZT_QtW0vP33_NC3J8JISV4pH-LETUnZUWOe8neXO7z_y8mK7QprJM_TzHeN7h9Ad_jwqO3evCpmzUjVGrxCo_lCoR5jVTEJwSQT7nDTKsC9yj-yulnl4PaWBwrCGkGcIp4U9Rkpvt8i0ERi_f_Va54OA2yC7s8ncQP7fbNUe4Ee4JvTKbJ0NV1zvaVBvDaFsvcSgiM9uHf8Vv6gD5J0fPoMBYTqYmuu-wtKsHq9tXgCphO46e4Y5Q_n8KYkWj1ciGLB-Cr86sAZwAgTtmXzGLQPrVJSY0i8Bum7bQ0rtm13btlbMyA3rmj04iafKSwF28sD888IMS6yR-UQOElJbSI92pNcnB4GRdBmhbgsLZZd3RvWS27hkMsClwSuYfOx5TwKg595-iBv58gfnXtF_-qo1am9yGyyWZazWebtQHEBp7puNmnk3Cr8NuHve9GFogawp0cx9g3KACIbZMvC0Inq-ZkFPLGNit6eoyVIuJkyPJHpNcjS3qI9xBFGo5WYAu3HksnK3q6xOjZNUnTMjCkEzqyauyqcxvtYbtmeVe7LGNFzjLUrdk4aojIPuuwb7Cp3VsxXohCl2xBi9pfki42hdCB0OTU6V8G2wsCNX96cWTwKFTYfYmpT6ldFXHVSmQxYlGmBiogrF4UKF0OS8fpd4qYT4jb5KaBlDVudOOTmbmQrSRAjpWfGNCBGG_NJ0e9cCWHvjG657Fbx2LEV9cBQ35Y2FHKNnx28KakT4pJFb_gmiONY6j8eH9ngrYy9rpuaVeGzFCmKSIGBa_Yz6g213-cB8uuIQUF2oFBcxizSw0rBVs3J7IiuCCT1E-jbgzMlBO4TNI5R0C0KfDkNYvXyusWKLerwgGWFdIj69KhIofEibB1eM1r5Q57Da1a9TU9TFB8rqEgYXksnd5XYgw4SFlR-myO2A7o1EvtEzhhN5XfNbf3vCvwgGkjqdT_4lyiLfuVcQjErrY39gXO2wnXhLvJ4MCK_pR7YGztqz0yjjkCyIuwwxuTWwK1lRWCNAZBjdwlNpVa_9wO22xjK6KrkEb3HImeithBYkgT4rIsQc869jzK_UqvIvk3s1YaWInMegUZIrY2V3sRsOpTwHfRY4dEayrlwpre5U2dCmcDdqt7oMzHxe0iK6LlMiuwOSsk8ftWw14T7xSuyhhN_J3sXbX2JsPShyW7zFJVnPOMu0OpV9je65YIRdc7B5G3FbSUpcJBoh8GEuD6b5glAFa7sfIKwhw3Nc9P738PegsQUtyIk-X45jGSkkzC7QTL3XUXY6a2QcVB336ALMnCGNJKHk5yYxgaHOfdCyysTyDoAe3Ir0b3INkd8G7NQdg6y4kBDoiqxsumv7SIaArZC4kzNMbwYhx9sFe-kWrZuiaWPVL2hXE1Riej-L5KQdYjR0q0lM3td_q0qTIT8SCntRpN2hXiEJdWmucpHZAY88ACzWWH31AOHioxVzgBkLgTOJLJulyN8e0zPL6jyjDgNcfgViQuglAUEFOZHPWZ3F-glf8jUyH_Z-jangf0JJChq6DDjPmZGY6b4ndMi0GQVPf8AAH8hLUiSPr6sbyG7mp5OYvPdRjm-ugk3XoubXB280HIWyMhlkNg21KtNoZ8h_KZYKtlwdcxSnXURMDZS57sY6hb7Nx4tU7M96j8MBafJKoTUX7sBGy9V2ilnF9W6RN_pFOyY1F5K9aJQWdQDdMO6Bt2XuzBAESeuPFeeUGiW0QBcdg9FFspnFjznP8-WDhbhi9raDO7pfJmdulE6wzBBW-0cPrfAqf5Ath_PCvaaToutAoR-k6koaXaqcKUdPVEDroMiygc8bP7-e19G59loiIgAgTmvPE2Ilt0q0eAvCotyPp8zplaDGVuu4_Fax1vb59--gV1YedDmktvNf0vPxLeRse24g2TCjdQ53V1v6VhgpOn6WL5SfDa1cLS_U14paaCjZBNqWEh_GR1A311eGtCfBhzFoh-nduO451ygbta9Ot7RTY4_hbx4SgiRWLd8Wrnl8QDmPtlzpnU0Nt2ggUtd&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

62929923a6ee441d5cb98355acbd355d3bdd9d45cbbd7c44f692801a0d0e6c7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35702
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FF06 42 B
63 B 73ms
71ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ARZQ9jnlwsJpfTNdAuABHozo4gcep3xldZ-Em6Z5GvIBguHwTE8D9fzcOzQxdDBWjjGSX1a5bUztYyRPMokc59YIH0KIV60BU1KFMtI9G9pvtx4A8

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame FF06 3 KB
1 KB 48ms
46ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2384
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame FF06 18 KB
7 KB 48ms
46ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF06 154 KB
47 KB 100ms
99ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H2 200 impress Show response
ad.vidverto.io/delivery/ 65 KB
19 KB 55ms
55ms XHR
application/json 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/delivery/impress?ctype=div&width=720&height=405&tld=www.lebanonfiles.com&pzoneid=7471&in_iframe=&position=atf&screen_width=1600&screen_height=1200&top_domain=www.lebanonfiles.com&top_url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&domain=www.lebanonfiles.com&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&referrer=&async=1&uid=5904742358
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 636c76d2ffb8a18232db450234ca3c65652fb71f0e6310b8bb9b51514da5957c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: application/json; charset=utf-8

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 47ms
47ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 46ms
46ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 27 KB
12 KB 362ms
351ms XHR
text/plain 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=242515980550670&correlator=2269686480019574&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=121764058%3A22548546259%2Clebanonfiles.com_W1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&ifi=17&adks=596932693&didk=2365396443&sfv=1-0-40&prev_scp=hb_format_apacdex%3Dbanner%26hb_size_apacdex%3D300x600%26hb_pb_apacdex%3D0.07%26hb_adid_apacdex%3D214cc283df11856%26hb_bidder_apacdex%3Dapacdex%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.07%26hb_adid%3D214cc283df11856%26hb_bidder%3Dapacdex&eri=1&sc=1&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&abxe=1&dt=1669716010666&lmt=1669716010&dlt=1669716007598&idt=1152&adxs=1175&adys=1786&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=f&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&frm=20&vis=1&psz=0x-1&msz=300x-1&fws=644&ohw=1600&ga_vid=1219796233.1669716008&ga_sid=1669716009&ga_hid=606078623&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ee041a9fe99dd4695017a69bf89f44f982cdf4a81db1bf80862e5d2e43ab8e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12051
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E1E2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

51ms
51ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Tue, 29 Nov 2022 10:00:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 mgid_ua.svg
cdn.mgid.com/images/mgid/ 2 KB
1 KB 42ms
41ms Image
image/svg+xml 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/mgid/mgid_ua.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70d5c4de881e718d0b7638959680ba86722d44eecbe4058d20dd77b8d0d97155

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: 1SAKNE8T99VM7FFV
age: 1617
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: ygWvmfZuUKec2ix2rXp9wGADIzJEt4+BbxwpugjObCowudhzU+Mv6OMB7bKnKqvKe27gjoifOFM=
last-modified: Tue, 08 Mar 2022 17:05:01 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1646759091/ctime:1646759091/gid:0/gname:root/md5:617c205137825561208ef7c1a2d8f319/mode:33206/mtime:1646759091/uid:0/uname:root
etag: W/"617c205137825561208ef7c1a2d8f319"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 771a7eaaf9cebbcb-FRA
expires: Wed, 30 Nov 2022 10:00:10 GMT

GET
H3 200 Adchoices.svg
cdn.mgid.com/images/logos/ 836 B
1009 B 33ms
32ms Image
image/svg+xml 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.mgid.com/images/logos/Adchoices.svg
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7992a4430843ef8b4bbae534358be3193aa1ae9c78f273e8e8a70b6af1244ac5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: BQQP2P0ZGAY0CMXJ
age: 6099
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: Cxr/h9GEH2cm2grnKHiXrIw5MioqY/kDhHlX9SIKfHkMPhFjrTu42FaOoPgYIABs4KQfQTtjm/c=
last-modified: Wed, 17 Feb 2021 18:15:53 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1613585745/ctime:1613585745/gid:0/gname:root/md5:7d59364b7ed2df3f02507c9f92560df9/mode:33206/mtime:1613585745/uid:0/uname:root
etag: W/"7d59364b7ed2df3f02507c9f92560df9"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=86400
cf-ray: 771a7eaaf9d4bbcb-FRA
expires: Wed, 30 Nov 2022 10:00:10 GMT

GET
H2 200 492
img.rtbsystem.org/481/329/370/87e49c17-1bd9-4232-b169-039733f8b9d1.jpg/16x9/ 20 KB
21 KB 117ms
48ms Image
image/jpeg 2606:4700:3038::6815:eb8a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.rtbsystem.org/481/329/370/87e49c17-1bd9-4232-b169-039733f8b9d1.jpg/16x9/492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:eb8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cea030358c8f7ad5aac21ed8ea988b7726d924381bc058c401ce0bb285f51bbe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 16 Jun 2022 10:17:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"62ab034e-7d75"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jl1dqN4h0Lap0UYmFRgmevcYBJZKl8x7dG9wWnmJpKq658bAhu94bgKUFOIKc6pZmg1RKJU%2BUJeG%2F6qi1qNewG7%2B2vDOVOn%2F%2BfiqXw1TwQG2GVsYZQyD0FSInxxDmXX%2BotYMEZIXVZoTUhr6%2B2UaYw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 771a7eab6fb99c12-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 20745
expires: Wed, 30 Nov 2022 10:00:10 GMT

GET
H2 200 492
img.rtbsystem.org/201/265/253/16ea473c-3a2d-454d-89ef-5da23d497263.jpg/16x9/ 19 KB
19 KB 117ms
49ms Image
image/jpeg 2606:4700:3038::6815:eb8a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.rtbsystem.org/201/265/253/16ea473c-3a2d-454d-89ef-5da23d497263.jpg/16x9/492
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:eb8a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6a2fd3a8526ff9bdd51962f47a322040bf774b319149b53a1279ba615d3fead

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: DYNAMIC
last-modified: Mon, 06 Jun 2022 11:45:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"629de8ea-bdf7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OZvaMh0dQhxAuQ3qkyczcTQnmTIjuqxhlBvH3MGBCeY0gxTm1uD7OoRogPDQ5Sr5e3fJ%2BonOEsagsm%2FRBQ%2B0z%2Fb%2B6KgqWXeb%2BoyBnLmX7jutMFDICiEQOHmtaNaxfdndnF0Ny6%2FqePcPqmdZHmpS%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 771a7eab6fbc9c12-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18953
expires: Wed, 30 Nov 2022 10:00:10 GMT

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NzAzMzUvOTVjN...
s-img.mgid.com/g/14242859/492x277/-/ 21 KB
22 KB 102ms
34ms Image
image/webp 2606:4700:1::6813:854e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/14242859/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NzAzMzUvOTVjNTNhMjU3ZjI1NGQ3YTUzYzIyNGFhMzBlNzUyMWUucG5n.webp?v=1669716010-inSW1gQQNpVvzEKTmjAjptr8xjeLmlxhujTn9wd4UkA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 52c1037c9ebac69278731841fbd602cb160b4acfded6a1dcebe749c7d4d58e99

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Nov 2022 07:09:56 GMT
x-mg-request-uuid: d461c4a5-d06c-47fa-8d5f-23cca1cf72e5
server: cloudflare
age: 96558
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 771a7eab6e85bbd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21766

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NzAzMzUvMjQyZ...
s-img.mgid.com/g/14242857/492x277/-/ 21 KB
21 KB 91ms
24ms Image
image/webp 2606:4700:1::6813:854e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/14242857/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NzAzMzUvMjQyZTFhMTI4NTQ5NGNmY2I3YTllOGNkNDA4OTg4YzIucG5n.webp?v=1669716010-26_wyPLs5RlZCSoQwXlGUcboKlPvYxOG-_wjesex5iM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2f213a0b91d602b18dd86d8e02ad49f5d865a65419f3d9670dff7eb6ee468de

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Nov 2022 07:11:03 GMT
x-mg-request-uuid: 16f67730-d4c1-4ca2-b9bb-f01e8862c968
server: cloudflare
age: 96173
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 771a7eab6e86bbd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21118

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0xMS82ODc2NDAvYTZiN...
s-img.mgid.com/g/14647894/492x277/-/ 16 KB
16 KB 98ms
31ms Image
image/webp 2606:4700:1::6813:854e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/14647894/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0xMS82ODc2NDAvYTZiNjBlZDAwNmI5MTk0NjgzMzY5M2RjZWE2NmUzZTguanBn.webp?v=1669716010-OL9omOD6_EcQfHO4jzFhs084Osy8AKlUM816zkIj328
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 905e52cca1d830a7cebf2aed3ae64a20bb53a27badceec91ea0f7b7aa1e9956c

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: HIT
last-modified: Wed, 16 Nov 2022 14:37:48 GMT
x-mg-request-uuid: 006885a8-c021-451b-a89a-ccef9db79a94
server: cloudflare
age: 92466
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 771a7eab6e89bbd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16122

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNC8zNjk0MDMvN2UyN...
s-img.mgid.com/g/12658887/492x277/-/ 7 KB
7 KB 120ms
53ms Image
image/webp 2606:4700:1::6813:854e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/12658887/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wNC8zNjk0MDMvN2UyNGJjMDc2MzQ3OWQ5ODcyMTc2OGYxYjY5NzZkOTUuanBlZw.webp?v=1669716010-OO4VQgxRhNaVB47MaeLlKdUADFi9etVJ9FIXJjJelJo
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d9682f659b4cffd17cb24ac945ecf179a358626db70aa2c72bded9154d247f5

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: HIT
last-modified: Fri, 08 Apr 2022 23:07:43 GMT
x-mg-request-uuid: 10353ee2-36db-496e-984b-8f8382fe1aa5
server: cloudflare
age: 2980140
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 771a7eab6e8bbbd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6986

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NzAzMzUvYzU0M...
s-img.mgid.com/g/14242860/492x277/-/ 19 KB
20 KB 97ms
30ms Image
image/webp 2606:4700:1::6813:854e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/14242860/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0wOS80NzAzMzUvYzU0MjEwZGE1NjFlMTFlNmIwMjkwYmU4NmJlNWUwYmUucG5n.webp?v=1669716010--sPZixOjbrJqnMWcl11DBwk5qTwh871CN8_-vmmgr8U
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c71cae41178a9a40835bfe22c8838a40e13e330769413c46e9d721d180611b3

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Nov 2022 07:11:42 GMT
x-mg-request-uuid: 236f92dd-51d7-4221-94bc-0f1201295ac4
server: cloudflare
age: 96173
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 771a7eab6e8ebbd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19940

GET
H2 200 aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0xMC80NzI3NjAvZGEwY...
s-img.mgid.com/g/14701459/492x277/-/ 6 KB
6 KB 94ms
27ms Image
image/webp 2606:4700:1::6813:854e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-img.mgid.com/g/14701459/492x277/-/aHR0cDovL2NsLmltZ2hvc3RzLmNvbS9pbWdoL2ltYWdlL2ZldGNoL2FyXzE2OjksY19maWxsLGVfc2hhcnBlbjoxMDAsZl9qcGcsZ19mYWNlczphdXRvLHFfYXV0bzpnb29kLHdfMTAyMC9odHRwOi8vaW1naG9zdHMuY29tL3QvMjAyMi0xMC80NzI3NjAvZGEwYWY3NjVkNTM5NjRmZmZmMTM3NjcyMThhMjgzNzQuanBlZw.webp?v=1669716010-jkdEuV2V9PmObZ8wdTEzSaJUr27-bcfdwEDGHeuqD1w
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8113780bd512b317faf7c7f707e4da322adcd057bd6c71a523e4cc9faa4b5819

Request headers

Referer: https://www.lebanonfiles.com/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: HIT
last-modified: Wed, 23 Nov 2022 09:21:52 GMT
x-mg-request-uuid: c985b4d4-5adf-43ef-83e2-65010ffe93c5
server: cloudflare
age: 520698
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: immutable, max-age=31536000
accept-ranges: bytes
cf-ray: 771a7eab6e91bbd7-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5768

GET
H2 206 c436919811cea2a26653a676525eaf4a.mp4
cl.imghosts.com/imgh/video/upload/ar_16:9,c_fill,w_680/videos/t/2022-11/547258/ 519 KB
520 KB 97ms
32ms Media
video/mp4 2606:4700:4400::ac40:9040
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cl.imghosts.com/imgh/video/upload/ar_16:9,c_fill,w_680/videos/t/2022-11/547258/c436919811cea2a26653a676525eaf4a.mp4?v=1669716010-tLcQgesSeTSzxnaR2L7ThFOy5RELBbQan2Gche7vN00

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9040 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60557cd00b804ea788377136eb18eb62351c7b677090bb2af4f2bd1531dab912

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
cf-cache-status: HIT
age: 555517
Content-Range: bytes 0-531708/531709
server-timing: fastly;dur=2;cpu=0;start=2022-11-16T03:37:29.315Z;desc=hit,rtt;dur=0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 531709
last-modified: Tue, 08 Nov 2022 09:17:18 GMT
server: cloudflare
etag: "f1b7498875a4e0cb1b4db39aeb0d1690"
vary: Accept-Encoding
content-type: video/mp4;codecs=avc1
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
cache-control: public, max-age=31536000
timing-allow-origin: *
cf-ray: 771a7eab68bc9948-FRA
expires: Wed, 29 Nov 2023 10:00:10 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 77ms
76ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=242515980550670&bg=!lJell9PNAAbvMpMzzzI7ACkAdvg8WlUgTxUgDWpP-OxT4_OGc2xLGv2SpHiazQKFL7IlpremQTkv0AIAAADyUgAAAAJoAQcKADTawXOyr_nHEgD7c6T49dH8uxq2F6ccNozhpkmFs6P9FdYGJYVdrkPXwyMcNOQ1wuiJhxk0mQKmg_Q3hREV1gmRPUZPkaIV1T_MaBGHCBDi_LgLnfl7uF36LuJiol3PgvHfJjstiLWhQ_BBCLpXbzNncd0OJRZ6QSkoDnUCVdhayfBD_kQA5cMVX419YiHObVdg1CzaNUes76oxkAUcCDIFRisWOLsa5aFCSiGBzm5un-SoFX_igAO0DdXY8IrSqvJMEKQ-v9Cq5t2j07vwf52pZ2xESUMYwqjv_WPG2A9KLXBeQdV8um9DQ1IuHeKFnDD5y-yW93o8EYGDCRupynKrBZKNZYc5Y_JSuZ8oJnA1F1mCOi3okuTahe6drz3JSDHHBT1IfTDyjsGZY4Hxh7w4cSTYD1XJ3OFMVMx4WDANERZpQ1HRdf7YS49pw0t_H4RmWDT_fgzSJBAoaLMet8khBKQFiIq_4SukLdEatlk05IKjwG56-e1EGBZyUc3X2p31TFqUMxKVbDa_MIoAf63KASUV6QPJwCeGbdJl7yuJVWHpC_J0KFB-aowd0DEVCVLxrsdieOqaFpgG0yrDpW-FwWBC4fB3-eHg5c7U-m4JEU_J36UZvF7Q15KUigmdh9sj0R7ZDe-VjfzvtxtCf90R3jkY9YxNUxIDLMoKl3GaUAo29NpjHJY1-hbzHxIrIKa7d5OGXqD1QL3ItfRRPoSE_FNpFrMUdIDpKkD7Ild_SCFnlyVYb_PxiMFKnbOJft4g7c8wBE4mAkGpTY8KpvEsSgrXBnoO3YODapcXjL9GpvNABvOiuNhFRtaYum-paOF-UpLnBPVCiG-OIGDxI8csdXkn1Z50d5SZCAF6Tb9_nsIu-dQ-sCUY1cwct3gQ5m2xpgNEbi0PF2yxd4nzB-1oESFd-70c6Pbdd7p3vWo6EfzGsaTt43VRgoKt7I54VaxkBY4ZYUVL5Dz8MVG0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 i.js Show response
cm.mgid.com/ 0
37 B 158ms
144ms Script
application/javascript 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i.js?&cbuster=1669716010738844173195
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-ray: 771a7eab8ac09bd4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2 200 i-noref.js Show response
cm.mgid.com/ Frame 7302 0
101 B 127ms
123ms Script
application/javascript 2606:4700:1::6813:884e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.mgid.com/i-noref.js?cbuster=1669716010747827801671
Requested by: Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:1::6813:884e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-ray: 771a7eab9afe9bd4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 57 KB
17 KB 79ms
27ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: jsc.mgid.com
URL: https://jsc.mgid.com/l/e/lebanonfiles.com.1189476.es6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39fae3dc476aaaa594e2c963401633dd5d02eccb3c175eda03912cfe0f91c92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 24 Nov 2022 12:48:29 GMT
server: cloudflare
x-amz-request-id: ZR9FS0KF8SF3XPE6
age: 132
etag: W/"9ee82d693d1e83b3a37ee20226716f78"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 771a7eabecda5b8c-FRA
x-amz-id-2: VistZBWckkAiP7GIvEPImKlKdXTBIKzx8WeKiNFm3NFnvLcmQwjT/xkLRFzAOFbFMk+ugJS7Fn+m45POSdZmLQ==

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 81C4 106 KB
38 KB 145ms
41ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Origin: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77877
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 12:22:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame 81C4 8 KB
3 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cw9GDWt0umk2ObPtRza1tvoF_jD7M8-MqrfcowmQwJa6W6egSNWt_HCqT9loMTZZZquoiTdEKO7meXbFNZalti93keJQ&cry=1&dbm_d=AKAmf-Dw_tAgbf96Z4-GSgGE_eKnXZOrxhz3Jai6n-nD-_XSQocuB2h-Q4gWe6qK0sCrP2DtW2USJ8pJIwYEi9XVS36ZX6KM73PCJjOzQbNr3LIbIANK1052RALzRVErgk5kbc1jVToJ3j8P_nYq6hQqoJ20e8esKLPf0d60FAqoCnrE14pOYoJBZcsCSbGaHVtn_gCja1Hr2mnbIqjiUf6SCiXxTuBV1dQ0bQ-kWbAKAFCmK_V18CKbxGmHvLv5cAl645mcb0pjGpKxFbsgAEROzuqpiavu2Ra2nAD9JWqXWpwNLhGO0XAgjx2J_4XLkPooGL5nsvk6iikbY9bhiSFZmkSH548cMizMme2Zg0Nqmv1PRF2MZCPamycHhyYkAyt3hQ0mWLFJlR4lC0xKHH5LP-JouKWY_c1OwtcNxlrVrXWoODZR2QV-HDB8SH9g_hXdvFxDin3dtFs2dobgoSx02xa3DPUPSYuF53AKzSdwYEnWwegcfJDHmhJwevmUAMflkzvr7icZcPB-rDYKyoCZPfCvYjvtU242CpOe445dj4z4sBga8e6qaUvnHGPfMf6Kisx-d3W1O5CDKtbqtjddNhuV1RwFZDoZ81yXl5Z-O7uMaVS0EG3En2yOlB6AjISuCW1ue9MozLUDjgwEiGfNMDVTs7z8dDBmYLIcWuox0FrpmlBOEaloFubbylHcPwsuRTId_D9ZmSztAURzLFXPkPKQousfAIlGm1W2RE2ZB73ClqarW8rKdRkfR-uaEIgeNc1VNcDgwiVskIm3VC5cyStCcg07YxhEnRpalQsisF9FAHuo_X3Luh2ZajUcteGTXww5X3v5QDV7fxDuobzpjbQEjpuqQVWEKV9hPz3Hdf2kyPlP-SACrWrJzA7dSpGViNX_VoJH1Uq2QMkQNoIWTUJB2Xod8KPcoMeJ0S-wACjuR6k5Xdz9ogfy0eG8lqqkfqWxpKTBk-f6ssn0mSRHzW7h0OutW7RSKo9q4G9JxaNUiM-AfCyjf3criY8E_nk_GYIOPXSw88Y1HSq5KuHkYS9bfXDfyQ4Eb2xgZHfxzgJsYmm_G43sjHMEhCvkhuYrCgY7M9XC1EAMoTuQgr8rdGhPqR_yS419IeSDQNEfuZHxOVTAe9ThKdfK4sz4kdQezMVKDIF_M_ltZ-vwiLLKMl0-UO9O81MLChsfT4FAyTdD98z2JaivtF5itbnXASSmHcIctS-gddDSHSa7WKVqPtqNqjxv1N5VCZTp5Rdz7av1BZVvPogIoiqgWokZM83_J2vETRx6p2rwyN4MCcGA5WC5udYbF-BxG_xrOa9aWNCLAr0ZkXOphUjDgJrUpgT_pkGYG0KOYbl54eADKmoe-RO0LY0UIP4C0eXdaEAl7FEXGT6C94hYFaA-Bp_8k0MoAWZthl9xz4kR8Q470Lep2MjDSPVoIrLJhVGLtYFJ9Hlctag-l8DSiOlPaDQ3KjeaG4GPWqayN0z4xp2Y0pxe4KJq2fBqmNg4MVyMf57I5Zw6NwDGUsD3MRlQKZFbqWn3yvRH2nzknpMrFuc5Ki-8xvCdko5mR0_5EAHs90HVVZcy57bDddKtnM5KtSnrl2uFPKNQokkPhJdL0Of6lev3oHJkm5U_TpCYM7-9WTGuRo31XR79CrpDHxRx7LgVpH9G7UK3mRQJggrjehfGZ2fR1baOy6gloLAwll3MYME3LQwFtEViQpIGxMifnnrVYHQX47-WIvDKWtrLaL37eU5c9UVfZHKRcHBPWwc0LmKLAwkKyil4FwK5YYd6Zi-nCgD_lXqB4Ia_Pr9pWwe_Px23aPPDyLn7ZNwJy7NIvB2yMYjS59mizd0p7p9qoUyFzfloVVLUdqAjaiF6qKpB66yQ4PIRO7OtuqWbyTIdotcIuurn5TR_r7LhE6Qv_ifzGx8QO2WAf3c6jiAASsFuUtYTVjm-dsvKhk25-K86LouzWo9F9FzovpFfG3NT_wR7vIE6X01FoaTbT4wz53zJsC_W4uMNw5HvdYG2kfH6RHPmIrzrfJPL-rn5HrlN6PFxu1clS_lXgBL-xLtaC4DshBdOWLauVhulzf8keXRH06Zn_9WDG0LvS8Jb0hBr6cWV532B6aMMiMEoXtnJc36kyVXiaAKSwjvFVZ0dmZ5MjTjfGd1dPokk6i9rucqFCAl5TNmsXj39IkDpjd3pMAiVgiqxqfNtVNlX5qByJhbi7M0vwUvX5KKBS5pDydOQSl7-SUbtdf5Ujpv0bCAYh9GO4_paGrOBaoHNs6EzuUZQW4sK_OkSAaaI46ho_9OONwNbGLxFsnir3Ps7WXL2T-eQowhuycfiU6vYJKxfkoHOUbirVADhL4aUGY2PlF5PheT9pIJHXJjnDyS8a9iliRil03jdrEzEFAt97vCFcwpJyfKVpD6yPux9IyaDg0UUfQ6EZAOvmPKIOmWc4Sj84P6z4nvgOLE3z_mFZh1Qsz7N7NwFSyC1giWiXov75JJmXqPAm4CEeMJDhBaWGJ5Lvtx0V2Fa7nRNILgnwNJ2KKe5poAKaOnYpUyx-KNLeJ7LsEViRr3yUSgwjKIHohEC67cYsLGMgD58Hm0p7DmjOgP_bl-tAy3ZycQLCeUqd6j1yXPoXzjCuWiQ2VyMKxgSDbi9ViOgJLJwo5EHeecYJsv_db9mUt11i1Lm67yeI68UydAsPWeEEGTL6FLNXq6TsU3CxnA9OQt_fCP089hXP0JtwalZtPZhOFEevwhOBY_NbMJqYJfIs_GcrOwDYobCFBWQ2jiLwYgft5Vd0UZaiYk7QpvPwEhE0pfVR3nSu9G6--sliOHqVV_Oq3DRr0EMfFDcC8fTS2gOfLw42_XSUy65IvqjxWW18Gz5H9jPTeE4b_Z3XaFqU-rXHNPIjzXLWr0Hn2-jGTHmSrCYlecCnS93AUg4wsIY2MiPd4vw-ug7J5gj9lMJOcLlg2TxgYafYGxoUDfp-_zG_K2NYR4bo_slPqqkg12SbMLyEiR5xfD_Hijze0dPzXduAdrtymOv4iQqA83GWaXhcjeBHUNtWCEGC4Fgaad5H7eat-EIuRnqbF9VBuDL2D8RCffSAGbXEhlXL-SDKGaQMfiJAnc7iKnHFDNeTpb73APBD6UXMc2X0NftRnc0KNXF2zsACeE_ZResgc_ZIPgCAYRt4eVXa92MqfxA3qfocxoSr_7sTxtBndk3bZvFR9q2ZaMzpbtw5AnucGEdzUxi6CCkgZzT8xAk8Pl8WhQ1kEm-a_izl1L3FB64p4xW1HtVtDw1CikIomrliVJHwRAkuzyXWbSXC5vJQInUGdGgKsbrjnmawMaoeR9aD-51nApLjLU_cFjwoDrsHUQPaHWhv7CcK9bpj6yNkiTYf1cpcGAuNtnecUZfyrazIkNtGoDV-MFaaktKZIzDBBQbKi1t5-u1b1m28DcD62w2gXWAuhesALkueNe44rNhsfgrZVn8fcovAfdWZPDMVAeCVq9_X-zLfbyAgxm9lCne2vHHE_XQzqlDQ9L20BrWPyJK4FSBoPNCrtXTFGYbK_4HydxsMogZ3FmkK8WvauMXDR1t0ytc1gPf7GSvfQxD76V0ESm1bAEjjnFChA8tfZhaIEgBA6n8yEOyJG6mhkJSyRIpMMGu03ng_Q2mbp3U6O-4mCIT_n2qmYJVCC0ZMPNUXvE4Y_YcAaK4r-ycQ7mfE7JIe-qYB_eGAeIKV1pS3wrKEAXHsOPolYM9FZ_inwDBRMUTB07LqQ&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 81C4 29 KB
11 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1269461/67381783/ Frame F093 46 KB
12 KB 127ms
32ms Script
application/javascript 52.30.202.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1269461/67381783/skeleton.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.202.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-202-51.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a8b7d380bc581d3b7027a38ffef6460162e1bb5989bac0da8bbb0188b7c42efa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame F093 106 KB
37 KB 201ms
108ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Origin: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77877
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 12:22:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame F093 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BrrkoRnJWmCl-QBBaSE6wrROrJF9hQvXR4Jh_kBQGH1KO2-IM1zf3tWH1jfJLOX5ZOunJ-oDBEzUyfeTw_3yffMu6f_w&cry=1&dbm_d=AKAmf-BKgP81ncRwWh6YH14M-cGjT9fu1aXPgQYNuWpa_O0Hbs9q33QTr1GmV_fWsuTxOK3y4YhsfvaLojCzXwL5WlCg1xXDJ9MWz4uGIxCCWX72K9VhT-Ly-prm4zCj3zWuqD0esJWqNp51S8M0bPVXTAY_8xUHnVZf_co2PXMLlkP3dBNnbZuvTk0F99hIqn2pi0FqXDaQwexahR-TVY10rRDoy365JTdakhmg4WgRjTbcOW-px4gKk0XFKa5ToHMGcx9HyKi9Db0oXwP5VNfkByqZ7inMMVVy_RWKaXYWhIILMo5ZLas5A6F0DEf_f9CRtm3PM5w9ylb75fFCnW708nLwIZK14yWNTJ6AZpSscvq2XQR7MyRgz2xQrwVbtHK6CMENxYTYzeW4dFrrqbaYvs0pU2_cM09C6H-I0GW100yN0IHVG0Q4ClGHpc81gES7d781v88LV72mYfrkiZGDRAXaGoZ5MM7kh7b1JOZxNnIa_aHMW6KUAS6CQvHTsGdvucK-FkRT8Jut-tJfg-kOCT9SMEtjl8IU1Y2WA5ZL8XY4ibTvCzo-HgrgJvt7WmRUsAnclu6XF9GkBp-oUDUfOBXmyAjcd2gvIGGKJiu5m_xF3HXky7nL5NqauzOuRuw1cKB9TlY0MpSEtJ3DdHg3kQCy13_vqDoP-FHXG2OATv7363vkgeVpiLQ1LKj2gzOTkCABcLoWdFD9WyinZYV3KI_PTlrfWzydISUI2vJbd0quvIkLKpB9Zf4oYKLKgX7Xxuw0-A6ip3VtpV7c6Gt_dbfKNOpMfB5lxRg5jsFyVddwy2pzKjb1Uki8ksMwaNFfVmzZdAnL1Wtu5eVwYjmtnZr1fkhnLrFFIvrNw8zRVDyRQ29vivZkyX6N27UaTJPTzwJ-y-B8KEliVHoY01kj_H7uXU4bo9b_FKY1_XDHrJqsHg0qPmOSJI6_mYBtW2ln7vrewOAgg0p9-CJ1esNrBFxCV5rJGU-b7eDxD-gc-y0uZTKMn97zb4bNFZPbbhY--unW66m8o_dBFGIMI24n0D9Q1cpxzyuAjh-UwihN0sdjCaXWy17CP_wMezj25vqQdcBuk0mwTZZAIIC-HgSRNPYiIhVG2NV7s4rLFXETLllPZxa7SMNy3G56paE0M_sA712bs8a2CRlLAogMzGTHLUGxFNTvfvLcbTzk00gtAEZfRk7eeJvahRGWkC5L-7TWfLVYoXr4nsxP9EqFRfOSZrFDGUlPqwxyUBJUDXiVqZ9AF6Jjxu5jZByjmQhrXOUNgZ0I_wuRhZO_xGS7iF1gBA8IJZe0qI5YnBkpRo0uIItFTMWbIamm50vrjP9Sr0rceqjebfCY1GWlQj9olUnRlEtQEDWxPzFKvWbN52d18xo3R_mtoK25--K1wSIfW03SzNjMJkmSYTJqfUSzqvRvXGzrj0-Lnnj2ZWe46okfadda2LOkmpDUAxQTLl5alH2oXL6_ptbdZvLLATEzpGueIaATxUZJnPGteEU5ehToxVMeaFd7LlAL71vL4MSmBPaw4iiIKrBGWoPZoq9VTkfrNgEJ18pue64Q3exJgQdxASbGHFvdjD_uf4OSIXXmKht2Tzl3xTZPYa6Rqn3NVd3a5tEnaHt6N8mQQl-xbZir8kfYP9r5qmdy-r1LIN9h5SySsAl9p9yodydIfY93w5ItCU5ExDy6vKy4tj-K_d3kRQs0dJ_gJ8yN-PwlYB3DNQwvQURMQlx9uEHBHpbnp0waVC3XRiKjEGwPUTiltywqm-Yc9j0xcUJia5BX6T9kerrxBFxWav7DZAVpvZPQlKFVuDBPE1IugjvdCHPiAWk2ievv3ZB5zLvjTb22g3tQb2G_bxEvkvMrmFGy2jk3LdutvVJp2oJSR1qQ4LOcQjmxrkoNoh-tup3SYOQYMA_WdegAr1InnImEc6Q3FNkUVcR4YjSf1c5Uo5p74F9nk_29ARaeh0ep31gYl3YxF2-8fdqlTXv0NuzV0DEV8I6pbwXnp-qXIuo93jZGes_UTwlA68ptKHUTbgcNNFabme5N1aJKGAnnjgriPNnXDwPsfG9L4ECy9kC2Rueok4M6qO2S8ERCYPRffSPjNWufcWV3AvxDoFJ9VYWxtvGakGuVMbhA7JVzRpldG1MW0EeA-o4U_6HrqaxUWRFHbSk4sBxHTlnWEutMgjI36LoLNNh0o7b_-pU4jc2b-Czf1kcxqyc96CprzzCahNnodJGS2oFHL1Yr2wnNF70E69fF8vFbK2E5_BLL4O3FeuuTblr2oDBaE-DOPkJ7fWIBI5AEicN559QecVN8uAl1FFP99nS2QJ78-BN2LxgFMB1n1kiBrE4w3pv7UsJpLZgRB2s-0o0NVWRFM_eE7BN6o7WqcbxrPorRMWO208jNS5ClidWhCC4gOLsgS_W_uNhErjShIVQ9e96ly12BHy-iwdq-HHjfgc3Tdz6p-kVmkPN2ndVLWNUGa1sS6tpfzE74KQO2bMTfvVr1vZInOLXhF0h-Hw-LkFM9dAkrMBpwp4qKSu_7PNTnk6wMoOnW4koMIdEeBHD9WBljNF86LMVTnlLfZ-LSk5Eb28cH8Caf48kdh-eifMyDd0oBKTWs9pYdtSIHgRp7fKT6qKIURwkc3TutUHqEv7r0PIoZoTrCpkxlh9bXdNUPk_FrwtdOwQX6mWkKexBDA0vjkk9_PdhBdUF9ApuEwDU1rP9fGPKLYOQUQBy9xKnfl04t1EamgAdakQuM4v_0fAnQixgUIfA5ZLWZEG0yaFsloQF_i7BaiaqetEOeosxJTt2jpMPMMHRIwnTH6ZJ870M1JHJQV3JuY1KBokxojqT4SZSt1Bcy5Xo2bXm1SieM7mYC_aEuYBPfisGOmkNlUWxZ244PqlEFao_VFjzR53Ne_ZxS-8h_jUAXyHGFKDnBGAJeQZY5GHx5v1-pg4ts_r5MSSZCih0DmDWVF44EAyEoyhZn3DgnO5lb6F_bbYgoGS68D4xobLgRh1mMoUl8e9qSvMpgbfAMP9-R3vozbEezHUGyMg3YcwmBlDCKKVVTwHTHxAwd8Na6XV7WOTiIK8kHNrv1BldFkRfXoZHUamwCxud_XKhpXOjj_YIkue0Zc1OFlgip1FxagrYsz6VihcWsADaPkY8kTw6vK4zbe_sqCnFwaeJ8xSjOO-ts1faHTQtdH3tmJkIb9ZhCzboggNi1QjPq5hrCTHMptrY0B2MRlu83caUTOwbXX_A-XmAy7VMAaGWX3DN2mzU1aWgf97slXXI4-pM-pX5EmhKg6oGcOcagtV1unG8ByBcmvwJ29cpJGkEbzXi5kiv6yTqIFKcoZIaDL87KUeqgTBsdTu7CEws5wN8bnXWML7chfJTo0PzGEoeqaKDd9_Rm6_WzTDSQQ477vpv5j2qszCtdrlWJnfpf4MSl_E9He2yLHHLJ8NYLCZ32wmFg_sFJFS7xWuyHBgM-U_hAkSvWESJ8qE7PRVywPHi5sPPCakUiDOLGo_OP9U6uPAXCxMLo5oBMURh181MMgbOU2gvqD3FBiFZMHhptYBrZeRcWhlDj2BVSStIGWCNkyVLUf65ziv6eMWKkIo5ZlRqVrzGfpT6nZwKmeRH6cennfleEJ4MwdqwBxeseRI-9lWb9ejBYT952xLsaa1kGBxt1GjUajNVDx2OCMP8FBkYtkfNAAxDh9qM86lN_czA5FAQt2G8wxQ9gHm_vALEvN9kRfYm6aFjV-x6AvaV9Y5gMO3Ew0xKILOJ38a_ITBp_DtNWIlNJI_Oa58vwZerq1wbP3F7qFuaov32lspDspmItmsJxmBWfXKjwsb1-ApM6faTVYILJSPSNZxQ20QO1N-O8_9gQyxFUBaOpi6cy6w0DLsUFMdTAZx_1P9s6xIcd-irNlNmhCyzO94jwAJK2GPVYX1EKgEZAkAu18V4HkfmL-6qbeaZjLYi-MBoSwdOaWETW4dGfhAaQ4WLdcZw__uD_&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame F093 29 KB
11 KB 42ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H2 200 moxplayer.css
ad.vidverto.io/js/moxplayer/ 51 KB
8 KB 17ms
16ms Stylesheet
text/css 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/js/moxplayer/moxplayer.css
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: a1fc449201f61ca3ea21d70a29c7539f8bcb19be28423a4e1258e7e1e994b042

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Wed, 10 Jun 2020 14:52:51 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"5ee0f3c3-cbf7"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:10 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/162534/8426/ 210 KB
65 KB 42ms
8ms Script
application/javascript 88.221.168.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/162534/8426/pwt.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 61a7bdb5a3c022130a5663cb3362b70335bdfa6b0a1677f4420c28374ae698a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 16:39:20 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=111076
accept-ranges: bytes
content-length: 65574
expires: Wed, 30 Nov 2022 16:51:26 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 370 KB
124 KB 142ms
46ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2fb94cc5f4e050854cd18abcf65c8e58f62f512e141acf6b256aadbc27f1a48e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126568
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H2 200 inview.min.js Show response
ad.vidverto.io/js/ima2/2/ 5 KB
2 KB 17ms
17ms Script
application/javascript 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/js/ima2/2/inview.min.js
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2ebcdc45625d8bd6eb8cea62780c1128df28c86ef0e10a6369ec23c97d61d92c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Wed, 10 Jun 2020 14:52:51 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"5ee0f3c3-1389"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:10 GMT

GET
H2 200 vast-client.min.js Show response
ad.vidverto.io/js/ima2/2/ 59 KB
13 KB 20ms
19ms Script
application/javascript 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/js/ima2/2/vast-client.min.js
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 04a436758e8992373a49eb612d5b5f54a6fe9e6b1aedab24b510411630fa99b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Fri, 17 Sep 2021 18:13:12 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"6144dab8-ea58"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:10 GMT

GET
H2 200 ima.min.js Show response
ad.vidverto.io/js/ima2/2/ 86 KB
23 KB 31ms
30ms Script
application/javascript 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/js/ima2/2/ima.min.js
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: a57b6e167e5134b5529553df1bef1833a0aa1e3912323a6991481f5f6102b161

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Mon, 28 Nov 2022 16:27:51 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"6384e187-158bb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:10 GMT

GET
H2 200 vidvertoplayer.js Show response
ad.vidverto.io/vidverto/player/ 129 KB
41 KB 32ms
32ms Script
application/javascript 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/vidverto/player/vidvertoplayer.js
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 8387013ae7c0a3cb9f15765f5b7693e4011a26d041b9109781d554ee93031bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Thu, 18 Aug 2022 07:44:44 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"62fdedec-205ff"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:10 GMT

GET
H2 200 invocation.min.css
ad.vidverto.io/vidverto/ 3 KB
850 B 43ms
42ms Stylesheet
text/css 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/vidverto/invocation.min.css
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/js/aries/v1/invocation.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 60f74110267d386c033ca330fc5bbd7d2472c972b63b33fa8000e87c8f815de6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:53:37 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"5fac1711-a0a"
vary: Accept-Encoding
content-type: text/css

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 056F 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwzIvHyT0z1MpE6nQDAlWIaHchf6Jb4-UyHnNILZ2liR5AoztcV139r4jcawtfTNOm0oqqoSrZNTUCdsu0QlTrgbtBBj5d69Wvz2RZTEf6oMW4neqcVefXB0-dcUC1KccToo-wQlk97-t5AofyX-VxvgTrLV1gkX7E5pWZM1GKzSCbLLY&cry=1&dbm_d=AKAmf-D4gjJvktvvnQtU-eMnL5eLP3MkAImgqQNrfCCiait7yR4mmhGju5pKM3m_L0J1F_oZItFWHWrGuLhllBFW5sk4MGdlTPooja7rmt4fYbSCvHBEY_ozbHfWvQ3GFpUt0Ftf7cWUuMM3iCZXfPSRQEuGH0LelvnurE_041muzv1N13_sVxtRikv_KalBH304ZaMqrha4PIbpLwOL-rYFVihGq-80ut9DDEcijhv7FmMxiBgdR2IDRdgatWJskuX7noIkUIE1tRh2tYO8GJEUATbkF5f-EL2HlD9-QtWwWinPt6yoFO8ELwxSRMkeI0oMO4MzhT2EDorPwQneaRM3izXZ6rUY5jlN7JFWHNwM0af60JXg6tioz70-YVoRMtB1v_26YFX7FEtu2B56VDXjOpSPMtxOs5iTXQyv_qJdDuRZo_12lXO6V--jTc8znzjUCIDrFBst9gWwxfSSmziE-jNhM8-tjh8EcF5jcs3IxuPghRiw53eUbLCLf2Ap1Nn8gwpexcz5Le-ZjqMo-asOPX-uCYscGr59kk23J4cVHJ6EEf6a7ttuAOl-l_h4qCYgzarccQ8tZBiEY35V4HMkoJlUhKnnsF-N6sfOfQxpaO2-OMoJ3QPHsgY3M-Bb1L4KBqfqKs7nGlhepGr3feHHrMsKSmsIh4Rn9sYunKlW58z-UNc7D_BioS9bbpcaScVkiXJs6xFt8YXivhAfDBlKGV47O0LSlZmvsF2gosUjNc935CkoIU6KlwUl9YScjRKaFq1z-OfIE-gRc8lc-ZY61CwW3MxrQJV2fZCXJKW2Cg_-n7NaP9x84lJ_SNAubnlsP9O1eKz59auarfHbVGVufAd12py3XblsNL86eP-O9xwAnrtI6eZfVmx5gsE26j_0YG5We8fsMHiF77vjxZ5Q8GXit16cxWYpU2pTMsnY3E4ItPyKWbjlM5Qbim7A7RlVCK-I9oqLmGBYUNy-Kwsxp_vLTrvk-TMP1TaNXPOcFXqm4O1AyUzsk5d5pb-X0UA6NSkK2GxooJ44XgWsSPly12oekLmVsT1-ABOUqItNCe-je2i7rbdG6QcH3LIZm_fJozzvYtDm2f2p7H-6K7OzqwBBL_pNYld4pD96JAGzdr1iNZwCMud8Qfykg9LrpWR4cNarvx2D6knufZgMSIyvVhPcARoz8tu_6sIEhZYqsPUMqrg5biibBw2gUueEz773D2Xd3RHGKdCZMZmxVNF5q-QnRiXBzxlDRYgNUAKlZIh1bruBL-jZnCLC1x8QP4i1sxsnnFrKm-jUKtTwHxgwy1regPguOvkABnjQ0SS78kAhUlkCrGPRkr4nosXTjCpYUalv4m0kf2cb5qLS4ZrXITDIoqT6tf7IxiWVt-tb0rHssrqwZAz5v_E4Rs_QOdS1a5db-4Orx2SRpciuF3M0xlzpRb7kjkZgk8hnO-RUpspjQJc-EqCGLcbOGvLOnwZger0oQuJijhQOT4P_pKGkE6rtJp8QTTM3dD-DfU9hW9DAdh6MAH-anMG1EFA5uICtFbeXUK_C14UIb1P3UIaaImSnRfaXEG6Dgj3NnEb9_oZK6WJzeMQpu-Pj68NVlftkip0F23cV7LNWC5FZSwGhLCa-ZcoQBu6KH0TJlatUctvyQiABKpELNHAH0aZx7APRS9znM7fB3Rn-Xh5_kKcXw75V8IR0PjqVnKSbZ1znfjBlvKKF0lDeCd1mc0T4pHh-Y5jJ6f2hpBEhXC2wgwZf-pfnjAoWWMN7qmqyBeXucdOJzIzs3RPw4ZKBOSxaFuhsOfb26-K0miH1ZB548hOawXNq3G4LN12P8JX7orA-ZJU5owYdgTZsbI96LWqvaHDSBRp0l84YuufmiTV3XlROo2aDCFQ87Q4CdSuPT0zZTei4IVZlMnaAElSgRisjS5EABC-S0W6KuCEBEFl9XaAy03UiBna2MqHEzR-KLeVHL12H78jqzL1HESxVO8GFzN81w5OgAZ4EGulyHnlQMc-iuSLmY4_JTIrgwXJu1C6CFwhhoCHHSIVVxWLnox8HXYo5rSYbGJ3Ou_rBf50MJMk-sd9QxKJztann-ceu1Gp1pMTt1gfPxq84lhJIahzo_Ex4dWSaOgg61LQ0E1QLRfuOOSB1ifOj_oInMYJVcvZoLUBlw6NtmuVV-S7Kh-HKzj6KPAMsmKwR57qc4xmdSxwrL1ZtV6MFEX-F_dXPUk4Amfam8guk40GalIFGDS0_2S7BYpFo6wINl2E4uVmByNlmuOE39JzRugGzga7g2okNC0NPiitw9ibZyjnX5CHZVykj1T8vv347OjIY89U6dJSci8DwT_q6JBvWwz9NhR9do9bKGPUU7MjNK6G62RjngijQSA86j_gqRcalfeV-YsWa50Xr-9wfbDraFfLac_VC7xFsON4oR9uvW39hM8LGlKGa8FQmlh6Frb_3eGm8twYp_KTlucTgFBoQ0QkWAcjtgMUbSWv7ncpKWrC107z9jNVBWY28-bdE1WNVf0yFMcGmW5BM0vipWRLxZ6tpOE2lCGImWLbWHefXhVTGp9NcSk7-sgeAaTXkU0yffkM3ygVksWG9hj2GHDXQAYQuJCiOITZsVoswYzYsJU0NVB4zabxn9cBkqx2XkkwSgq5rb4cTroi-CqE8Y1EOntgbJrKzE_PX7dVlHWTm3-M0lOHHzhMDUteb7o9QE0aIqKMb2gMOSF1TnlNeEUnEYvOnhyFYLMGuz7DeXRRfPvhk8Q4H70S0Ul4ulXhMerqVFNPVgtrdR_wSlU192nhQ9mkefdwAaSwyfcfzCfa1ByvgSSmsPFkXnF96XGIlzgUAMU9n0hJyl3hYBgLoXtMWV4MmvxalROSegBky_m-_HlKP-iWug73fMH3ONbwaPYXGq73UVpQyNGLniIGre-lQASQaykLKzd7wNHAbwEDfI4u8XHHxCMoWc3RlQ43Bt6Oojn7n0xmJlPGP646M6pWVHgedbE8cb0M_RvtGHmM8oRC0dCnhqTTqwJqxrLlOdDUew9riSkEpKmuJYexdt4M4mMDX15nEL8dBGGY2kfL1H9cIuy7dvzLwso7JaSUovitNm0oZc4lqjWpfL7trVuzCSiqRoCCGQRh_Hjl5Oh8rV_lN9zUuAa4dhfQiVT7vofTKL_tbPv8pS_UEwpTDcMDWHEqJKWo9ALvo6V68g3QzQklxd2gOgpADN0Qm2vAhuKhleDdKVAZkjWy34YQZghyswsRDKXNpAc6qfOEsQNCXBWzYwBu0HbUbJMzAxX32pWEqPXAqYnSPFWv0MXcHEqI34s-NKIfmqj0tSeujawog7e0U_Z8zTfMjhygCQryzgiLSK6WF_zdqwbNnrKsgtHybdj4B8voEWZ2NKPFe6yMSmR2YYnGmdi9CtD9e11kHmMw1bkZKCYX9m56dxf4eWUifcZJ2dJVhQQsOb_IWHZqA2hUlC1C8R9CYgaZmrSd-7BjCBh4MgxmHI9VVNucKwa2rAFuyz89ASbNJlBgmQ6vs3sEnFDntg58YZbpAkPISGiI0EbotNt1YN2zLRTmDu6Zx_oPtXWA85MzaxHGdUdx7hn8Nmqhae7GErQ3dhlEYWvVm3w-HdPWkh7CXqWY6CjDZR4bnZMhrlYzzurHDJ3xA6anOEcOCj6OBS_R3CTVys0v6tef5isZxDHGZAouvCx8aIIy63u4c1R-tlPP88dsHp4D4y3gyofaGb37Hog95FH4JNpq05QM0VY-bNOSgRuxrvC7ccAx4Ki77W3gCexjXHZI52jzLsQF_c9r9XXNsOBS2JA-DkYTnMy0b7m1FTwA8W-Z9AR5nDW8nfqecIK03kcnBE3G2Iu9Jqk4RXELWHA1CRUb8gEXqz1Dmih2VGukobSbAdCqkERz2KPCu7oJ7I4l7Rrmp79cCNAwyMDAAx5OJjo4zoOwd8N6vB8ldWQMVsRnshwS_eQR-ojW0cQBDQXe1iQKI2bY8WB0Q45mgxgLzl65jeA-rRPsHpMr05N5SEYXPi6wkaaWEhB8_qqWvqcEtQSkutldsawj02DA4g1VgwfdZ93_-WHoTjmJRjQ7s3RaKTb86UaqbsTy_zoNKyoONnOcmPH_IdKxTjLYP_KiF4L40UzA99XcJCdZtRQHHun7c3Odfag1cjCk8XCAJHCWl852nigImkA5Emqh_OGom3lRZwZt_ucskPkqQ4Q-vkbxCwxObf2xTTW9mW0pvhub6cDMbPbCFf2JH76XjRKuw9Clz6uPKshl0D7jlQQ&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77876
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame FF06 170 KB
59 KB 149ms
82ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Origin: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 16:47:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 61973
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 16:47:17 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame FF06 8 KB
3 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D4YZirlyyz5MixO8CFsHY25qLcmDSWk7jzttxpq5IXvVYM9ty2ldfQcI_VXvF-KACnv3AucLYpI4pzpdBAg5nm-yJWU__Lasff1cMed2PQgliy6YdELjGUWM4B8xTuH4zbvQNH-d_hXC4IBAReLmLHTtOoKODcGESt9k7sQsYt2Hx5Mv4&dbm_d=AKAmf-AzvmcI6QAjA8WqI4Jw7bw0SvA7ESno7kM3Yex2M0kIsYErRJ3mYEOBXJoOhsNyhxgqFol_5GpaLMCGaEI_8sSh4670oPtC-wgm4HB59P__P4pzKqm5t9nNpzfyGFQidw3nGhhM4cv4n7PZXCpZb7ekSRQA3kXIhXB9-WdaMdydiLvLa9-Ta3RJ3k6bJ7TAxQ2khBP1vu9kDFLcTL8YBGkmNO1V2hOsN3wy5fBWxPpGXy3QRIe3txwfaFrDl9agV5DCDwqV0xqT-V2QHyrRFrbwFh5zaQDqpU3zRvpZJuB4Z3jzCK4ShxwRVbBKAhzJtCJxS31bWyBriO6ga2TCILiPU-bPwrrYHet67vo6xn7dogbFP7kQA7zK6DRzyYOd2eEEdE_V46fPG7DvQBsLj3QEjpqjcagVwZYtPWD5UOx09tr5gB8igRhggZigjzQhHkUE4cOjfFfhvrpKdc-BdgUcO9JzeoK5WZxT4Uc2v8lCQls3epbVq-0iDmD1CbH0kFRED3gj1Zyz6inW0826KNttAC2IoyprhfbPQQtSADFqDakc9KCOcguWrnM6OCypLJmLH_zCrpaIrnGQufFK56xEdd4yWuO2tn4VMrKLKTgzyOk2jeItzxKKtnrwgi3zsX5Ce-0GeF3H_ghGF3FU2JaUUdR9QIuuwckb1PEj4kFe15_iz3JUgOI2ZVMxg-cFvNbZvFQ7nTS6KFiZZxqsABDuh_8RiLbN5Av040FNQNAbroS2fteU9nyNf83FmEF5Ji5DZPE1ETIYCzccMRcDscEQIBskb17oel7WcBYPIv5x4nxqCH-OX3DuI_fgm12JsdajUBhvoRLshSqDeha6TYgNL1RuInEUOJJjufQgfYwhs1w1etifmyO_6zobKR46HYoeGGilIdiQP5kaJaw3-HbwPHhEhP9XDQ5vK7DtvpKGo-ctdIwpzxN_ej9pZN43bBeb4Vbm20Sb7FmKlk7nDl81WoftLuqYMKpibtLKtZBQGkP_W2YqH5lkzSR5bkJ3AyH2xtCXn1g-25NoXx05T8SVHWtatASh9DXbEN3ahBQNetZDPZOQp4_xkyhkGNGptlmWQ5f8C3_4-3tBkQtIL2F4mGLm3exWfRQZb3CxLf3UFmLVf3dx-AFsi5KOTZXME9QuHl_rEpGY3bRDW2chdkjP1dApPX5V-hg_etm5fPqCKtiJCsRrxLfwnVmrLxByZDY6-1bvo-ud-fLzc4ij-as4DPkUEbTlPQqgH3pH9kg9UhqTg4aE4kHvMejnUb8MYbP2RHfVij5QIjld4dK_u-O9KzXvDeDdByMlTMUbDEilIUR5J7DGRelBUMLwqTfOvFR6-Se8XSXrcWEaRwpaiDxgRAkthoK6dLL7HPg2-OVlMgF1HNsb3zIc3KNjoDe8vTmvegTkdGuICPscO3FGMJzeQ1uSZR85-CIypF69BQ1d4dTh7EbjSuI4eWp8KaVKEnAQXURa3pHH0L_UhRfVhC0tZdh6_j5EmsC5-pCB2nGqeJHEe6Tw0Pu8I3IhMj4-qbmQGvzMAduXJvV1hHPpNNw1AsJff-_roKuZ-YuHYdCWJVtjVT4SqQQu0FWxfdv_KuWKg43ANmXc0_FjigyBVbRRLxAd14xUGXRv0Q14bLSY5254fpCU3cswOZowWVIbxMwAjfPY9OMf53QlO_64pf4RtPm9OnjOKTzqL0_KqertBzTtiwkSMN-aMz84wwPCqChij06mLgLe0mT4p04Z_G8hBmmzaVQLvmk79VjL6j05RSv37_Gx9coA_JqtV_5M9J2Jz7L4sPZ5jY8ZV_iItgj1zEa73zCxxVuLh0rRJH8iaORPGGjeQHRm3VUDDhHhqqcvJjyEDSNADXIbKUiYhYzxXAtzr09nMvjmdXugaB8dUC1XAyXG2bj1braT8a6jNe-CPpuEVEJ6thjxsmWqX5H7uZT_QtW0vP33_NC3J8JISV4pH-LETUnZUWOe8neXO7z_y8mK7QprJM_TzHeN7h9Ad_jwqO3evCpmzUjVGrxCo_lCoR5jVTEJwSQT7nDTKsC9yj-yulnl4PaWBwrCGkGcIp4U9Rkpvt8i0ERi_f_Va54OA2yC7s8ncQP7fbNUe4Ee4JvTKbJ0NV1zvaVBvDaFsvcSgiM9uHf8Vv6gD5J0fPoMBYTqYmuu-wtKsHq9tXgCphO46e4Y5Q_n8KYkWj1ciGLB-Cr86sAZwAgTtmXzGLQPrVJSY0i8Bum7bQ0rtm13btlbMyA3rmj04iafKSwF28sD888IMS6yR-UQOElJbSI92pNcnB4GRdBmhbgsLZZd3RvWS27hkMsClwSuYfOx5TwKg595-iBv58gfnXtF_-qo1am9yGyyWZazWebtQHEBp7puNmnk3Cr8NuHve9GFogawp0cx9g3KACIbZMvC0Inq-ZkFPLGNit6eoyVIuJkyPJHpNcjS3qI9xBFGo5WYAu3HksnK3q6xOjZNUnTMjCkEzqyauyqcxvtYbtmeVe7LGNFzjLUrdk4aojIPuuwb7Cp3VsxXohCl2xBi9pfki42hdCB0OTU6V8G2wsCNX96cWTwKFTYfYmpT6ldFXHVSmQxYlGmBiogrF4UKF0OS8fpd4qYT4jb5KaBlDVudOOTmbmQrSRAjpWfGNCBGG_NJ0e9cCWHvjG657Fbx2LEV9cBQ35Y2FHKNnx28KakT4pJFb_gmiONY6j8eH9ngrYy9rpuaVeGzFCmKSIGBa_Yz6g213-cB8uuIQUF2oFBcxizSw0rBVs3J7IiuCCT1E-jbgzMlBO4TNI5R0C0KfDkNYvXyusWKLerwgGWFdIj69KhIofEibB1eM1r5Q57Da1a9TU9TFB8rqEgYXksnd5XYgw4SFlR-myO2A7o1EvtEzhhN5XfNbf3vCvwgGkjqdT_4lyiLfuVcQjErrY39gXO2wnXhLvJ4MCK_pR7YGztqz0yjjkCyIuwwxuTWwK1lRWCNAZBjdwlNpVa_9wO22xjK6KrkEb3HImeithBYkgT4rIsQc869jzK_UqvIvk3s1YaWInMegUZIrY2V3sRsOpTwHfRY4dEayrlwpre5U2dCmcDdqt7oMzHxe0iK6LlMiuwOSsk8ftWw14T7xSuyhhN_J3sXbX2JsPShyW7zFJVnPOMu0OpV9je65YIRdc7B5G3FbSUpcJBoh8GEuD6b5glAFa7sfIKwhw3Nc9P738PegsQUtyIk-X45jGSkkzC7QTL3XUXY6a2QcVB336ALMnCGNJKHk5yYxgaHOfdCyysTyDoAe3Ir0b3INkd8G7NQdg6y4kBDoiqxsumv7SIaArZC4kzNMbwYhx9sFe-kWrZuiaWPVL2hXE1Riej-L5KQdYjR0q0lM3td_q0qTIT8SCntRpN2hXiEJdWmucpHZAY88ACzWWH31AOHioxVzgBkLgTOJLJulyN8e0zPL6jyjDgNcfgViQuglAUEFOZHPWZ3F-glf8jUyH_Z-jangf0JJChq6DDjPmZGY6b4ndMi0GQVPf8AAH8hLUiSPr6sbyG7mp5OYvPdRjm-ugk3XoubXB280HIWyMhlkNg21KtNoZ8h_KZYKtlwdcxSnXURMDZS57sY6hb7Nx4tU7M96j8MBafJKoTUX7sBGy9V2ilnF9W6RN_pFOyY1F5K9aJQWdQDdMO6Bt2XuzBAESeuPFeeUGiW0QBcdg9FFspnFjznP8-WDhbhi9raDO7pfJmdulE6wzBBW-0cPrfAqf5Ath_PCvaaToutAoR-k6koaXaqcKUdPVEDroMiygc8bP7-e19G59loiIgAgTmvPE2Ilt0q0eAvCotyPp8zplaDGVuu4_Fax1vb59--gV1YedDmktvNf0vPxLeRse24g2TCjdQ53V1v6VhgpOn6WL5SfDa1cLS_U14paaCjZBNqWEh_GR1A311eGtCfBhzFoh-nduO451ygbta9Ot7RTY4_hbx4SgiRWLd8Wrnl8QDmPtlzpnU0Nt2ggUtd&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&rfl=1%2Chttps%253A%252F%252Fwww.lebanonfiles.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame FF06 29 KB
11 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77877
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H2 200 favicon-16px.png
ad.vidverto.io/images/ 900 B
1 KB 30ms
30ms Image
image/png 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.vidverto.io/images/favicon-16px.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 42fe10d8382d3fb7f84308b95ae83c5959838f0aeff2cb1733bab9d394c5a2d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
last-modified: Wed, 10 Jun 2020 14:52:51 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5ee0f3c3-384"
content-type: image/png
cache-control: max-age=604800, public, max-age=604800
accept-ranges: bytes
content-length: 900
expires: Tue, 06 Dec 2022 10:00:10 GMT

GET
H/1.1 200
OK 9zr738t4suio Show response
hal9000.redintelligence.net/zone/ Frame 056F 12 KB
5 KB 46ms
13ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/9zr738t4suio?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 74051bfcf9818fd7c75e57cbba6f909af1cbc3e9e78543647b912d5931147aec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:10 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4449
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2DF8 154 KB
47 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:10 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/156400/7371/ Frame 3F17 206 KB
66 KB 13ms
6ms Script
application/javascript 88.221.168.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/156400/7371/pwt.js
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/adtag/latest/pav2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2f9c77b2c4c8a58c7303d4114a4d6286b6b4c47c962f6d4812b5ab43164ff669

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
last-modified: Fri, 15 Jul 2022 10:26:00 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=92264
accept-ranges: bytes
content-length: 66940
expires: Wed, 30 Nov 2022 11:37:54 GMT

GET
DATA 200
OK truncated
/ Frame 25E6 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dab05794c8041543fca34618cb647cf39f702f5e006a7b093ff7db84337cdc37

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 7098 6 KB
1 KB 149ms
49ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:800,300,600,700

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a4961c1ae6e8496067150f54acfa06b0026a5525978c24075d5636d33531fb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 29 Nov 2022 09:18:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7098 16 KB
6 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 04:14:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20766
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 30 Nov 2022 04:14:04 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 7098 34 KB
13 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:55:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Wed, 30 Nov 2022 09:55:17 GMT

GET
DATA 200
OK truncated
/ Frame 2DF8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41d2554b662c849030c43ac5116b287ba4d0c9643ef14e2360930173f0f6336f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 6B6A 2 KB
1 KB 54ms
14ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4XYKQAIJYkK0wshAAmvIB2F7w53QIjTwTf5lA&u=%7CH4%2BVDK1C6ormMH4QsP8CTufYx8uzElg2NCKolFkSIrk%3D%7C&c1=jWCgqsKSUoV3SMf7iUfSyMCnTpn87UHNWAfGoXO4nLFqnE480YHVHx7mz-K5ZBShjJasfYEbwaoSgg7uYPfNMr_Nd6DD_87BtITfVAWtbG3zYaNHdkeC_wBVV-DNZIhXWUCeSGam1zaEaHa7zu3_uVpOFE9c3Nunz_WSo4doKNiSGz-Wr-mJ38Rqh-gpu1vUMiN7-PeDZNstBSrlVDur3cowOi8dqw-l__ZIwDH9k0LPCbGY-n8qpRejA7-LLA0qKxHVDm2CuRQhTQ0b_dND6Yq8n9NhGdsu-yR50N-ZlWkEKPN5DEiPIAkGlDgLTdc9wwPvB4HIVp85hw08Lnf__88RmWXHR41Tep9ceK3DD5s3m-nZWk26vzA6xI8DVSV2S3Yz-RX9l0ygz_1g9nCepTC_3wPeMVhnT5JXl7ZpPvgaOaDrdGnCZJIP5HsZ2wGviA2wsgfhEX9CS9l3i--O_ZCLCnqjNv8FUjxhynb_MdDmJmYAtUvbKi_hrW15dArXaOBYPJioUtfT6QLDhg7fliIk9541xsHFLZfc2gZIRKHU8dnCNcvRVYt3VlyuN1ID_F-pXcqzFo16D7j1Laq8HpWrhTWqhpGmSbd5DPP9u0OuKC0WDj7MzSrApp_zdIXj&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCIF67KdiFY4nLIKGWzAag3qaIAcme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItODc0NTU5Mzk0NTYwODIwMsgBCakCLtwKvpttsT7gAgCoAwGqBP8DT9BQUWAFSdqyqOBXjQBcwJiQAVX5duXPB5hD0wFSfR1rjxwAAdnRRxg2leuZquiOP0OoDE4yTTSjJ32eymkvm6MskPfP1RRVGODIHnxWNRgzLjdPp1eW-8GUjOWM1CoUY8v-Rd0nZfVLdyFM1498qVw-M0LEDFjC4qZpx--sFjhrvXkA4qOI2xEvA_jo9Kr1k_gXph4l8lI6Xpp7-Ox-fSeQav9LypM-fS_W9UGYP-r_ma8cOynmZCfucDhhtmZeo8Nl9S-fS_OnkBAzVI2ZyZUjDosUPwpi3PrKmPB7gqb0pAKCcaU-nqrS2Afd0OEe4ZCM-wwSTtmJBg_iifFuhN6EHaMgJPiE-oI4OML_v4ozAAuRAJxl0sD1peOwLm8IqigwOdju5c1t4tQ7Vux42r8VBgUWYDanGCYUrF_wDSpkZ9H6hQZiNewxBhFJjTP5FGXTk6DicPrNRogPm5vhjxPm0tiTvueMd9Pz8r6Q8xZmxyXrv0dU8z1C5II7AQ7oe0Mb_QF1xXFd85UCoFtFykJqaL5F630qy8sDl0YqvR55JujTBJ0Rj1H2zRE08I_KpslPcUaG1vTZd11dfn_gUsXaiX6-VojPmwXaCGXT1o8dzAuAKTkxmZIU95i387DoVzozFoO-ke4gAGZA3gi5T2YTe1uMKan_EjklPPKRueAEAYAG55qZuuXY-7rBAaAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2yTIVmc79aWW_q6kGurIiEdTOOEA%26client%3Dca-pub-8745593945608202%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:10 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 6B6A 2 KB
1 KB 55ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:10 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 6B6A 308 B
636 B 16ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 6B6A 293 B
621 B 15ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 6B6A 43 B
348 B 56ms
18ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=Ue39UZKa5n2PjJFv2y4p1HwsUz8YzlG1YHlPGw7nJrZtrmU5lgRNvXhD_t6NjExJXSGdr76kSmbWz2_5ev1VZ8N9DOSt9qLivzBP9Amp8O2T_skus4eHjO_1dsT2fqZTKRbQHOMeY4txaQ5CendHzyE0DUe2f9HIXRQrKniNy69tX7bV7-iQCElfLSRi_inIAqTMbHceBbQ6g0QTTHMbm6Glne6_2ec4ebMvrUroXbrgltSJDSJwztrpyVyeoDP0OJSGYAZTVU8_lGDpxFyeMgrSjYcOP5dxks8wf-FCEsTc_z85kpV4dpCdq6PYcuzMQqCMLZEAn4OPufi2QyTrksACN4SR_A2H5t4Z0Ya15iamjG6FjFutpYXWyYdaZdW3Gw3F3HCGD7fmgRlCZijZNDlIVbfSE-g9uOh2R7ESBO8rnvFZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3265075
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 37F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
894 B

10ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiCsOjSATAB&v=APEucNUVU35YI8Sdgb3YXtr3R8rGHSB3WiKpaknCrYr71sh7iu8Wo3zYYmFGjYvF2hZ8ARyXjAj2qKW2qz3uPdNvp7vSlZfuG5mPFj32zdXl5zP_etfn3n4BmJArDA23p3Ld5z226xkgVw78QETFYlGdapZXWgRLupjhCFK0ZaW1V2zqRPmfS9I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 37F8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
894 B

9ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiCsOjSATAB&v=APEucNUVU35YI8Sdgb3YXtr3R8rGHSB3WiKpaknCrYr71sh7iu8Wo3zYYmFGjYvF2hZ8ARyXjAj2qKW2qz3uPdNvp7vSlZfuG5mPFj32zdXl5zP_etfn3n4BmJArDA23p3Ld5z226xkgVw78QETFYlGdapZXWgRLupjhCFK0ZaW1V2zqRPmfS9I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 37F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

43 B
1020 B

18ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiCsOjSATAB&v=APEucNUVU35YI8Sdgb3YXtr3R8rGHSB3WiKpaknCrYr71sh7iu8Wo3zYYmFGjYvF2hZ8ARyXjAj2qKW2qz3uPdNvp7vSlZfuG5mPFj32zdXl5zP_etfn3n4BmJArDA23p3Ld5z226xkgVw78QETFYlGdapZXWgRLupjhCFK0ZaW1V2zqRPmfS9I

Protocol

HTTP/1.1

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: 4a1ed867-ff1c-4bf2-9bca-e71b9723d48c
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 37F8
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

170 B
188 B

125ms
49ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: bfab9ad1-6959-42d4-a682-b083a07f53a4
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 16B9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
766 B

9ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY1eDDmAEwAQ&v=APEucNWY__8iFNnFtxtZIolKE7ovgOCum8ZNQZ4426g8CI9joGuxpXR1mG_UJ9v_8bq3Lc2aw33g7P67L_Z1GYqILxp4fnSkCmbR6G1XHtw0eqLFSW-GlCQQxbWvl4HhIAhIoDjPDcVCeYH39OhEMPK3ddjBJZLImS7mMgVsEMtcgiQHOoBzl4g
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 16B9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
766 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY1eDDmAEwAQ&v=APEucNWY__8iFNnFtxtZIolKE7ovgOCum8ZNQZ4426g8CI9joGuxpXR1mG_UJ9v_8bq3Lc2aw33g7P67L_Z1GYqILxp4fnSkCmbR6G1XHtw0eqLFSW-GlCQQxbWvl4HhIAhIoDjPDcVCeYH39OhEMPK3ddjBJZLImS7mMgVsEMtcgiQHOoBzl4g
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 16B9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

43 B
1020 B

18ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY1eDDmAEwAQ&v=APEucNWY__8iFNnFtxtZIolKE7ovgOCum8ZNQZ4426g8CI9joGuxpXR1mG_UJ9v_8bq3Lc2aw33g7P67L_Z1GYqILxp4fnSkCmbR6G1XHtw0eqLFSW-GlCQQxbWvl4HhIAhIoDjPDcVCeYH39OhEMPK3ddjBJZLImS7mMgVsEMtcgiQHOoBzl4g

Protocol

HTTP/1.1

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: 9ea5373f-63cd-43cd-86fc-821566ee3981
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 16B9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

170 B
188 B

129ms
55ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: 7a197701-c037-4d8b-9275-aa84de89764a
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D436
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBCCoHQYoe7r2gEwAQ&v=APEucNVEuAmvLZIpqJlGGwgVv0EGkSMkowCxuLopdfDg66WD2UqVo5doM0Rcz67jHKfa_lC5pJopVGTsTwOZe2Kgo2xiqb-Gzd4vc-WFAIdG4dW9cspllW2u2YRGEpcnmkA-dHt5NBCHAH1Xe4tz-LymuIJmhCNqD4DDy2zo1vU-CD3OeINK0Ik
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D436
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBCCoHQYoe7r2gEwAQ&v=APEucNVEuAmvLZIpqJlGGwgVv0EGkSMkowCxuLopdfDg66WD2UqVo5doM0Rcz67jHKfa_lC5pJopVGTsTwOZe2Kgo2xiqb-Gzd4vc-WFAIdG4dW9cspllW2u2YRGEpcnmkA-dHt5NBCHAH1Xe4tz-LymuIJmhCNqD4DDy2zo1vU-CD3OeINK0Ik
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame D436
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

43 B
1020 B

31ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBCCoHQYoe7r2gEwAQ&v=APEucNVEuAmvLZIpqJlGGwgVv0EGkSMkowCxuLopdfDg66WD2UqVo5doM0Rcz67jHKfa_lC5pJopVGTsTwOZe2Kgo2xiqb-Gzd4vc-WFAIdG4dW9cspllW2u2YRGEpcnmkA-dHt5NBCHAH1Xe4tz-LymuIJmhCNqD4DDy2zo1vU-CD3OeINK0Ik

Protocol

HTTP/1.1

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: 07a561a6-1cee-43bf-823d-02f8d2de4f8b
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D436
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

170 B
188 B

107ms
56ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: 251f8f30-d367-4798-a6a9-a098569fb6ee
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4238
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
766 B

9ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxicrrvGATAB&v=APEucNX5-FhXy51hlKdoCdGzEP9YvZ4p6Wq7Z0tg0LNI80Zch9Zva1gfw0961qIwWBSylqt5HZSJR6TDG7Cp10-XJpab7N9QnYEvEsUjp-8NsM4KAUpSgYXI6883HSN3fwCY0-IHWxa7I_D7XInZI9yMQZiiX5lTuvvyMF8V2HYjSZ-5shnfvOE
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4238
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4XYKpVfU9au-VZsFZ28PwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1

43 B
766 B

11ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxicrrvGATAB&v=APEucNX5-FhXy51hlKdoCdGzEP9YvZ4p6Wq7Z0tg0LNI80Zch9Zva1gfw0961qIwWBSylqt5HZSJR6TDG7Cp10-XJpab7N9QnYEvEsUjp-8NsM4KAUpSgYXI6883HSN3fwCY0-IHWxa7I_D7XInZI9yMQZiiX5lTuvvyMF8V2HYjSZ-5shnfvOE
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEG4rY4HPmGWQFm-szdHFmWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4238
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

43 B
1020 B

37ms
18ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxicrrvGATAB&v=APEucNX5-FhXy51hlKdoCdGzEP9YvZ4p6Wq7Z0tg0LNI80Zch9Zva1gfw0961qIwWBSylqt5HZSJR6TDG7Cp10-XJpab7N9QnYEvEsUjp-8NsM4KAUpSgYXI6883HSN3fwCY0-IHWxa7I_D7XInZI9yMQZiiX5lTuvvyMF8V2HYjSZ-5shnfvOE

Protocol

HTTP/1.1

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: f8fc8c76-4afe-4eaa-8211-390038679147
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH0Y5uSmWGDJ60AD7cKVQSI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4238
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

170 B
188 B

105ms
57ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
AN-X-Request-Uuid: 4503a543-1b70-487e-9499-07a3fd624a70
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk5OTcwMjk4OTE3NjczNzIxMw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 81C4 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77876
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
DATA 200
OK truncated
/ Frame 81C4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b475d4bf0e4319ed3e5d24814d01e092f8a504ca068c755d10f940b1f50f7dd9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 6B6A 12 KB
6 KB 16ms
15ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H/1.1

200
OK

request.php Show response
hal90004.redintelligence.net/ Frame 056F
Redirect Chain

https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

99ms
72ms

Script
application/x-javascript

138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: af4e3ef8a43a8997b4c0a549e2d2a970e445bfce788f2b8cc76cba8712002b47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 73293100054213004444644012158004
Connection: close
Content-Length: 1092
Expires: Tue, 29 Nov 2022 10:00:11 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 29 Nov 2022 10:00:11 +0100

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F093 41 KB
15 KB 64ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77877
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
DATA 200
OK truncated
/ Frame F093 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b9d15f21f8cef3ca116fcc3221b2044456b1bbce48c278cc48fbeab7d3dc6440

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FBF0 22 KB
8 KB 50ms
50ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 20065
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FF06 41 KB
15 KB 88ms
87ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77877
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
DATA 200
OK truncated
/ Frame FF06 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3ea6a2ac6069e29db9db6adbd682af15e19fbc5fb4249258a3de8bafc835fc7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 85FE 6 KB
3 KB 42ms
41ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:09 GMT
expires: Wed, 29 Nov 2023 10:00:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 6B6A 17 KB
18 KB 82ms
31ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-114859.png&v=3&w=800&s=O6wTMfEctrB0OuqqVDMF6aqU&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

52a54c31feab338f551f355987ec4b0536e51595cc1238bad55ad9c3e86f2a1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=13197
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 17682
expires: Tue, 29 Nov 2022 13:40:08 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 6B6A 0
128 B 58ms
17ms Ping
text/plain 2a02:2638::21
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=IVEMrS4gR2jBYbPaJobg4yKBwbmGhxZBpvdozd7IfBqSXTCQEVxpfFqs4FP4DXhewverRCP-kPpeE0Myo_HIpualqae4GZk4DuQwTDTSFn8YfHfgXvAIBBxUFP_H2NrI9aZ2pE9BoOR_sJfoiSCPkEyAfEnPZ0FjSQfdXkmQA_IDo_IC4f8f4gFqhHzfEdwcb8MRUWFmnSrvrYtylTcmrL6zd3oVDxAmONEJnzbB-tMCD4VDyht1H97byHrmB2wu0WxllQ&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::21 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 6B6A 2 KB
1 KB 28ms
13ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 6B6A 2 KB
1 KB 30ms
15ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:11 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 47ms
15ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 471598
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=0PrQ8nwrRWo5MXdYVktXNlhUL1BwU2gxOEp0ZlZXKzZHTk1EdVJzbzhJaERPUEdvWTFQZ0dmNDRXaXkwUWpvU0t2bWNnRWV2RmxoWExCYXg1SDRVNEZkYTlrNTd0R3E4dUxDbFc4RWc0ZFlmU1RSQ3k4TVU3OEEwemVzdH...

372 B
665 B

49ms
16ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=0PrQ8nwrRWo5MXdYVktXNlhUL1BwU2gxOEp0ZlZXKzZHTk1EdVJzbzhJaERPUEdvWTFQZ0dmNDRXaXkwUWpvU0t2bWNnRWV2RmxoWExCYXg1SDRVNEZkYTlrNTd0R3E4dUxDbFc4RWc0ZFlmU1RSQ3k4TVU3OEEwemVzdHNDWmlNazV6YVNpN2kvVHE4T21KWE5rODJGcGpEaHpncW5XZnF6bytOZ083SFZyOXZkSXhmYUQ3b2o0SXBsWDIzM29EZjhZamhLR25HVjE4MXM0ckRybkNmTEtjcUo3MXh2c0ZCc0dPWkV1Zzg2QXI0R2pLVURPS0FOdlBvYVUzYXFtbUI5K0s2fA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3af30ef2daf63f304a53cbf807012eae9309b5afb5d5c321993684e2b730ca1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 856008
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
location: https://mug.criteo.com/sid?cpp=0PrQ8nwrRWo5MXdYVktXNlhUL1BwU2gxOEp0ZlZXKzZHTk1EdVJzbzhJaERPUEdvWTFQZ0dmNDRXaXkwUWpvU0t2bWNnRWV2RmxoWExCYXg1SDRVNEZkYTlrNTd0R3E4dUxDbFc4RWc0ZFlmU1RSQ3k4TVU3OEEwemVzdHNDWmlNazV6YVNpN2kvVHE4T21KWE5rODJGcGpEaHpncW5XZnF6bytOZ083SFZyOXZkSXhmYUQ3b2o0SXBsWDIzM29EZjhZamhLR25HVjE4MXM0ckRybkNmTEtjcUo3MXh2c0ZCc0dPWkV1Zzg2QXI0R2pLVURPS0FOdlBvYVUzYXFtbUI5K0s2fA&cppv=2
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 481773
content-length: 0
expires: 0

POST
H/1.1 200 429.json Show response
id5-sync.com/g/v2/ 216 B
630 B 33ms
7ms XHR
application/json 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/429.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162534/8426/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

de02329849789aff735e54fbce9cedf75a5f69c8348ee3fde1ab820674315f58

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
321 B 107ms
33ms XHR
application/json 54.75.190.240
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162534/8426/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.190.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-190-240.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache
x-server: 10.45.9.77
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
394 B 102ms
32ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162534/8426/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: c4da5733609dbdf4ce63dfb551f6fe33c52c9eb251435304f9a3893426221087

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Thu, 29 Dec 2022 10:00:11 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 26ms
17ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 527359
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame 3F17
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=aw50M3wzL015b0VMR3JnU3BLZFZLekZPWXY2ZW5Eb2hsaWRRdmpZdUErSlRmb3VROWYxTWhBWXNvRjlpdVFXdkRRQjRVKzl1SmRpQTNFSzdvQ0hnTE8ySGtySmZkYVlJUUh6cURTRU9UbVY4c2l6eklmb09oUUErdi9oUS...

360 B
644 B

50ms
18ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=aw50M3wzL015b0VMR3JnU3BLZFZLekZPWXY2ZW5Eb2hsaWRRdmpZdUErSlRmb3VROWYxTWhBWXNvRjlpdVFXdkRRQjRVKzl1SmRpQTNFSzdvQ0hnTE8ySGtySmZkYVlJUUh6cURTRU9UbVY4c2l6eklmb09oUUErdi9oUStValZjWkJnMmc1ZUEyMXhtOG02MW5Sd2xndkhieEtYMkJuRWMwOVhtQUJJNFZRSmRwc09qL3ZFYytzRTVSYmxGYkpMTTZwaXo5YUtUdC9ldXVmb1duek5JTnhyZ0dpWkpJQWhhdWdXYWFGOG91eHpmS1EycjdlcDNvQ1lHRzdTNVJhVGZKY2tCfA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

615f1e8db4e6e22bba5a30d8202730ceeb535e38b0e68bbe52c92971369141a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1470171
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
location: https://mug.criteo.com/sid?cpp=aw50M3wzL015b0VMR3JnU3BLZFZLekZPWXY2ZW5Eb2hsaWRRdmpZdUErSlRmb3VROWYxTWhBWXNvRjlpdVFXdkRRQjRVKzl1SmRpQTNFSzdvQ0hnTE8ySGtySmZkYVlJUUh6cURTRU9UbVY4c2l6eklmb09oUUErdi9oUStValZjWkJnMmc1ZUEyMXhtOG02MW5Sd2xndkhieEtYMkJuRWMwOVhtQUJJNFZRSmRwc09qL3ZFYytzRTVSYmxGYkpMTTZwaXo5YUtUdC9ldXVmb1duek5JTnhyZ0dpWkpJQWhhdWdXYWFGOG91eHpmS1EycjdlcDNvQ1lHRzdTNVJhVGZKY2tCfA&cppv=2
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 752010
content-length: 0
expires: 0

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6398 36 KB
16 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A5F6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

52ms
51ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:11 GMT
expires: Tue, 29 Nov 2022 10:00:11 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:11 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 main.19.8.366.js Show response
static.adsafeprotected.com/ Frame F093 196 KB
61 KB 55ms
8ms Script
application/javascript 2600:9000:223f:3200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.366.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1269461/67381783/skeleton.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eb6cb0bc1769b5545101b7c78affadfff0dfcd0157d2a2b3c71eb4b129942699

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 21:37:52 GMT
x-amz-version-id: DTz7DAGx5H1oATkuvwxjIs9w8gvuFjKB
content-encoding: gzip
via: 1.1 3517ce13630d84c5b14e88de469985cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 649339
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 21 Nov 2022 19:50:49 GMT
server: AmazonS3
etag: W/"ca4194ffbaa3712186a83d16b497895d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: R6Lc52a6bVhjjEy_peWZB3UGxj6NQWIpbs57swVoVkvcMyxQXCClnw==

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10293168272613754819/ Frame 6D07 25 KB
5 KB 123ms
42ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20bb483bc4bd6f847982f359cea0250ccfa9cdd34b67856ad40a4ac2a1af9f60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 601102
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5184
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 11:01:49 GMT
expires: Wed, 22 Nov 2023 11:01:49 GMT
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 81C4 0
0 173ms
78ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvYTbCBKwDKz9ZYARWU_2EPSiNXJ0zCxM5I3nX99fnbAi4C4ZDCa6pizlyf55Iz4SyPQ2tzOIxwMwkQWe0_Gi3K41lfJbiyWOZoYdwt4W2xpqt1n-OJynOL4V7D5lBoIQrred8-5qMIGnG-Bic1KAmLkrFEALEGxU4e-2bNnUtWER2Z6EqMwToYL88C55PTm23H-1ivmFhwwIQXtFZ8YkhYHXx1IC4UONySvIwxMBU8W9RnpKnR2MOuXqGi_R-nlnXX-2WA3o3Vl1huSj7wE4lQzVv_R7OSXnr8lLqSfTQiKB8l8PAAH2-4eBERtEH_A32dJdLzKTSkBQjm8eOmdzBPYgGclLDKuxN9E9r0vAGZCnPUheIayBozb_AqMtO4mKPw1jP3NOS_VAUEQQYvGpiTGM4gLNWnI2HDgWSxHhx-pHESI1hj1rhkN_D_Vk-fKAXWL9n00l2HaVLynvuAdqaCMuDCghht0oW_5P2wNKqvdPDc3K4PuKPtReLg1qsgqRPjncnkv_AM9gFFDZQPCBm5rHGsjfwvElMMu3zvjGhtyHI_O6cKVZ0bx43ncNrCMdNaL6PPYQamZRXMvQL2pxlX-zqGJpNsQY7zWp5FKVytabz3tS3OyDkYrjLlHYQBZmgreq6Sk-uriRILfrtD3_-kNWiSF06oi6ojZsth5vyak1Bd5pjgr5vF3tnjM87vg2con3O2_UiQcmm_RCvDRnpnUnvFFyHh3bGv4nPDR4zKMP7h9jjoGgpWUKinfbJOCINiuECGlbNSD7SxtLk3hqdUCwMKxTaSKqvwD3saUBE6fsqjAzxIh1xagSP2W9OwA1Eb_AyPUuwd-KCRMpQo7SW1u6vq2XZnWM60YQiUUwwqLA2KubZ7n8NRh58nFLnJZCnES01UKCRg82rSL0Ld6uJBsxfytpqIDc3_ohJrO1ttila8cbMftpvVPp_jllu3H4Xv9F6jMcITJQp0mR-IWJb2HSlbX_Wy0KtY0VjAy3ZDuR2YeSVYX_JRAYRTHvKSpWVKj3E70vTvc4xWQUEVf4gKeI43CVn3ROjWmA44JQyv8kAHM7fgeAt8AsRUe0i2przZD4C4HDrHBAQL5PZaR5pjjQzfZ_la_O_5ZWZrWF7R1EObPok9IsNOWHzEN3OkbrOKxDtZRLD3xLzEOF3RQz1EzgSRdesREn8KStxMsZwq5MsnqqNc6dHRwSRM5KZcz5qD2CRx3inJwTbDLyrk1K8ZNmAcWUKnn2VUaYwKvrh7JJcQuZcF0Rgo4P5CBdgQG5vSo5QhKiD2G_Jhoj66kvgnZr_1geNM2NF9_Lp5xaZsB7muIXItVBs8lZ2tNcQXWA&sai=AMfl-YRhu933-tC-pb2Xxe1w_oHCeJ7g3oKbPR7pk0tQSbVtHjVdiD6muKahVj4lJMryPfp1j6homwYS3XgvaH_u_-20GdbdCP0EFwk3Epd6shSDRJNQzmiB47P7owo9K1-GK1-keS2mbwqGu9n6k3SC3_qddg1dyKAU7zgmcvfuyepKKVVGJqH7zurtoFFaMA3TKjPAiriEOSdTlSRy8TNvvTXJPo8T8JsAEi5lDIb0-aCjBZsfFT3Znw9sceUwFstI68Bc8cjgkIdZHBbfPMwSiIHcbmXJJj2_KndXlAti1hgeVVFNXzqVY_nYFnoVPk5w&sig=Cg0ArKJSzOExqiN-84z7EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=574&cbvp=1&cstd=571&cisv=r20221110.17502&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 29 Nov 2022 10:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H2 200 publishertag.prebid.123.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 18ms
18ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.123.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 03 May 2022 11:21:03 GMT
server: nginx
etag: W/"6271101f-15b58"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 30 Nov 2022 10:00:11 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3F17 0
0 77ms
76ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstjQVXEA2clTmyaNDkwgsgF7tupULTpY21GOt3hWUxuql52-xSaKcimhzj6A-T2aOwHbjiGkFAzehTkEYKJKLU2P_il7clH8S5wiqj0jMtc3qtTnyFrBnLgNGESlMjjkhS-ZTar-7YeUAqPqLq-MT0OuPxY137FnDMtraTsQnnrczCtCwNVhuVd4HJBtxjMg7WC7xXeZYI5QG-sOPMJhxv3ZHXMs1onlGAIWc3ebs853pjUQrwOp4nOrf8L-gPbj6bn9EOF4mCAG_owNxQ4liqxkdZ_RQjY1zL_sCJzinBtF3KyNfTIkfHv-iUDSamQBh_jmIKvvTdJR3FAO43C&sai=AMfl-YT47Y2YubXTFzA4rqjVAq8pEFtSs91GL7Lq-wZ5dxs5kvyhFtMThOyJI3Ncn2NEiyfD_BeqfL0NoXeazvadB694UIsXy92qSpgRS_i9pX7cqEYOM0-F_w1ZSqrKebrUL7C9Ts-vQmPSZ3DqLRYYzRc&sig=Cg0ArKJSzJ3vDm2ztdZyEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/7880356414873403392/ Frame AD24 45 KB
12 KB 76ms
53ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55468abd6c7a0abe7622605b79ebe6258bf47a4ebf0a19077a0fff6f904e47cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:11 GMT
expires: Wed, 29 Nov 2023 10:00:11 GMT
last-modified: Wed, 14 Sep 2022 11:46:50 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF06 0
0 113ms
79ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu01Ny096W3hPauHFqQPTeXVx3znYsKrxswhxMFuiEqfzP-P6iCvG1r5tASBSQAuJkfdOsY4tQ9sBUQ_vcXBhdPHXStZJxTvpMf2R6Fw5acxMWM-DB9hXVTpn6jJwzAfZwBpr07hAuy2TrZHV0B5K7nT7JKlxymWqdPbFWUHR9DoAEMUdWo5TMMGyOwCX6TksgO4Bt4nGN9bL4jDg_mhfl5dvEztz6NX4pUoAjXAwdgxOmtQIe9itLHyUzxlfen9j2bF7HrMe6VZH5yGolccv86KBgCympZy4JLbZ4Qdz9j7QxPgtkun-XO6fmlnH9Cih6wj1JspaIjQCDUEawLJcN0-MBx1lCZM-1nVWXx0cpyHB4ENPKiKG4ICwijRRTOr9SWknJ5En3dRiK-6fE1JhJBH6WIAjPhFqHJKjDUaEFZ2KmjBKdT1E3IdctWCDBgZED1U3a7L5M4WnHU0Em6hhC4DTRiu10jDZ_Te4zlLOhP79UcGIgZBJ3aXEG2Ck_17DSsPTcE375p748-6t--MQsDlh-TGmvt_D4vxuooAoGfuMgIUBcs7t6kKPkwVirzvKyk0n3DvP_LefsvYr75lwpZAPTOPPfFunvXfzpNyAQKIV0GUuDmYswGI3BpozucTRccLSlFv6OzMbzvW_Cb2XUluSPTbi2LorerCEEpHIlG3TPRuE1Hc0Yf3MTrk0ehkNTvj-hLo8KR0MDCBGy26Qu2LwDZL-uhY7IVaeCwSo37Yimyvl1JkFAXJIsZOQtojmwWlMP-WC8Gx_Vg2dCz5b85g50VUElaRjiEYwKvPsrCoW8IHABcF_34u2yt1iYl3Hh7I44DcEao9-Rcr5smUFf2vwtiVzn-7CKm0quUTHaNBKLROqIj6C-JndP5sQPsMNRypJlyoUdr9ca1YXZb6lxScuF-BUCRmwv4z081O65zqhGHbeEI7O6DRQOfI2-4gJwyFSv3UwsCvKW1Ck8sOXrJwkx3EjSLZPU3SIOrudsqGC0x-02b0nTy9pyelccGPF0WLpo6FgkMscAwmLio5gyUs5g_MRJNJJxjYVgEnNtwwFJxdMCy12COHXPdvU5rFk3Jj9VUTyun2oDGrXwG6sHLUQbwbJyXXpwbpuW5jWg4SFnGtKRNFUwJaaF4yxlfTISP9X-6C97dkKmWi_Wjk9yG1jNpPRfgkh0qvOcvtGMYe3ZjQBEh3pUdfZpnfGsRU7x0jU-ZYREck4X8dxgZQ4ifGtzK1euSlSG7uvZ_qmjrKkebdEQUtGNdbaAq2-IWLcFQxfRYtM-CbpNX0WIciK9w9U3Q0J64139xePWefasJijYbLiplGV3pabuCh0TKyyeJ546MUluM&sai=AMfl-YS6nnSxRexkQuIgMZA8hjZew_dZigqAh5Nxqzdd57Dx5uyWWFUStRXvI_vplVAYV1y2J4QxGrUiUfCWhj-Fl01QkM3uRKkrxLQRQj9KfUQveowhdTQaJEu7kX3RWKJXtMLr-x1QU0MKym1Vf9Cnm4BQ0VAslbdo2FcS373Bdpaaz7HjdtHJkDPLsumxXLLKYPXXXOYevtiAgDyHO_Ia2ylQxqVeE-HkoSDfJInJNs2DuZCWM3cI3w0Pf8Me7yFyUB5qQ6k4Kfm5Xb3AtcNFNwgT2roVleTy9rmjnFVCGw&sig=Cg0ArKJSzOgHuIVXXSjfEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=600&cbvp=1&cstd=592&cisv=r20221110.05763&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 29 Nov 2022 10:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 112 KB
21 KB 53ms
49ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd239bd7157224595485501877dea08a3266e3edfc9406ca917dd61cf94eccaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 10810
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21972
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 07:00:01 GMT
expires: Wed, 29 Nov 2023 07:00:01 GMT
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F093 0
0 83ms
79ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsucp_SXW0yKSMmLeaum3OfyryU84JmyXX7FXP5tgCVCyRZ9qkmWigSKL3QDJ3ykHLor54xCtwFfFYyBbwBM7wHIbW9El5keFo65jQD_l6vHuAwLLdhoeAXlyhAYtsmt6gqKghyL2SCbAPXhp-duNB5HqwVl0t9qBzAElVIwJ085xFCl4sn47sqRxx5tGwV-Ry6MbcmeWqA1kEZPBVwSZQaLy9PaSslm5W04HlEvDVuTM-K5vVNETPnb6NuQfqJuc8ctjKjmIempSogkixQAGxoeY4TdHQvCXlZQ6_-pey1NrjFXC-dG-V2nE_tocZS41dP4BFcdrUEy4bfHviIOO2aOHetE9x2M-5xeaJXPSLV1S7nwUL_7xhPyTcAMz9GuLowASa9o_WDPVGbW4zVm-nAveBXGJd4oo2NV06gReyk-lzh58rzgotulhGIvTHWDRovEVTthIdUHzW4C2A5ABav_t_hML94ft9G1t4UaNlWdsuZ3oGMzJPDRrPFIKStM8kuZkVFBCV-qi2rR6uf62C5u2wDEMbsyvlYompkeM0cZ7R8fdiQs_E6JZZjSpOq613KdTgsUVo-qYL7LQdMHf7CA5u3lPBOsHP70YfFicVzJ3UVohzi6EAae4CK8lNeZOu6s7zEi8Fq7qyRFi9WppyAHIgG-wwWNCTvfDqqqy8P7A6qTS1ZH0nrzgMyiVTgLm_14ekZ6fGACIVvpacmWsoyWym66RVRBeDfk1JFjDxVLEh3u8zPnI1uexvD1Lce3Q34IHkp-Y-tbQQgRgCz7fPgLpuSmMYMf-rL98UUbe8D87q4Nx0B-ekOup5wz63Jk5pCb95iuUDmnUsC_S-lH8-Q7jkIj3qzO5tgFtEFA79pFl9xTLEA5kLwEFUMfQ1uB3DcgVYSEPrn7Ung0g35W2OyZCJ9QbkoMwGWB4I20nGMB-kpNaZ7XKZAMAXPxnbw5NK-Qp_o2BiBc-IzENO5RvkegKvyZiH93LzYr3KXcQAnB6zgb-ekeoayrY0f2r9kJjzftIqOe8y6biIehS434usRW2F6-i-ni5AAy2QMIT1wvDNGRZ2JIZiH4gaEiUjgnoFppm8MgSY9gI8sLzZmZmfZsQcbe-3thwOTR0AM1ClHdtr7qvZd45JoTrzUMYtr4rjEP93UO7qq9mye5QkptakdGi_LMLlcTGawQaFN0QQgh9MKcE_COd33egyTGJXS-U1HLoiWbmCMG4HhxxXXGIVIZM-U3FtjRym1zY_s5rj2RMMxVFi_kVw3oA-UoKbREpybamroxrNG0ihCcR84ecVylQFPqbrCsZdsyz6f5pzP1HCRcZNxENNsA9jUzE0CfwzUuHx3o3Lgr38e_eJ15Vdc&sai=AMfl-YTRROSCmKMtTE7c0WCdTeyYvz7qGnR2GetMh7PnMryQL2daDfxdFgE8Z804ycpxvuyw6qBxjicEHStDcOOIbYlKHsOBJSCnQLItWPTvkuksMnnYS1GpEsCd9MVqLw3CortzuWaYlW2nBHUWfYsyLz_e9FpyXB5qEzdFrg0mbWNCT08PNjmY0g-Ve2Fnz9aIl7nJIwQH4eLlwUF8Q1qbsS19LZDqzffyjjFtMzBacGLwUOzkgmqtBaMWR8voYxlQ-htVN7KRHylII7o3v2ha4DL-5rK7vw3MTI-L5eyvng&sig=Cg0ArKJSzDzyW_vE5T0fEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=655&cbvp=1&cstd=653&cisv=r20221110.01159&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 29 Nov 2022 10:00:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H2 204 ad_impression.gif
beacon.krxd.net/ Frame F093 0
347 B 116ms
29ms Image
text/plain 52.16.228.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/ad_impression.gif?confid=rrj5ukgn8&_knopii=1&campaignid=28946407&advertiserid=6522545&placementid=353314981&adid=544429504&creativeid=183089034&siteid=3355505
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.228.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-228-49.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-served-by: beacon-n021-dub-prod.krxd.net
date: Tue, 29 Nov 2022 10:00:11 GMT
cache-control: private, no-cache, no-store
x-request-time: D=50 t=1669716011
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-no-pii: 1

GET
H2 200 93665
stags.bluekai.com/site/ Frame F093 62 B
578 B 209ms
155ms Image
image/gif 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/93665?phint=event%3Dimp&phint=aid%3D6522545&phint=pid%3D353314981&phint=cid%3D28946407&phint=crid%3D183089034
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Tue, 29 Nov 2022 10:00:11 GMT
content-length: 62
bk-server: 5615
content-type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 309D 22 KB
8 KB 45ms
44ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 20065
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
407 B 45ms
9ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

84f67b2966de0f841622921ca23f6c07016c100670bfe1e3bc2194f04124b0a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
235 B 43ms
7ms XHR
application/json 2001:41d0:701:1000::31ee
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::31ee , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 706a01a4577702a1554e9269255059c86a91141898433947d70921ca55abf561

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:11 GMT
content-length: 54
vary: Origin
content-type: application/json

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 85FE 0
0 82ms
81ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CZtBEKtiFY57VLY7-zAbo15-QAsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNTUxMjM5MDcwNTEzNzUwN8gBCakCLtwKvpttsT7gAgCoAwGqBPsDT9CUAzIc5TuxaqC9mSe0OUPAffadw99UYfLbfw6FvbMS88WbvsuJCqz3RzGmSW7uPv4cHHKhnubzzn0LTNj_y4ID1nrdo-7sjkNF0r-cifNqgTTGUYUVeybVb7NfuDqMhFqaxwSQ-gxgQFme8ys5qComxjPx4bUE7ntYLTvsX20HrW0ITxFcOZAo548Icb3auvqE4rSuUpOxKoTzamLF0NgoGfurfceUxXXL3ZmJVsiusUMgDO-l3L5n28LQCQXbakCofS7nZbeXc3lYDGr0PlLnKKTzZ0RWS0RbtV4p1cwtcp4WI-CZJt4BXXT2xPlzItK0WxcODrEoqqifrp4qPSX_qxf7TTEEh6TtJyvPMskX2BK7ZaasWepeEEPZfWyvoY6-0GqVL1NtEw2XFjL1kXEKay9e22uRx-kN2WBoj1t3cHXKDi2FLev5eGujCbVFyEYXleZLXbt_6efvRZT970eeCy3Fp8jDZE81X1JAjfosWsdvW-nnKNKgMsPtO1UMXltGa0t24A0Ysa7f9u-2i5LvjSHQWYblBmZ4ElgqG87AFyJeSeIhZ2UpvSsQjaSolfIqA4RA6VICTKkxhSghet0UpMRPVtTyfcf7czHGvvpHYeuVCwoqB0OSWItsmbbw2XvLjKEOTNMzDax1U3SLrYDtXoZE901u5LgO4AQBgAbnmpm65dj7usEBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPIIG2FkeC1zdWJzeW4tMzA4NzMwNTAxOTU4NDQ3NIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi01NTEyMzkwNzA1MTM3NTA3GJLvIQ&sigh=N3jFokt_LXE&uach_m=[UACH]&cid=CAQSPADq26N9kw9Ty-AtSW3J1y5CDcaCaOMhV2V3Zsb4en7EcYyjvYbev7i57cryGTtwFZwq2OJnxJ_iJF3l7BgBIBM
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame 85FE 0
0 67ms
15ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=k-LsEY-lBKwC2ASdg2ICAgAAANlEjjyI2ebFhK2f6EehzuIQKdiFY8mrU7C2_Bv3zSwMABIAAA&wp=Y4XYKgALap4K0z8OAAfr6OZD5Gjd-6lRWFEOvw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:10 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 287146
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 4289 186 KB
53 KB 92ms
91ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4XYKgALap4K0z8OAAfr6OZD5Gjd-6lRWFEOvw&u=%7CW9JZrb0GPJH%2FNlkuZgqO9E2NEfUvdzMMLHf4ppA0G2M%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5u071KZSs7iZoFIV3Ug09kHk80gsUVTNDytcC2l2ZkUoaeUp42MjATUELG0MjEr1f1lOXJQDnIO8e36-9h2f7OyKKgl8l8LS-tGOPERvWL4968HypVC61NjeskXaFh1dJ6WtDSDmBFbtg6ndqOQBevK8lrbP3GZO_R3PvcZ7RC-8KOrzGYuGPuhE6jNNCpdOmztKCxMvhg-2reWzIa53R084Hx3DdYTsHf79A6YH-RFLSennUCj2wtl6GVoTz14iHiZMNne662m5HCJg10gKC6BIowvGQxY-VB9wm4PCKVFKF-1vclAoIduSTCYM6_I0YcHqVDCf1Bgr8QVuHsmn_LETYFshfYaZ_8q-J40TOu7Ktd0IIViUmS4OVuc8xj0pAyApW3ajfy2xiTvn7o8p0R3CNo1aHIfxeGZIsrgMAvSaG5GCoAd4RNp6DkrAqcjcmB8WT-DCRkHsXVHhBYQxbeqKQ9J5bgEDWpL-h0Ni9phFqOLyY3jWBbqanlQmLPRpKWkJfz3tgpMDxcdTgQBMdqtUASnfNLL3XDeUms6gvsN7V1K-AvE-BoVcg8GS4YyjUDpOoRK5dQARXlT5QpVKnxbnv6daKs9CGA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJEMwKtiFY57VLY7-zAbo15-QAsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNTUxMjM5MDcwNTEzNzUwN8gBCakCLtwKvpttsT7gAgCoAwGqBP4DT9CUAzIc5TuxaqC9mSe0OUPAffadw99UYfLbfw6FvbMS88WbvsuJCqz3RzGmSW7uPv4cHHKhnubzzn0LTNj_y4ID1nrdo-7sjkNF0r-cifNqgTTGUYUVeybVb7NfuDqMhFqaxwSQ-gxgQFme8ys5qComxjPx4bUE7ntYLTvsX20HrW0ITxFcOZAo548Icb3auvqE4rSuUpOxKoTzamLF0NgoGfurfceUxXXL3ZmJVsiusUMgDO-l3L5n28LQCQXbakCofS7nZbeXc3lYDGr0PlLnKKTzZ0RWS0RbtV4p1cwtcp4WI-CZJt4BXXT2xPlzItK0WxcODrEoqqifrp4qPSX_qxf7TTEEh6TtJyvPMskX2BK7ZaasWepeEEPZfWyvoY6-0GqVL1NtEw2XFjL1kXEKay9e22uRx-kN2WBoj1t3cHXKDi2FLev5eGujCbVFyEYXleZLXbt_6efvRZT970eeCy3Fp8jDZE81X1JAjfosWsdvW-nnKNKgMsPtO1UMXltGa0t24A0Ysa7f9u-2i5LvjSHQWYblBmZ4ElgqG87AFyJeSeIhZ2UpvSsQjaSolfIqA4RA6VICTKkxhSghet0UpMRPVtTyfcf7czHGvvpHYeuVC0goJtEV1xd_Jirkeqv2KlkHWNmFB4Jt0cBDkCYf4Zho78jEYKuxH1xh4AQBgAbnmpm65dj7usEBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPIIG2FkeC1zdWJzeW4tMzA4NzMwNTAxOTU4NDQ3NPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3eCywJTZ3MRRHvxGNPC5axhjQxOA%26client%3Dca-pub-5512390705137507%26adurl%3D

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

de56bb0fc5d541808e9507a4c0301a3257f4d26f7c7ab3f764ec665147d17205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=Cv0qcS4gR2jBYbPavaHVQ1k7hPVRjv3u4JyuXtnka5wh1imfaSsDvPurRJuQD-Torci3CMX6Lso8lWXz9etyvrlL09Nl29w4TSX2fo44LhR4NVk-1cGrXtZsHesr0lm33zsBtKYVdFvrGL8AchH0hcolw0x9yWAB0o3MhSFntejXwd9kep4mDzzY08AXh5QN8qXCCrilR0kAvTo1xHnN3Ijw_z7YyOxZ_9Gr1-5glqzHGQTtMK8Hr-eBvWZNiZwk3gf-XA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 76836017
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 85FE 3 KB
1 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2385
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E0BE 1 KB
643 B 48ms
38ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 83765
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 28 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Tue, 29 Nov 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 85FE 18 KB
7 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77878
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 85FE 0
0 53ms
51ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQTCAOUJs_Bh-UInvdNCXTd8J5v3vPmXj_AmF9bSLbD8fz36_YzugCs6B9kuXH90Uk55kjbLG7XL2w1_hBDtWzCV8Mm3A
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 85FE 24 KB
6 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 20:58:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46895
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Nov 2023 20:58:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 85FE 154 KB
47 KB 69ms
65ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H2 200 video_playlist.js Show response
ad.vidverto.io/vidverto/player/ui/js/ 111 KB
32 KB 34ms
33ms Script
application/javascript 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/vidverto/player/ui/js/video_playlist.js?v=1653047028
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/player/vidvertoplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: c252a63cc3245c852e13332a77220c033b56a952344862770bfe104e76a0d436

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
last-modified: Thu, 18 Aug 2022 08:21:47 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"62fdf69b-1bc07"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600, public, max-age=3600
expires: Tue, 29 Nov 2022 11:00:11 GMT

GET
H2 200 video_playlist.css
ad.vidverto.io/vidverto/player/ui/css/ 61 KB
9 KB 47ms
47ms Stylesheet
text/css 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/vidverto/player/ui/css/video_playlist.css?v=1653047028
Requested by: Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/player/vidvertoplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 79e5889c36479f99096a96a61cbfa92fc35ecf12d233635e0224b2c415859de1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
last-modified: Sun, 28 Feb 2021 22:32:40 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"603c1a08-f52f"
vary: Accept-Encoding
content-type: text/css

GET
H3 200 bridge3.546.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame A3E3 690 KB
221 KB 116ms
38ms Document
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f43762f8d21458d2db8345c175545afe7c12bd886a827956d78ae75dafc50179

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 46107
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 226628
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Mon, 28 Nov 2022 21:11:44 GMT
expires: Tue, 28 Nov 2023 21:11:44 GMT
last-modified: Wed, 16 Nov 2022 18:58:05 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
16 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
DATA 200
OK truncated
/ 73 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe7a7cfe98bbd929fbdb4f39bd50bcf40f9127563225643f619ee452eef1869f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 video
ad.vidverto.io/delivery/rtb/ 0
0 26ms
25ms Image
text/xml 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.vidverto.io/delivery/rtb/video?data=OWNWTjQ0UHZpR0gxdERWWGdLa2lRVlhRNUxsZzdEb1RIa2tTQzBISk9yamhPSEN0KytHOGNpZVdIcXJwUjRWL3ZqUDJuLzJjNDg3RUpTQk83UHFUOUdISWhtS3dzK3JweWNZR2xiNHpLcml4SUwxbnZsU2pHVlZHaG93c20vejRtdEZFTkhhTUJmS0pvcW5sUU45N2FTK3NHcGVNalhETkMxdlMvVHM2UG9sN2RHR3BWVHZUNkIrandlQm1ZK2VYOUxOZ1VjSEtEclNNZ200YVg0emptdjY3VS9tVi9rOC8wZUFyV3JNSHNXdXpGVDc0ZzVsZElhOVRyYkwrc3VJbzFBc0VwOEtUSWdXSk8vVktCZlpXQW5hekR5SnE5M2ZibE56MEQwUExtUlMyRDFoOTBSQWQ3K0hpazYzMk9iUExEQkd1dmRSNDF3SnJFV1A0OGJ2SmRCVkVGUFJ1SndQYmtyUWttbTBjVVJYcHYwbUdXVm9ybll2VWtaZlpBREVTazNYeStlaURSbEdSMERWL2FyS2pMVHhPbU5JZzBKNjFIeElTTkFIMExqSHlOajJDclhRMkRYSEhtUlN5KzQrVUdmUENzaGVvVHppZUUrN2UyN1RhYTN0SXViajhyb2dRcVAvUG9KZG5nL3dTcXVZRkhXMzhPNi9CRHhKQWVuYmk4U0c5ZGU3TWFJSThEWjhEZXdsbXJsaGlUeHRUMzdQaFNwR2dtN1NQdUo3OWh4b3NPUUQxL05qUE9yNVRVQ3haS0ZWeDVlQWh3M0E2S01RT1djbE9tYndVWEJNMWlYd3NVWS92cy9pQks5VmRlNUZkY2U4dEZrZlRLYjh3aGtxQQ%3D%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 50ms
48ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 49ms
47ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 78ms
21ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 604953
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 78ms
22ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 29 Nov 2022 10:00:11 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 500198
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 prebid.js Show response
cdn.projectagora-adtag-library.com/prebid/latest/ Frame 3F17 430 KB
131 KB 7ms
7ms Script
text/javascript 2a02:26f0:480:f::213:7ed0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/adtag/latest/pav2.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ed0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 2417fedf8338f6a8858d66cd2a5b471bb1b045a4e5c9f70e440cf7125d6f1d5a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
last-modified: Wed, 08 Jun 2022 14:28:52 GMT
server: UploadServer
etag: "201318864c4a9ca3681326bff8323300"
x-guploader-uploadid: ADPycdulmLkfKBklcO8p7PNWdO4pbiXJ8O6YbzFqzTC3AjHnyKsCl38Rhz9VcCuNmh48gaDTfngjUqJGAo9wsjCu9o8vtQ
x-goog-hash: crc32c=dDyTCA==, md5=IBMYhkxKnKNoEya/+DIzAA==
content-type: text/javascript
x-goog-storage-class: STANDARD
cache-control: private, max-age=86400
vary: Accept-Encoding
accept-ranges: bytes
content-length: 133565

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v28/ Frame 7098 45 KB
46 KB 128ms
39ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v28/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:800,300,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 22:05:34 GMT
x-content-type-options: nosniff
age: 388477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46524
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 19:58:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Nov 2023 22:05:34 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FCFA 22 KB
8 KB 46ms
46ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 20065
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 31B3 22 KB
8 KB 44ms
42ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 20065
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 caafd485a4229a8786e33286a6757f51.js Show response
s0.2mdn.net/sadbundle/10293168272613754819/ Frame 6D07 94 KB
27 KB 41ms
41ms Script
application/x-javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/caafd485a4229a8786e33286a6757f51.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9adf2872df2e729a3f068d8372119d928ae9b5fc6b54076e452fdbf84ab5d0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 11:01:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 601102
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27504
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 22 Nov 2023 11:01:49 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame AD24 118 KB
40 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 11:10:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82194
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 11:10:17 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame AD24 63 KB
25 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 1924 29 KB
10 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 11:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79491
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 11:55:20 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 7E15
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=73293100054213004444644012158004&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=73293100054213004444644012158004&actionid=981741&produktid=&dt_url=

0
628 B

61ms
22ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=73293100054213004444644012158004&actionid=981741&produktid=&dt_url=

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:10 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 29 Nov 2022 11:00:11 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Tue, 29 Nov 2022 10:00:11 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=73293100054213004444644012158004&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: B9D59BA6:D7BA_91EFC182:01BB_6385D82B_22006E6:4673

GET
H2 200 / Show response
adv.office-partner.de/ Frame 1BCE 930 B
931 B 57ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 29 Nov 2022 10:00:11 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 06 Dec 2022 10:00:11 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 056F 2 KB
2 KB 161ms
79ms Script
text/html 18.133.151.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=73293100054213004444644012158004&nw=1
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.151.109 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-151-109.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 828f59a9f4137897acb331022cf9ddba952b3bebcbc7dfa73b1e53ee9c88c092

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
last-modified: Tue, 29 Nov 2022 10:00:11 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 29 Nov 2022 10:01:11 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90004.redintelligence.net/ Frame 6012 7 KB
2 KB 35ms
12ms Document
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=9zr738t4suio&nw=20&renderingType=javascript&namespace=f03b98179e&subid=&uid=7167486680614243&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8lhuKdiFY6LYIKGWzAag3qaIAZumgKJprZLqi84P8C4QASCG6OV1YJXikIKgB8gBCakCLtwKvpttsT6oAwGqBKMCT9A0Y4HmuDlM9NprMi66XoXwlpQ1wFNh31xtMayjaU_mI_89Iv7KDi8rdtP_fJ7BoaZNjrkJBz_rkD-k3CHpjVfLVs6_6a1uUE6-EKGOzlY4IXAWhQA2eWdNQvoJsjPEDKDRMMdgot0KAe1P3qP82WBfYJp6fZZJ2-1DvN9VwUwjbAwHj5WzYHc8M4JlcHvtEQxdZme705XONvp8pTi_vV6eSAMdno62N9a-kphASqCqrGJlYTMFfsmtcLRuuM2o_2B2We-6-CBRFxgTWvrU1Tn-93E5A7fQ0GpdSHIuPMRJtlWlPcGn5Il5LxVF8BkhXRfoGNZh-BjA-dKfTmFkgeLrElOefZqMpGZL2xGLZNo0HBO9V5Ok6KICkddqY5QEEsPnwATRos_UgATgBAOQBgGgBk2AB6yt9Z8DqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHTICqgI6AoBAgAoBmAsByAsBgAwBsBORqNEO0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT%26sig%3DAOD64_00N_h84jNSpUoM00W30PjggsE3ew%26client%3Dca-pub-8745593945608202%26dbm_c%3DAKAmf-Bo__fclrcCh60gcs-grRSUou5U9nh_7qddphUBnvcqm5KTRL78GesJC9GAl_G8eGPvAQIrWy_HUU8jYPo_uFjl66TLqV24Dr82lI9BmqEtm3G7rCMEKrgEqP1zP8tD_i_k7fdrFVOF0KtcmbSoLHr3JirONH9TX0pPBHgmtP10tAnSYTA%26cry%3D1%26dbm_d%3DAKAmf-AoXyU-T6mD-agvMLMtd0aZiM4NHiXUrYi6KJyPke6KUolVJcG7SOrLHvlMVviygRt5K6C-cV4fVuVIajQ6Wb9uZWvTVtfktn8nCkJosPL4_ahzkq7pHyR4a_GA-i4vzkJr9_A2Z-p0d3JytqhvDUVRLqgyJyTWMPui82_7I-gMx4o9eIp-2k2SchE79zjialE9wdhg64UOByGpC2UIDoNVn5zfLOQ5qTOPa9FC5m5Qhg6OnKJsIumG9CM2ZQ-NI3Wl04BL5FhTBY2tPRQP4LvGSidB9aFXK2n0w5Z2MOeHKfI4b32ameqvOpFUJaSLTkGF8JVrTmLKbNhg1lGoRL8_ZZ9Nz9c8Ry4lPNwbE9v2x66BGfYvt_W4_W1mkwSjISf0iHdOjXu5BkETpyhDP8dWCeJrVrfMqApMnSGXA-0ZNDIeQzkY1WAOHZ_kvbgUIgluiiBi91eapx-nJVWTD0zDhmweltR4Vn0C4Rw7Fu8gb2_an-u3UwiMHSAnVk_VLFATOBrQchsnWLhi-XRaiY1AelqGhdNGpy8RAHC1ALsEWeGtdnib3Lae4ouG1-vjrRI1U6J5_vEDQWHeOU1uRDA1Ux6vlJcUl4XX3o_sEK0bMqCnzC1O_7iSYzbB83PTyk-TXOmlDvcYcQosdTg1vxUOZhLRHDBbKiEaNZfhZVQ7Kl4tJEJVi6x6-T6a7MQkoF3jymDhmwVo1hdwixd43xjaKUwRBwlsyxvySY2812YXHRIl3gX9k8KRSLoqCjZfANUX1hcfN8-HOcWwAEP7WmljJn1o_2r1d0vKqpBZm5HDihRJs5SA2ZSlP1z6rRbO7ED3qokNuCUeDOf67PTLf3-Jsg5IaF4NHAcnGyiCU2GPFKm_FuL5zCo-msoTOJ5R94tVHdC1qk5NICaZFqPHa1g98SpDMQ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.lebanonfiles.com%2F&ancestorOrigins=https%3A%2F%2Fwww.lebanonfiles.com&random=8078281575852&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9e068ab957122a76339e6bf4e4d3841346e1a65f11b1aa57666dcfa9c71fa7a1

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2020
Content-Type: text/html; charset=utf-8
Date: Tue, 29 Nov 2022 10:00:11 GMT
Expires: Tue, 29 Nov 2022 10:00:11 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 056F 43 B
705 B 87ms
58ms Image
image/gif 23.203.81.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=73293100054213004444644012158004&pv=1

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.203.81.208 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-203-81-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:11 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 056F
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=73293100054213004444644012158004
https://ad-server.eu/wm/pb/native.png

68 B
312 B

153ms
29ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:03:37 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Tue, 29 Nov 2022 10:00:11 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: B9D59BA6:D7B8_91EFC182:01BB_6385D82B_D5189BC:491B
X-IPLB-Instance: 40027
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame FBF0 36 KB
16 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 4289 2 KB
1 KB 15ms
14ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y4XYKgALap4K0z8OAAfr6OZD5Gjd-6lRWFEOvw&u=%7CW9JZrb0GPJH%2FNlkuZgqO9E2NEfUvdzMMLHf4ppA0G2M%3D%7C&c1=0n2XosTo5clc2Y5hvSIf5u071KZSs7iZoFIV3Ug09kHk80gsUVTNDytcC2l2ZkUoaeUp42MjATUELG0MjEr1f1lOXJQDnIO8e36-9h2f7OyKKgl8l8LS-tGOPERvWL4968HypVC61NjeskXaFh1dJ6WtDSDmBFbtg6ndqOQBevK8lrbP3GZO_R3PvcZ7RC-8KOrzGYuGPuhE6jNNCpdOmztKCxMvhg-2reWzIa53R084Hx3DdYTsHf79A6YH-RFLSennUCj2wtl6GVoTz14iHiZMNne662m5HCJg10gKC6BIowvGQxY-VB9wm4PCKVFKF-1vclAoIduSTCYM6_I0YcHqVDCf1Bgr8QVuHsmn_LETYFshfYaZ_8q-J40TOu7Ktd0IIViUmS4OVuc8xj0pAyApW3ajfy2xiTvn7o8p0R3CNo1aHIfxeGZIsrgMAvSaG5GCoAd4RNp6DkrAqcjcmB8WT-DCRkHsXVHhBYQxbeqKQ9J5bgEDWpL-h0Ni9phFqOLyY3jWBbqanlQmLPRpKWkJfz3tgpMDxcdTgQBMdqtUASnfNLL3XDeUms6gvsN7V1K-AvE-BoVcg8GS4YyjUDpOoRK5dQARXlT5QpVKnxbnv6daKs9CGA&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCJEMwKtiFY57VLY7-zAbo15-QAsme0rFc1Z2R93DAjbcBEAEgAGCV4pCCoAeCARdjYS1wdWItNTUxMjM5MDcwNTEzNzUwN8gBCakCLtwKvpttsT7gAgCoAwGqBP4DT9CUAzIc5TuxaqC9mSe0OUPAffadw99UYfLbfw6FvbMS88WbvsuJCqz3RzGmSW7uPv4cHHKhnubzzn0LTNj_y4ID1nrdo-7sjkNF0r-cifNqgTTGUYUVeybVb7NfuDqMhFqaxwSQ-gxgQFme8ys5qComxjPx4bUE7ntYLTvsX20HrW0ITxFcOZAo548Icb3auvqE4rSuUpOxKoTzamLF0NgoGfurfceUxXXL3ZmJVsiusUMgDO-l3L5n28LQCQXbakCofS7nZbeXc3lYDGr0PlLnKKTzZ0RWS0RbtV4p1cwtcp4WI-CZJt4BXXT2xPlzItK0WxcODrEoqqifrp4qPSX_qxf7TTEEh6TtJyvPMskX2BK7ZaasWepeEEPZfWyvoY6-0GqVL1NtEw2XFjL1kXEKay9e22uRx-kN2WBoj1t3cHXKDi2FLev5eGujCbVFyEYXleZLXbt_6efvRZT970eeCy3Fp8jDZE81X1JAjfosWsdvW-nnKNKgMsPtO1UMXltGa0t24A0Ysa7f9u-2i5LvjSHQWYblBmZ4ElgqG87AFyJeSeIhZ2UpvSsQjaSolfIqA4RA6VICTKkxhSghet0UpMRPVtTyfcf7czHGvvpHYeuVC0goJtEV1xd_Jirkeqv2KlkHWNmFB4Jt0cBDkCYf4Zho78jEYKuxH1xh4AQBgAbnmpm65dj7usEBoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPIIG2FkeC1zdWJzeW4tMzA4NzMwNTAxOTU4NDQ3NPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3eCywJTZ3MRRHvxGNPC5axhjQxOA%26client%3Dca-pub-5512390705137507%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 4289 2 KB
1 KB 26ms
26ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 4289 308 B
636 B 15ms
14ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 4289 293 B
621 B 18ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 24 Nov 2023 10:00:11 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 4289 43 B
347 B 21ms
20ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=74e7gAY7ln8urXD62vGWSHEFPfkEWZ1sSgAH4sVoomv2h5VmWE7oNVXgNBTq6-n-LzGV9W3c__ExVxtooxc-4cJgVu_CX9Sj4GphqC6sfdf5FUPJ3iqYoH5ei7KK3o0DsVZiJcd0GyF6qZ7mAKG4oAGJTSNAc_dOItR9Q-pF0uCmZnBaTkj78DFM4n8Ea2daCcq0onzLSu7Y9M7jyovhum34uBRtT3Bai_t9EU5HhMB8pb7KQCpQPY4yn2YYXdfnOsvSAk04NtgOS8_44-7SJJn0Cc4Jg6erMEM4v3esM4MlMpV6ethwbOlrcoJe4NwpzewInnX9X3VyYEjP2p_m_UpHv7n_ZH1oKufSmCKpyX2mDwpv18qNMlL3vOp6yhWA1Zw8BlM1mxsx0O3B8Z4UDJhJqNt3f_yx9yMqrhSx_iUOPO8U10Nrb-_ifdqcVhHy4svNLw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 6423379
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 73F0 42 B
64 B 72ms
71ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvF8LaAJxm4TYOGMXRO7jJFCb-Re-v33wJITLYQwPQLQvCWHd3hshUpIXZAOuUFe3JFGRqdERdN4c_pE0MzYtDL5ce3m39tlRP_NnRc6xMTigcZy_aZ&sig=Cg0ArKJSzLnRngAAhKUpEAE&id=lidar2&mcvt=1132&p=199,1599,200,1600&mtos=1132,1132,1132,1132,1132&tos=1132,0,0,0,0&v=20221110&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1850051439&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669716010288&rpt=297&isd=0&lsd=0&met=ce&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 855F 42 B
64 B 73ms
73ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv68Hv-nNh96pHY3161BJ_OpLSPXIQusZ67Pc8wKMhYFFiJYGpanGsDoMFqM0RbVrNOwBNtv6Z0wGZ6kHVOj5QfYQOGbniElM0RF4WVlDoPxvT3khknf8-V8gQj0w9xp1r4EUMAFw&sai=AMfl-YTbPPMWskRL3Zhe5r8MygM5TjNnF9Q33FjcnggVRX6V4oBdQFhCtw98Jyw80tDAkB4UuY6TYY6nlg-Q1B4&sig=Cg0ArKJSzDEonOcZCT8WEAE&cid=CAQSGwDq26N95mG6F8KYbs3--LM30HMNG5es_9HbZxgBIBM&id=lidar2&mcvt=1134&p=0,0,124,1005&mtos=281,1027,1134,1134,1134&tos=281,746,107,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669716010009&rpt=537&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 231.json Show response
id5-sync.com/g/v2/ 215 B
629 B 7ms
7ms XHR
application/json 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/231.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e73b3f6f06b9fe1ec6da3880c2d407f55e0a8bb9dc3f6cd40d9a19e5b1e07834

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame EB8A 15 KB
6 KB 19ms
17ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.lebanonfiles.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

aeb779d96af4bfa1b664c203d52fbd9ef573b84a31b34314668325fc784e1b13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:11 GMT
server: Kestrel
server-processing-duration-in-ticks: 577853
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 50ms
19ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.123.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

61c1317e433c125a2ebbbdaf22fc3a0b3606bcb0c9cfea151425adf7b5195f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-16294"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 30 Nov 2022 10:00:11 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6012 4 KB
651 B 132ms
55ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 29 Nov 2022 08:09:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6012 11 KB
11 KB 35ms
13ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 29d1ce8e1f7b514f5ce0551c843a15edc116927169331a7f2d2814928c86e38c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10955
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6012 16 KB
16 KB 64ms
13ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 99f73e916e7cd54d98b4351026db2b49ba69b2fd772c70c07675139606e95ce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16489
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6012 16 KB
16 KB 63ms
12ms Image
image/png 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f939bc11e069fb71567bda797a66cc47be3e5d5c47d10af2b7190c17252727fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16552
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v12/ 18 KB
18 KB 123ms
39ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v12/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: ad.vidverto.io
URL: https://ad.vidverto.io/js/moxplayer/moxplayer.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ab7918478793ceb022d3f5449e401b44b78d87bc4429058ebb8b64163640da2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.vidverto.io/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:35:21 GMT
x-content-type-options: nosniff
age: 44690
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18684
x-xss-protection: 0
last-modified: Tue, 07 Nov 2017 15:24:32 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 28 Nov 2023 21:35:21 GMT

GET
H3 200 JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v12/ 19 KB
19 KB 126ms
43ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v12/JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2

Requested by

Host: ad.vidverto.io
URL: https://ad.vidverto.io/js/moxplayer/moxplayer.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

746589ecfb4406519933a6aea5f1149224afcba81e3c3ef0541e7ad6c8111b7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ad.vidverto.io/
Origin: https://www.lebanonfiles.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 16:54:38 GMT
x-content-type-options: nosniff
age: 61533
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18956
x-xss-protection: 0
last-modified: Tue, 07 Nov 2017 15:27:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 16:54:38 GMT

GET
H2 200 logo.svg
ad.vidverto.io/vidverto/player/ 414 B
551 B 32ms
32ms Image
image/svg+xml 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.vidverto.io/vidverto/player/logo.svg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 8d5d4d2769bdb28802f4309747ef6a358007eeb37daadc66a78ba0ca81cd4bce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
last-modified: Wed, 04 May 2022 14:39:21 GMT
server: nginx/1.14.0 (Ubuntu)
accept-ranges: bytes
etag: "62729019-19e"
content-length: 414
content-type: image/svg+xml

GET
H3 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 370 KB
124 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: ad.vidverto.io
URL: https://ad.vidverto.io/vidverto/player/vidvertoplayer.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2fb94cc5f4e050854cd18abcf65c8e58f62f512e141acf6b256aadbc27f1a48e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126568
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E0BE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEKflh4hg4jIr7gsDrO7C0vE&google_cver=1&google_push=ASkJ3FbC-vsSHmzrkUFdpymBIw0mV_MrqVh7cG14KReITEogaecE43LA_BnI1mkX5Tpo2lMz_2hex5Qv6cSqYjp7...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbC-vsSHmzrkUFdpymBIw0mV_MrqVh7cG14KReITEogaecE43LA_BnI1mkX5Tpo2lMz_2hex5Qv6cSqYjp7p6_qyfMrX0iiIQ

170 B
188 B

53ms
53ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbC-vsSHmzrkUFdpymBIw0mV_MrqVh7cG14KReITEogaecE43LA_BnI1mkX5Tpo2lMz_2hex5Qv6cSqYjp7p6_qyfMrX0iiIQ

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Server: MT3 169 32252b7 master nrt-pixel-x22 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbC-vsSHmzrkUFdpymBIw0mV_MrqVh7cG14KReITEogaecE43LA_BnI1mkX5Tpo2lMz_2hex5Qv6cSqYjp7p6_qyfMrX0iiIQ
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 29 Nov 2022 10:00:11 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E0BE
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rSA1byXUQXGOLkMhYTvTnQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

61ms
53ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rSA1byXUQXGOLkMhYTvTnQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FZePKF3zfx8jTo8dfaljTkRGJ3SaFyYdBhbGCZbspz0KQ9KijEc1qexvZLgtUbvfhcDwzrQev7Yrgk6tez1oYPA7okoi0Op9g

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rSA1byXUQXGOLkMhYTvTnQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FZePKF3zfx8jTo8dfaljTkRGJ3SaFyYdBhbGCZbspz0KQ9KijEc1qexvZLgtUbvfhcDwzrQev7Yrgk6tez1oYPA7okoi0Op9g
date: Tue, 29 Nov 2022 10:00:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E0BE
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEMuW0CkqNRRIFEW4TWi6K7Y&google_cver=1&google_push=ASkJ3FacOBASeANpZz_Wdb0WJAC5SWyjrmN4VVEw7XcDTYS3SMPKGASTn0UW-H5YrDh9_JqePqPYwuSZ9mgz...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FacOBASeANpZz_Wdb0WJAC5SWyjrmN4VVEw7XcDTYS3SMPKGASTn0UW-H5YrDh9_JqePqPYwuSZ9mgzl-Dra887PlTiZXx8

170 B
188 B

60ms
47ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FacOBASeANpZz_Wdb0WJAC5SWyjrmN4VVEw7XcDTYS3SMPKGASTn0UW-H5YrDh9_JqePqPYwuSZ9mgzl-Dra887PlTiZXx8

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FacOBASeANpZz_Wdb0WJAC5SWyjrmN4VVEw7XcDTYS3SMPKGASTn0UW-H5YrDh9_JqePqPYwuSZ9mgzl-Dra887PlTiZXx8
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E0BE
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEBQSH6UV5H-jlxYFgF52_4M&google_cver=1&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2W
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMyMjI1NTIwOTQ2OTUzNjYyMjE0OA%3D%3D&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv3...

170 B
188 B

48ms
47ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMyMjI1NTIwOTQ2OTUzNjYyMjE0OA%3D%3D&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2W

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MTMyMjI1NTIwOTQ2OTUzNjYyMjE0OA%3D%3D&google_push=ASkJ3FaQ072aoO_9EEc4Bo8eU5bsYdIS47h4_MM8WYID_i8xUk19Uyv393NtmXZ9CZGfniihP1qdpcmBUVHkJvCt_hZAX1CXdm2W
date: Tue, 29 Nov 2022 10:00:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame E0BE 0
75 B 170ms
17ms Image
text/plain 185.86.137.121
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEF0FA66We8sSfBiTpSm33Ew&google_cver=1&google_push=ASkJ3FZZ7QkV9kTpB1a87nY4yOrGBHLOiA7Ug9MnX5RvrOHzLQbYT0N7CSq1m8LEwwRN4EpdafQ_TlxnpOn15z3GylUZmVMnzhO3
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.121 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E0BE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESENeTj9SFZih8eFnN1HKbotY&google_cver=1&google_push=ASkJ3FYESskVFTKMjbsVBMKXaLVlrTRBs6bKWjqbpam34qIPUcxfv13iKAJjrBm0QZzITGZf9G...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1hMjhyUmFoRTJ1SEJWaVV2S0ptb0JmQWpUSDZ4b3A1ZX5B&google_push=ASkJ3FYESskVFTKMjbsVBMKXaLVlrTRBs6bKWjqbpam34qIPUcxfv13iK...

170 B
188 B

70ms
47ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1hMjhyUmFoRTJ1SEJWaVV2S0ptb0JmQWpUSDZ4b3A1ZX5B&google_push=ASkJ3FYESskVFTKMjbsVBMKXaLVlrTRBs6bKWjqbpam34qIPUcxfv13iKAJjrBm0QZzITGZf9G0Ybw-o--qFih8opAxZBqDLefbZRxk

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1hMjhyUmFoRTJ1SEJWaVV2S0ptb0JmQWpUSDZ4b3A1ZX5B&google_push=ASkJ3FYESskVFTKMjbsVBMKXaLVlrTRBs6bKWjqbpam34qIPUcxfv13iKAJjrBm0QZzITGZf9G0Ybw-o--qFih8opAxZBqDLefbZRxk
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame E0BE
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEF4W4nUYvGVEh4fGOsgxxyI&google_cver=1&google_push=ASkJ3FZ5wF6_qjmGQnuIXQcCHIKfTzwtU9Ff-uE78C2tKHv2WqjZEhUv5boJf7maIoOwY9ajyDLe3qT-5o8SrqDAxAhlQHIlEpgy8ZE
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DASkJ3FZ5wF6_qjmGQnuIXQcCHIKfTzwtU9Ff-uE78C2tKHv2...

43 B
1 KB

8ms
7ms

Image
image/gif

141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DASkJ3FZ5wF6_qjmGQnuIXQcCHIKfTzwtU9Ff-uE78C2tKHv2WqjZEhUv5boJf7maIoOwY9ajyDLe3qT-5o8SrqDAxAhlQHIlEpgy8ZE

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DASkJ3FZ5wF6_qjmGQnuIXQcCHIKfTzwtU9Ff-uE78C2tKHv2WqjZEhUv5boJf7maIoOwY9ajyDLe3qT-5o8SrqDAxAhlQHIlEpgy8ZE
x-download-options: noopen
vary: Accept
content-length: 274
x-xss-protection: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E0BE 0
12 B 47ms
47ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J9D1aOBZNlc1pF39ky3l9yutg8tEZvFK6D67E7g4GgxmabzA9wp6Ix7K4eyJPjH4NkSv9j28M

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame F093
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1269461/67381783/skeleton.js?adsafe_url=https%3A%2F%2Fwww.lebanonfiles.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.lebanonfiles.com%2F&adsafe_type=e&adsafe_...
https://static.adsafeprotected.com/skeleton.js

17 B
465 B

10ms
7ms

Script
application/javascript

2600:9000:223f:3200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:3200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 13:58:04 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 3517ce13630d84c5b14e88de469985cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 24782529
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: zIGg0-6HgHqNoYIFY5M8Z8pqUdgURXip8TTqhiO3EthQLJkAfrigjg==

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
server: nginx
x-server-name: app10.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame CC5E 91 KB
23 KB 15ms
7ms Script
application/javascript 2600:9000:223f:3200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:3200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 3517ce13630d84c5b14e88de469985cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 5941435
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: JZo1BYSQmiI96ifSAPD4w20p9Ez3NduC5SRe-sHMkwTFzcz8kPBfvA==

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 1BCE 102 KB
39 KB 139ms
56ms Script
application/javascript 2a00:1450:4001:830::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

31168ab45684688ec81f621dee4e48f91087128421c3530abfb61d6dafc447d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40382
x-xss-protection: 0
last-modified: Tue, 29 Nov 2022 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 309D 36 KB
16 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H/1.1 206
Partial Content 480_650.mp4
cdn.mox.tv/data/X1XrxbFfg33fxBZ/1399/video/1921/ 556 KB
0 110ms
26ms Media
video/mp4 212.8.250.43
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mox.tv/data/X1XrxbFfg33fxBZ/1399/video/1921/480_650.mp4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.43 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: customer.worldstream.nl
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.lebanonfiles.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Last-Modified: Thu, 02 Sep 2021 16:36:15 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6130fd7f-24e1341"
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Content-Range: bytes 0-38671168/38671169
Connection: keep-alive
Content-Length: 38671169

GET
H2

200

sid Show response
mug.criteo.com/ Frame EB8A
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=lebanonfiles.com&sn=ChromeSyncframe&so=0&topUrl=www.lebanonfiles.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=0D8U_3xvbXo4a1VXRytXWG4vQXZ4emRGSUJZOXZ5SGFyQzRzV3dFMW1DejhMdmJJL1R6UVRTZEg3bEVWUXRNeFhIY1lZZExEMDhrWE4yaHowa1VINEtvNVVrekZ4V0dZN2dXaVhhMnhiK1lTbllIL0JQSzd5NHhINVMwVW...

457 B
674 B

20ms
19ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=0D8U_3xvbXo4a1VXRytXWG4vQXZ4emRGSUJZOXZ5SGFyQzRzV3dFMW1DejhMdmJJL1R6UVRTZEg3bEVWUXRNeFhIY1lZZExEMDhrWE4yaHowa1VINEtvNVVrekZ4V0dZN2dXaVhhMnhiK1lTbllIL0JQSzd5NHhINVMwVWNOUTY0aFRGMUpmRnhSOGlhVGp0aWc5d0VudG5vUEJodWd2dkxKajdWM0FIeWFqektHSzhKWnJyR3Z3c2xRVmZpT01KY3JFaWdBVExDM2NkTWI1QWh2RWQwVldnY3FjckpWUHZaNVJwSnVHMEtoakozeTQ3c3RLbXoxZHI0ZUNoWWFtdFNSR25xK0V5b28vSjZCUXBudW1EOGZPblUwK3EwUmtMc3l1aHBRNmoveTFkVCt3WT18&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a0d82d13e02d130200499f1808ece390a163edcfe0eae4e1355d39a039eca4e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2217808
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=0D8U_3xvbXo4a1VXRytXWG4vQXZ4emRGSUJZOXZ5SGFyQzRzV3dFMW1DejhMdmJJL1R6UVRTZEg3bEVWUXRNeFhIY1lZZExEMDhrWE4yaHowa1VINEtvNVVrekZ4V0dZN2dXaVhhMnhiK1lTbllIL0JQSzd5NHhINVMwVWNOUTY0aFRGMUpmRnhSOGlhVGp0aWc5d0VudG5vUEJodWd2dkxKajdWM0FIeWFqektHSzhKWnJyR3Z3c2xRVmZpT01KY3JFaWdBVExDM2NkTWI1QWh2RWQwVldnY3FjckpWUHZaNVJwSnVHMEtoakozeTQ3c3RLbXoxZHI0ZUNoWWFtdFNSR25xK0V5b28vSjZCUXBudW1EOGZPblUwK3EwUmtMc3l1aHBRNmoveTFkVCt3WT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 279716
content-length: 0
expires: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F093 43 B
215 B 589ms
175ms Image
image/gif 2600:1f13:800:7781:805:604a:656f:8be8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1269461&asId=841e14c7-6476-964f-cc4a-adf43ca24c4a&tv=%7Bc:vlHBet,pingTime:-3,time:752,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:589%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:752,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:589,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B185~0%5D,as:%5B185~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tozkdOt+11%7C12%7C131%7C132%7C141%7C142%7C15%7C16%7C17%7C18%7C191%7C192%7C1a%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1e*.1269461-67381783%7C1e1%7C1e2%7C1e3%7C1f1%7C1f2%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1h1%7C1h2%7C1h3%7C1i%7C1j%7C1k1%7C1k2%7C1l%7C1m%7C1n,idMap:1e*,rmeas:1,rend:0,renddet:na,siq:591%7D&br=c
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:805:604a:656f:8be8 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: nginx
x-server-name: dt20.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F093 43 B
215 B 585ms
174ms Image
image/gif 2600:1f13:800:7781:805:604a:656f:8be8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1269461&asId=841e14c7-6476-964f-cc4a-adf43ca24c4a&tv=%7Bc:vlHBev,pingTime:-6,time:754,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:754,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:589,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B187~0%5D,as:%5B187~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tozkdOt+11%7C12%7C131%7C132%7C141%7C142%7C15%7C16%7C17%7C18%7C191%7C192%7C1a%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1e*.1269461-67381783%7C1e1%7C1e2%7C1e3%7C1f1%7C1f2%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1h1%7C1h2%7C1h3%7C1i%7C1j%7C1k1%7C1k2%7C1l%7C1m%7C1n,idMap:1e*,rmeas:1,rend:0,renddet:na,siq:591%7D&tpiLookup=ao:www.lebanonfiles.com*&br=c
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:805:604a:656f:8be8 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: nginx
x-server-name: dt07.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 81C4 42 B
64 B 80ms
80ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvsqS9vaK9Q09VSeWerQ46s53Q4Fe0eROwWP8K5LS5EtJVXf3okMqsoBIm2tJ9fKNBBLFUZjoEVjsva056hxpKostXOLzogT8yCWDBTW5OGJZavFEHVXVMCG61Y8fj3KxTE5Nuxkg&sai=AMfl-YR3hUdAunB_DRaeqU18qBhvpyseXEgTufTLSNmFnIpg6eWC7cv4Qz1mZ99m7sNenOySN-h9vtr05wcTWxEeRfdO4Pl4aWTFMh-6eQhfQowgolMQG8qhT4F-K_lUMpoL0W58Tkt-8tAfCcJG2jH2&sig=Cg0ArKJSzGGLPqcqHFFeEAE&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&id=lidar2&mcvt=1092&p=10,115,100,843&mtos=1092,1092,1092,1092,1092&tos=1092,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3611282516&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669716010304&rpt=687&isd=0&lsd=0&met=ce&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ Frame 3F17 2 KB
2 KB 45ms
44ms XHR
application/json 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221129

Requested by

Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83c45d2a8b0133c0c10802abb2510b8ee51f1bb2a745288a1944af4f9a508fda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 25147
x-jsd-version: 1.0.1538
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4526-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66a-zSB71lydrnWHanna+LyL9m8KH40"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7V2DgwVPGck6lWrDXSSj%2FORXveVe8H9QD5sPc8NEZFGTaDU1icPVws1DogDKGgz%2BfgVWeeDO1aCNFSA4WQpp%2FNmqoiY7kl1C2LN0WnEprF02rbaA%2Bww3FJ3gfbmvA6olu%2FyEXnAgZ83nvjYdbDY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 771a7eb3ba8390d4-FRA

GET
H2 200 min.js Show response
cdn.kdaimo.com/projectagora-483829/ Frame 3F17 3 KB
3 KB 58ms
11ms Script
text/plain 143.204.215.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.kdaimo.com/projectagora-483829/min.js
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/adtag/latest/pav2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-128.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 94e1ce5a00242c1352435871c46a8f36db344edf4d823234cdce4ccc5f40ca0c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Mon, 28 Nov 2022 18:30:34 GMT
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
last-modified: Wed, 06 Apr 2022 01:00:55 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 55778
etag: "61e4dbcc663e6d945cd8b7db1c35a1e6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
accept-ranges: bytes
content-length: 2849
x-amz-cf-id: FBtlVcM7F7wUrqceImx-v3kPtGF4ur06Y_8yqgKZH-QMB8GgSel4-Q==

GET
DATA 200
OK truncated
/ Frame 85FE 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec48d93b7705a0e8f75003ea2933b73e10b61d647f20ac3976c6b1fa816312aa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame FCFA 36 KB
16 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 31B3 36 KB
16 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6D07 6 KB
638 B 55ms
54ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500|Roboto:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/caafd485a4229a8786e33286a6757f51.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d1bacd17873c96bdbd350c12414feaac6d0b8cca24bf7c7a76fb2adca4da029a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 29 Nov 2022 09:39:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H3 200 26a7c83d22829365e50f6443cb4ff331.png
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 28 KB
28 KB 50ms
49ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/26a7c83d22829365e50f6443cb4ff331.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6896ad0850e899ea7bb9db2d18ba059b05129f3589b0bc986d0d67a3e7ba0a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 11:01:49 GMT
x-content-type-options: nosniff
age: 601103
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28828
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 22 Nov 2023 11:01:49 GMT

GET
H3 200 732e6b6c27a20285e7b8e3ff8714511a.png
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 5 KB
5 KB 52ms
51ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/732e6b6c27a20285e7b8e3ff8714511a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aa1be81fda06de2efd9639b18bd2580f814320b13ccbef13a8d1c30f5ee3d4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 11:01:49 GMT
x-content-type-options: nosniff
age: 601103
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4840
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 22 Nov 2023 11:01:49 GMT

GET
H3 200 14a5357efe026c52e8c22f698ff46157.png
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 794 B
821 B 52ms
51ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/14a5357efe026c52e8c22f698ff46157.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bce27ce4b302cea70cf511c73d44c7dd0e38aa5b4744101662253be55946b31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 00:56:21 GMT
x-content-type-options: nosniff
age: 291831
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 794
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 00:56:21 GMT

GET
H3 200 5f2d930c42f0c9fb5f152fb617fb4676.png
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 8 KB
8 KB 52ms
51ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/5f2d930c42f0c9fb5f152fb617fb4676.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69d7f1f2ef752245d66b340e9bfbe7eaeaaf797e90822495414453e760d034f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 11:01:49 GMT
x-content-type-options: nosniff
age: 601103
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8638
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 22 Nov 2023 11:01:49 GMT

GET
H/1.1 200
OK viewability Show response
hal90004.redintelligence.net/ Frame 6012 0
150 B 59ms
12ms Script
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/viewability?s=73293100054213004444644012158004&a=c257489d&vb=m
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/request_content.php?s=73293100054213004444644012158004&a=93b31d15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 056F 85 KB
31 KB 61ms
8ms Script
application/javascript 65.9.66.110
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=73293100054213004444644012158004&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-110.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 19:30:24 GMT
content-encoding: gzip
via: 1.1 f2fa38e6635ded6d22a69d089217bc90.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 52189
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: FMD5zKUXD3YUwcSkBKzb_jos2qnq3XZa3xoZd9mSR8mwimziw8053w==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 056F 3 KB
3 KB 60ms
7ms Image
image/png 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1669716311&Signature=kygT7qMA2Nglq4bU~jtXF2zKe6SjeDv7WzHYJ~wjKTi8xlkzy41lANvjyvKW31jOxj0-Wz4I3PiP9ptr-HSJsZPG-2TRbuQ4PRjzlHaaQgbksMQnPV5fB~4~pmfMM8efcV7iuE2a4T7NVrK02nEHrBwpRddDrPqBxmntmrLb2bHTDaFp-jWKQ7KBOP0DIBCT4Z5TtsTJTrqTI0VV2y2uXdBNAqZdK3YU7qhqgD7t8-F1~AckxZAwniRw77dBOXPySJeNQbyHSyqERPbS1CXPyVkjmeTD3orIo4JAs9FHitYNrQm5~CH9MRVi4tDZblY1S2CMD9uj5LXL4olbkgOavQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 29 Nov 2022 05:22:48 GMT
via: 1.1 d07eabeb1ed60c06da1457f35fb5c8c4.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 51172
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: pJrPM_qBTOyUsbSskG0oSYOUco0RV9ZY1fTMekN38m2UHScctWHuMQ==

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF06 0
0 179ms
93ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu01Ny096W3hPauHFqQPTeXVx3znYsKrxswhxMFuiEqfzP-P6iCvG1r5tASBSQAuJkfdOsY4tQ9sBUQ_vcXBhdPHXStZJxTvpMf2R6Fw5acxMWM-DB9hXVTpn6jJwzAfZwBpr07hAuy2TrZHV0B5K7nT7JKlxymWqdPbFWUHR9DoAEMUdWo5TMMGyOwCX6TksgO4Bt4nGN9bL4jDg_mhfl5dvEztz6NX4pUoAjXAwdgxOmtQIe9itLHyUzxlfen9j2bF7HrMe6VZH5yGolccv86KBgCympZy4JLbZ4Qdz9j7QxPgtkun-XO6fmlnH9Cih6wj1JspaIjQCDUEawLJcN0-MBx1lCZM-1nVWXx0cpyHB4ENPKiKG4ICwijRRTOr9SWknJ5En3dRiK-6fE1JhJBH6WIAjPhFqHJKjDUaEFZ2KmjBKdT1E3IdctWCDBgZED1U3a7L5M4WnHU0Em6hhC4DTRiu10jDZ_Te4zlLOhP79UcGIgZBJ3aXEG2Ck_17DSsPTcE375p748-6t--MQsDlh-TGmvt_D4vxuooAoGfuMgIUBcs7t6kKPkwVirzvKyk0n3DvP_LefsvYr75lwpZAPTOPPfFunvXfzpNyAQKIV0GUuDmYswGI3BpozucTRccLSlFv6OzMbzvW_Cb2XUluSPTbi2LorerCEEpHIlG3TPRuE1Hc0Yf3MTrk0ehkNTvj-hLo8KR0MDCBGy26Qu2LwDZL-uhY7IVaeCwSo37Yimyvl1JkFAXJIsZOQtojmwWlMP-WC8Gx_Vg2dCz5b85g50VUElaRjiEYwKvPsrCoW8IHABcF_34u2yt1iYl3Hh7I44DcEao9-Rcr5smUFf2vwtiVzn-7CKm0quUTHaNBKLROqIj6C-JndP5sQPsMNRypJlyoUdr9ca1YXZb6lxScuF-BUCRmwv4z081O65zqhGHbeEI7O6DRQOfI2-4gJwyFSv3UwsCvKW1Ck8sOXrJwkx3EjSLZPU3SIOrudsqGC0x-02b0nTy9pyelccGPF0WLpo6FgkMscAwmLio5gyUs5g_MRJNJJxjYVgEnNtwwFJxdMCy12COHXPdvU5rFk3Jj9VUTyun2oDGrXwG6sHLUQbwbJyXXpwbpuW5jWg4SFnGtKRNFUwJaaF4yxlfTISP9X-6C97dkKmWi_Wjk9yG1jNpPRfgkh0qvOcvtGMYe3ZjQBEh3pUdfZpnfGsRU7x0jU-ZYREck4X8dxgZQ4ifGtzK1euSlSG7uvZ_qmjrKkebdEQUtGNdbaAq2-IWLcFQxfRYtM-CbpNX0WIciK9w9U3Q0J64139xePWefasJijYbLiplGV3pabuCh0TKyyeJ546MUluM&sai=AMfl-YS6nnSxRexkQuIgMZA8hjZew_dZigqAh5Nxqzdd57Dx5uyWWFUStRXvI_vplVAYV1y2J4QxGrUiUfCWhj-Fl01QkM3uRKkrxLQRQj9KfUQveowhdTQaJEu7kX3RWKJXtMLr-x1QU0MKym1Vf9Cnm4BQ0VAslbdo2FcS373Bdpaaz7HjdtHJkDPLsumxXLLKYPXXXOYevtiAgDyHO_Ia2ylQxqVeE-HkoSDfJInJNs2DuZCWM3cI3w0Pf8Me7yFyUB5qQ6k4Kfm5Xb3AtcNFNwgT2roVleTy9rmjnFVCGw&sig=Cg0ArKJSzOgHuIVXXSjfEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1377&vt=11&dtpt=777&dett=3&cstd=592&cisv=r20221110.05763&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F093 43 B
216 B 482ms
174ms Image
image/gif 2600:1f13:800:7781:805:604a:656f:8be8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1269461&asId=841e14c7-6476-964f-cc4a-adf43ca24c4a&tv=%7Bc:vlHBgb,pingTime:-2,time:858,type:a,im:%7Bsf:0,pom:1,prf:%7BbdA:423,bdZ:570,beA:977,beZ:978,mfA:1540,cmA:1542,inA:1542,inZ:1546,prA:1546,prZ:1559,si:1567,poA:1568,poZ:1586,cmZ:1587,mfZ:1587,loA:1731,loZ:1734,ltA:1835,ltZ:1835,mdA:978,mdZ:1042%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:589%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:858,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:589,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B291~0%5D,as:%5B291~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tozkdOt+11%7C12%7C131%7C132%7C141%7C142%7C15%7C16%7C17%7C18%7C191%7C192%7C1a%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1e*.1269461-67381783%7C1e1%7C1e2%7C1e3%7C1f1%7C1f2%7C1g1%7C1g2%7C1g3%7C1g4%7C1g5%7C1h1%7C1h2%7C1h3%7C1i%7C1j%7C1k1%7C1k2%7C1l%7C1m%7C1n,idMap:1e*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:591,sinceFw:266,readyFired:true%7D&br=c
Requested by: Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:805:604a:656f:8be8 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F093 0
0 160ms
92ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsucp_SXW0yKSMmLeaum3OfyryU84JmyXX7FXP5tgCVCyRZ9qkmWigSKL3QDJ3ykHLor54xCtwFfFYyBbwBM7wHIbW9El5keFo65jQD_l6vHuAwLLdhoeAXlyhAYtsmt6gqKghyL2SCbAPXhp-duNB5HqwVl0t9qBzAElVIwJ085xFCl4sn47sqRxx5tGwV-Ry6MbcmeWqA1kEZPBVwSZQaLy9PaSslm5W04HlEvDVuTM-K5vVNETPnb6NuQfqJuc8ctjKjmIempSogkixQAGxoeY4TdHQvCXlZQ6_-pey1NrjFXC-dG-V2nE_tocZS41dP4BFcdrUEy4bfHviIOO2aOHetE9x2M-5xeaJXPSLV1S7nwUL_7xhPyTcAMz9GuLowASa9o_WDPVGbW4zVm-nAveBXGJd4oo2NV06gReyk-lzh58rzgotulhGIvTHWDRovEVTthIdUHzW4C2A5ABav_t_hML94ft9G1t4UaNlWdsuZ3oGMzJPDRrPFIKStM8kuZkVFBCV-qi2rR6uf62C5u2wDEMbsyvlYompkeM0cZ7R8fdiQs_E6JZZjSpOq613KdTgsUVo-qYL7LQdMHf7CA5u3lPBOsHP70YfFicVzJ3UVohzi6EAae4CK8lNeZOu6s7zEi8Fq7qyRFi9WppyAHIgG-wwWNCTvfDqqqy8P7A6qTS1ZH0nrzgMyiVTgLm_14ekZ6fGACIVvpacmWsoyWym66RVRBeDfk1JFjDxVLEh3u8zPnI1uexvD1Lce3Q34IHkp-Y-tbQQgRgCz7fPgLpuSmMYMf-rL98UUbe8D87q4Nx0B-ekOup5wz63Jk5pCb95iuUDmnUsC_S-lH8-Q7jkIj3qzO5tgFtEFA79pFl9xTLEA5kLwEFUMfQ1uB3DcgVYSEPrn7Ung0g35W2OyZCJ9QbkoMwGWB4I20nGMB-kpNaZ7XKZAMAXPxnbw5NK-Qp_o2BiBc-IzENO5RvkegKvyZiH93LzYr3KXcQAnB6zgb-ekeoayrY0f2r9kJjzftIqOe8y6biIehS434usRW2F6-i-ni5AAy2QMIT1wvDNGRZ2JIZiH4gaEiUjgnoFppm8MgSY9gI8sLzZmZmfZsQcbe-3thwOTR0AM1ClHdtr7qvZd45JoTrzUMYtr4rjEP93UO7qq9mye5QkptakdGi_LMLlcTGawQaFN0QQgh9MKcE_COd33egyTGJXS-U1HLoiWbmCMG4HhxxXXGIVIZM-U3FtjRym1zY_s5rj2RMMxVFi_kVw3oA-UoKbREpybamroxrNG0ihCcR84ecVylQFPqbrCsZdsyz6f5pzP1HCRcZNxENNsA9jUzE0CfwzUuHx3o3Lgr38e_eJ15Vdc&sai=AMfl-YTRROSCmKMtTE7c0WCdTeyYvz7qGnR2GetMh7PnMryQL2daDfxdFgE8Z804ycpxvuyw6qBxjicEHStDcOOIbYlKHsOBJSCnQLItWPTvkuksMnnYS1GpEsCd9MVqLw3CortzuWaYlW2nBHUWfYsyLz_e9FpyXB5qEzdFrg0mbWNCT08PNjmY0g-Ve2Fnz9aIl7nJIwQH4eLlwUF8Q1qbsS19LZDqzffyjjFtMzBacGLwUOzkgmqtBaMWR8voYxlQ-htVN7KRHylII7o3v2ha4DL-5rK7vw3MTI-L5eyvng&sig=Cg0ArKJSzDzyW_vE5T0fEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1421&vt=11&dtpt=766&dett=3&cstd=653&cisv=r20221110.01159&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-159-159-128.eu-central-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 4289 12 KB
6 KB 54ms
37ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 15 KB
16 KB 110ms
96ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=104&m=0&partner=19887&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F19887%2F170726%2F8e5e83a15e224956a9c5d4f5e394d0f1_geomi.png&v=3&w=596&s=X0g7Lz5yL8cGQvazTLMTlRPK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f946af174ce4064c6d23be4ec38d56567388a00ab7755c1a72326fc197b0a7cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30749074
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 15740
expires: Mon, 20 Nov 2023 07:24:47 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 11 KB
11 KB 38ms
22ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-114689.png&v=3&w=400&s=G1Z6tiy8_02v8RHj8rMOfy5x&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

31a353f4b34e71c12751c6a4bf5e2e76afafbacd71ce1c0d4e163ec344d8570e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11304
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 9 KB
9 KB 38ms
23ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-116916.png&v=3&w=400&s=-w--2m1O4dUmY23HE84Q2yvA&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7f6a632c3429b966aa753c3e5efdc60ddab510ae3ae732f0e669991d0a82abe0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2844
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9164
expires: Tue, 29 Nov 2022 10:47:37 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 14 KB
14 KB 51ms
36ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-110073.png&v=3&w=400&s=EPNftHQVryNwfDjdWVrg17-a&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

8e228f16a467f4dcda9601e57d279277bd5327703442d990b8e404d5f00d14ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14450
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 68 KB
68 KB 77ms
62ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-136080.png&v=3&w=400&s=YWRyNxci7kUn9G1cTt6eojNG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

878a60085e2f802de5e13872308b142a8428d9d329c9b4cf80409fc089223be2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=2150
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 69143
expires: Tue, 29 Nov 2022 10:36:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 8 KB
8 KB 49ms
34ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-114859.png&v=3&w=400&s=zIoXwpIXDHYJEDRG3qsgW5bJ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

2e2f232af7ad02e00d0c6bb26233eedf6719a6a74d4713040bd8fb02428718cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=13196
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8090
expires: Tue, 29 Nov 2022 13:40:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 10 KB
10 KB 79ms
64ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-91649.png&v=3&w=400&s=SE3ueP3GSN_LNdRa14dQeuUL&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

c04408e2e05394bac83ac943e09b9660f5777139ebf3af5a432181ae3cb6bebf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=8744
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10470
expires: Tue, 29 Nov 2022 12:25:57 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 9 KB
9 KB 53ms
39ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-91182.png&v=3&w=400&s=Yq1yvQC8WzVamsvfa6kBZRZd&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a0274ed2e5a2585e06f8a238a5b4439edf58bc35cccf6b32b9387039a25a3771

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=4494
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9360
expires: Tue, 29 Nov 2022 11:15:06 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 50 KB
50 KB 79ms
65ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-136070.png&v=3&w=400&s=Hjy_PJTheX9WvWhPMTJrsw0O&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

427211b1fded72db03a297c848e04c0539bfe9eeee03eb4d8c7e88b47f2777e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=11877
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 51144
expires: Tue, 29 Nov 2022 13:18:09 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 9 KB
9 KB 76ms
62ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-91652.png&v=3&w=400&s=8xKfcC-FpZje4qotpMbhapHG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

76c7970873ef1d01b53934e5d30028dc23139da4306d3802d93d5c96f8ff8079

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9204
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 42 KB
42 KB 110ms
97ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-135340.png&v=3&w=400&s=cMwq0arujel1SMGHtbARfV7X&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

4860bb3fc5150d07450e99c7932ee3f744d6986692e62372e75ba63e10f31ca7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=11906
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 43197
expires: Tue, 29 Nov 2022 13:18:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 7 KB
8 KB 107ms
95ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-72119.png&v=3&w=400&s=sk3eo8oTiIHxMksy5SPTH2WI&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

d5b7c3eeef5fb827582594f3d8da343a4e5b545d71ecbcacdeb835e30c88eb94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7619
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 7492
expires: Tue, 29 Nov 2022 12:07:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 11 KB
11 KB 107ms
95ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-59832.png&v=3&w=400&s=Iut5TPuMuqvJZzadHjTE1Faq&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

d122dd8dd9b00f48f62593f6c0d74cf160a89acc81a07957891835b9ea2afbe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=7773
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11462
expires: Tue, 29 Nov 2022 12:09:46 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 44 KB
45 KB 107ms
96ms Image
image/png 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-146258.png&v=3&w=400&s=frBsLwjizDvOacg-PKfuL8hW&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a4f9d8ea2387db64c0a7ce2a119e6fd09eadd5b37a26e2092e2b7d935fcf1287

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 45390
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 12 KB
12 KB 107ms
96ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-116076.png&v=3&w=400&s=atvJ0Xn24Q3RMc26SKtHqKHY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

60561e474ed789533722b2e488cb4cbd0167477196a4f575c35ee8d91ac43ead

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=9221
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11918
expires: Tue, 29 Nov 2022 12:33:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 4289 10 KB
10 KB 106ms
97ms Image
image/webp 2a02:2638::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=19887&q=80&r=0&u=https%3A%2F%2Fwww.geomix.de%2Fshop%2Fimages%2F0-0-107978.png&v=3&w=400&s=xqqY2-Jl1lphmHemQEZuNUlx&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

5759cebad9bcea4bc211c8837f23d45edbf76145d4dcbed9dadaa78544bd3bf8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10016
expires: Tue, 29 Nov 2022 10:00:12 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 4289 0
127 B 27ms
18ms Ping
text/plain 2a02:2638::21
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=Cv0qcS4gR2jBYbPavaHVQ1k7hPVRjv3u4JyuXtnka5wh1imfaSsDvPurRJuQD-Torci3CMX6Lso8lWXz9etyvrlL09Nl29w4TSX2fo44LhR4NVk-1cGrXtZsHesr0lm33zsBtKYVdFvrGL8AchH0hcolw0x9yWAB0o3MhSFntejXwd9kep4mDzzY08AXh5QN8qXCCrilR0kAvTo1xHnN3Ijw_z7YyOxZ_9Gr1-5glqzHGQTtMK8Hr-eBvWZNiZwk3gf-XA&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::21 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:11 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 4289 2 KB
1 KB 46ms
39ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:12 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 4289 2 KB
1 KB 23ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 24 Nov 2023 10:00:12 GMT

GET
H3 200 Algovir_Packagings.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 26 KB
26 KB 60ms
59ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/Algovir_Packagings.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98ba645c358687e7cd2018456d3691e703613aa27fa2fa2e54d9396cdf4c55b3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Tue, 22 Nov 2022 19:12:59 GMT
x-content-type-options: nosniff
age: 571633
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27097
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 22 Nov 2023 19:12:59 GMT

GET
H3 200 Check.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 585 B
398 B 76ms
74ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/Check.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f60b30f2c5ddad9a137a0bebdbcdd2df24cf8e1c3f229764e987d72d56aed439

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 25 Nov 2022 15:17:25 GMT
age: 326567
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 360
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 25 Nov 2023 15:17:25 GMT

GET
H3 200 CTA_mehr_erfahren_einzeilig.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 5 KB
2 KB 75ms
74ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/CTA_mehr_erfahren_einzeilig.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eba07c8aaf4516406fe82ace06334844f851e93b3efb12ef6ee69f190a5c4f67

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 26 Nov 2022 15:35:17 GMT
age: 239095
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1689
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 26 Nov 2023 15:35:17 GMT

GET
H3 200 CTA_mehr_erfahren_zweizeilig.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 4 KB
1 KB 62ms
60ms Image
image/svg+xml 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/CTA_mehr_erfahren_zweizeilig.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66e9c7e2345cb50b8e2eed66f19e4ca73427ec6b96b78ecf9387ad152003474b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 25 Nov 2022 15:17:25 GMT
age: 326567
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1265
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 25 Nov 2023 15:17:25 GMT

GET
H3 200 Bubbles.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 15 KB
15 KB 76ms
75ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/Bubbles.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42e15b92dfd5ed76464a31a7e57706652db1f05e4287b112170f0f57c3aeb8f7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 23 Nov 2022 09:19:55 GMT
x-content-type-options: nosniff
age: 520817
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15028
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 23 Nov 2023 09:19:55 GMT

GET
H3 200 algovir_Visual_Spruehstoss.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 14 KB
14 KB 73ms
72ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/algovir_Visual_Spruehstoss.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21b2c55e517d80205308da0a13befc68d57b05b7f077646058b1b584ee872a5c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sat, 26 Nov 2022 14:56:19 GMT
x-content-type-options: nosniff
age: 241433
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14241
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 26 Nov 2023 14:56:19 GMT

GET
H3 200 algovir_flasche.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 20 KB
20 KB 68ms
68ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/algovir_flasche.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c45eea5e6944436e8762d9c18bde4591ac33efd2bfbda1ff9d064712cadaa1ce

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 23 Nov 2022 09:48:23 GMT
x-content-type-options: nosniff
age: 519109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20835
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 23 Nov 2023 09:48:23 GMT

GET
H3 200 Viren.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/ Frame 7098 8 KB
8 KB 73ms
73ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12231767363623583744/Viren.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1c08ac4601146baf8c5c89c7ce57be133c9fa8cf02d02904f0a20d57b0d1e99

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Wed, 23 Nov 2022 15:35:07 GMT
x-content-type-options: nosniff
age: 498305
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7856
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 13:33:03 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 23 Nov 2023 15:35:07 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2DF8 42 B
64 B 85ms
84ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuS5pFTWiP9Uw5mM13_4PGZJT5dQU4yss1V1HBidSj95fpaU-Jkrfzlhrvc39faN6xXIUbjxYCc-v266-TBh_RV3sWKecz4NeRu5MyRNTtKBqvo8RXBM1G7KhbpA2i9Iz3a15u1wQ&sai=AMfl-YRvdB9Jtdexe98dvkfn3_GQki_8KkpG7iXGTuxbRtJLjlNrQeJprpFMO_qo1aVyflpZJmae0LpjD22AFT640MmOvA4bzWyZiIDjAbSBDbn54Ru6zUsNEwQ-5fIRqJtynFO9kBWEK4ODPIoq791p&sig=Cg0ArKJSzDO7OaQmlEJNEAE&cid=CAQSTADq26N9kMPSLMgC8xWspKYCaw-SZhXHTqvRKhf4GR15UNClXofrfzqcXvn7cgMTcfkVUIVVscYA2O43KzP4noptu3MZOtHOW4sbWmsYASAT&id=lidar2&mcvt=1181&p=340,315,430,1285&mtos=1181,1181,1181,1181,1181&tos=1181,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=2342546863&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669716010354&rpt=844&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame C945 0
91 B 96ms
42ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 29 Nov 2022 10:00:12 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK check.html Show response
biddr.brealtime.com/ Frame 2896 926 B
1 KB 123ms
37ms Document
text/html 104.17.120.107
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://biddr.brealtime.com/check.html
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.17.120.107 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 868a78df4f3d0a21f89c48ccc709df44d3875f5fb33e22bf51ca8b5c28be4202

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 5818
CF-Cache-Status: HIT
CF-RAY: 771a7eb64a46918e-FRA
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 29 Nov 2022 10:00:12 GMT
Expires: Tue, 29 Nov 2022 11:00:12 GMT
Last-Modified: Tue, 08 Sep 2020 13:51:51 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
x-amz-id-2: THBBha14TFKejWVop+slac2Gat7v7s2Fu4JGgxBkG9B75xNQjO1mn/icIaXCsUesNFddupQ0giY=
x-amz-request-id: 15DG7FS62Q387667

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 180E 52 KB
17 KB 60ms
10ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/bidder-dev/prebid@master/4.23.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 18476
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 29 Nov 2022 10:00:12 GMT
ETag: W/"623de86a-cf34"
Expires: Tue, 22 Nov 2022 04:52:03 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 6, 339643
X-Served-By: cache-lga13626-LGA, cache-hhn4036-HHN
X-Timer: S1669716012.499315,VS0,VE0

GET
H2 200 batch Show response
services.insurads.com/dfp/mapping/ Frame 1612 931 B
583 B 110ms
109ms Script
application/javascript 44.194.188.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://services.insurads.com/dfp/mapping/batch?appId=2490&requests=[{%22eaup%22:%22/21894097782/LFiles_1x1%22,%22eoid%22:2761469273,%22eolid%22:5507213652,%22advid%22:4830452331,%22w%22:1,%22h%22:1,%22eId%22:%22main_lfiles_1x1_0%22}]&h=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F
Requested by: Host: cdn.insurads.com
URL: https://cdn.insurads.com/iat-1.7.4.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.188.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-188-152.compute-1.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: fe7d7f7c9081c657b4d6a17b32af6ef9d298927ff4de985a712a9bdb848f8fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
content-type: application/javascript; charset=utf-8

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame AD24 47 KB
47 KB 64ms
41ms Font
font/woff2 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:49:00 GMT
x-content-type-options: nosniff
age: 672
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 10:04:00 GMT

GET
H3 200 OnAir-Light.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame AD24 46 KB
46 KB 65ms
44ms Font
font/woff2 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Light.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:50:05 GMT
x-content-type-options: nosniff
age: 607
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46936
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 10:05:05 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AD24 7 KB
6 KB 103ms
79ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

010db0acce8f44bb7f2fd1d0710a1ba24ca7a7ca5fdabbfbb36fe0729a835de2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5683
x-xss-protection: 0

GET
H3 200 60005582_20210507060843268_Asset_Transparent.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame AD24 2 KB
2 KB 74ms
51ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210507060843268_Asset_Transparent.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 08:08:22 GMT
x-content-type-options: nosniff
age: 6710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2040
x-xss-protection: 0
last-modified: Fri, 07 May 2021 13:08:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Nov 2022 08:08:22 GMT

GET
H3 200 60005582_20220908245045701_Siegel.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame AD24 17 KB
17 KB 79ms
55ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220908245045701_Siegel.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c41fa2cdafe9c7021105c32feb68705ba4e7fa1f7f86465a154e958d8330cdd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 16:14:14 GMT
x-content-type-options: nosniff
age: 63958
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17716
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 07:50:45 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 16:14:14 GMT

GET
H3 200 60005582_20220908244709534_300x250_LOOK-01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame AD24 39 KB
39 KB 73ms
51ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220908244709534_300x250_LOOK-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69aeb5d2ad469592eaaaa3378816e4269fd9f94e6ee73cef2487bbafdc573f3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 13:44:36 GMT
x-content-type-options: nosniff
age: 72936
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40341
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 07:47:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 13:44:36 GMT

GET
H3 200 60005582_20220825085147454_300x250_BG.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame AD24 28 KB
28 KB 74ms
52ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220825085147454_300x250_BG.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04fbd20b04ad6a98e605ce6014aaef976cc9a47a939e621c19d801fc59650c91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 08:01:29 GMT
x-content-type-options: nosniff
age: 7123
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28198
x-xss-protection: 0
last-modified: Thu, 25 Aug 2022 15:51:47 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Nov 2022 08:01:29 GMT

GET
H3 200 60005582_20220908244706131_300x250_INTRO.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame AD24 42 KB
42 KB 78ms
56ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220908244706131_300x250_INTRO.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c1972edd197114c7f9580a4299deb5ca08e7bbdd1c9d0b20c294ab1e3f2e405

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:14:51 GMT
x-content-type-options: nosniff
age: 9921
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42691
x-xss-protection: 0
last-modified: Thu, 08 Sep 2022 07:47:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Nov 2022 07:14:51 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame AD24 43 B
639 B 57ms
9ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14112_PV&mediacode=28467061_4307561_345597451_170181290_SOHO0301A20220909&ref=28467061_4307561_345597451_170181290_SOHO0301A20220909
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Hanau, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Last-Modified: Wed, 11 May 2022 05:12:26 GMT
Server: Apache
ETag: "2b-5deb57cb16280"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 43

GET
H2 200 bTVpQ21ia1loaklpd3grVDhlQzUralJ3T0psOTNPeU05bFZPeEVORjFiZmFDNXkwNXFsQXQ3dEZ1V2tac1IxNVJERGZRRzFnZEFjNU9qS1l2Z2pjcTdKZjFCN2oxRFBtak1uMXVjYzAwT0NlUzJUTzFxVThxY2VtWlplSDZrUHVWUEZ6VFUzSU1JOG9aT2ljUEdvO... Show response
ad.vidverto.io/delivery/video/pod/ Frame A3E3 34 KB
15 KB 40ms
39ms XHR
text/xml 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.vidverto.io/delivery/video/pod/bTVpQ21ia1loaklpd3grVDhlQzUralJ3T0psOTNPeU05bFZPeEVORjFiZmFDNXkwNXFsQXQ3dEZ1V2tac1IxNVJERGZRRzFnZEFjNU9qS1l2Z2pjcTdKZjFCN2oxRFBtak1uMXVjYzAwT0NlUzJUTzFxVThxY2VtWlplSDZrUHVWUEZ6VFUzSU1JOG9aT2ljUEdvOUlBMSs3d0VnY0ZnVXRmbVB5ZlVQNkhWeDlpZzJMbm5iNkRLNkwwRmI0U2ZNTGZodzYvSDhpaXVtbE55TUdhQ25GZjFFQ09MODRUb1J3L2ZVQyt2aFcrZDZieG1ZVUhHcUwvdyswS3BiOG02SFFTM0srdTc5LzRCbGdVdHFkb0JNejNqZ1k1Tkh4aFdJMXE4Tm5jSVJPZVo0aFVtK3pQdklzNFN2NWxvM1dYSXRrTlNYQ2o3ck4yYldMd20zcXZNU0pURC8zeFRJbzAzTEdhZzdheGg3eUw0YVExVU1HVkZXY3dkVG1KTGxOZFJsZTRiTkVIb1dHM1Q0WlhKTFN5MkxrU0ZKM1VBSjJWMTZaV3JDVCtGVkRaKzJUZjdMaEdUWFF6YnRSR3U2S3FsRzVFVGtzWko3a044MlM0OGN1SE8wRVcyNlRJbG1kRmx1WXoydUcrQ2JnTjlHRUJNb2ltcThMa2w2ek0vWG9KdENVc05QZ1p6WlBjMXlOaUhQdTBBc2lzak1vZmE3ekJBeG40UWRYS3lNRTNEYmZtSzlISytJamZSK1F2VURLc2dTeHJFRjY4cWFxNUFXN1hRSU1scXJzUXNHL1ExOHVGV2V3aXRzWjhxSlh4bGNzSmxXMC9JeXoyUEtETXU5RjN0Zi9WaHdhNy93d1J2NHA4RWhxeko2aUR4YXQwVXdkZjVpSFkxY3JYakhFdUxYOTVEdmJsSERMUUppeThpVVEzUVZWbjEwM3JqRVRKWXUvNmt4NzkrdEI4Vld1RlBINmtrVlpSVXRUOFlOWVJVPQ%3D%3D
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 03f192f8d6318d002ee0a843fa15e22b9a745baf3a1628e72303fa17bb53240f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin: https://imasdk.googleapis.com
date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/xml;charset=UTF-8

GET
H3 200 e9d812f78ee6aa9851554eab94db7bc0.jpg
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 4 KB
4 KB 57ms
56ms Image
image/jpeg 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/e9d812f78ee6aa9851554eab94db7bc0.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47027eabd0579c3c523ca62ec9adb313835f5a6493c41aaba88d82508704ba9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 21:11:22 GMT
x-content-type-options: nosniff
age: 391730
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3755
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 24 Nov 2023 21:11:22 GMT

GET
H3 200 6cb3df6e7c3d92a9816e85dedff7a776.png
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 3 KB
4 KB 57ms
57ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/6cb3df6e7c3d92a9816e85dedff7a776.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

611eca343c812654b9ead66929102e4e44fc7c917c35c3c55d926991c4fb6906

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 20:54:22 GMT
x-content-type-options: nosniff
age: 306350
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3580
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 20:54:22 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6D07 15 KB
16 KB 38ms
37ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500|Roboto:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 16:44:52 GMT
x-content-type-options: nosniff
age: 62120
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 16:44:52 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6D07 16 KB
16 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500|Roboto:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 11:59:40 GMT
x-content-type-options: nosniff
age: 424832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Nov 2023 11:59:40 GMT

GET
H3 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6D07 15 KB
15 KB 45ms
44ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500|Roboto:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 03:39:12 GMT
x-content-type-options: nosniff
age: 454860
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15752
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Nov 2023 03:39:12 GMT

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/creatives/assets/4085730/ Frame AD24 26 KB
26 KB 51ms
51ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4085730/bubblespritesheettiny.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7880356414873403392/300x250.html?e=69&leftOffset=0&topOffset=0&c=4YcTX5hIhc&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:52:18 GMT
x-content-type-options: nosniff
age: 474
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27068
x-xss-protection: 0
last-modified: Fri, 12 Mar 2021 15:44:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 29 Nov 2022 10:07:18 GMT

GET
H3 200 bridge3.546.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 75A2 690 KB
221 KB 39ms
37ms Document
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f43762f8d21458d2db8345c175545afe7c12bd886a827956d78ae75dafc50179

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 46108
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 226628
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Mon, 28 Nov 2022 21:11:44 GMT
expires: Tue, 28 Nov 2023 21:11:44 GMT
last-modified: Wed, 16 Nov 2022 18:58:05 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 t
t.lkqd.net/ Frame 0
0 686ms
106ms Preflight
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, OPTIONS, POST
access-control-allow-origin: https://www.lebanonfiles.com
access-control-expose-headers: Content-Type, Content-Disposition
access-control-max-age: 300
cache-control: max-age=300
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:13 GMT
server: nginx

POST
H2 200 t Show response
t.lkqd.net/ Frame 4E70 0
168 B 318ms
103ms XHR
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain; charset=UTF-8

GET ad
v.lkqd.net/ Frame A696 0
0

POST
H2 200 t Show response
t.lkqd.net/ Frame 1EB8 0
169 B 309ms
95ms XHR
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain; charset=UTF-8

OPTIONS
H2 200 t
t.lkqd.net/ Frame 0
0 638ms
107ms Preflight
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, OPTIONS, POST
access-control-allow-origin: https://www.lebanonfiles.com
access-control-expose-headers: Content-Type, Content-Disposition
access-control-max-age: 300
cache-control: max-age=300
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:13 GMT
server: nginx

GET ad
v.lkqd.net/ Frame D325 0
0

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 1 KB
1 KB 40ms
39ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/cta.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ba7cc2349a9ea92f75454a856086dcb7eb3f21152c4bb9e0d92af8ac8b3e577

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H3 200 prod2.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 5 KB
5 KB 44ms
42ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/prod2.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25dea38bd0b6126725d2f549e04afb11fe8622c577ae97dca1c66e8cf6b386ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5143
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H3 200 preis.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 4 KB
4 KB 45ms
43ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/preis.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc4aaa83f7893c047bf4f15efaaa6a9a8c96827fbbd38608d8c5c13805bc9759

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4141
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H3 200 prod1.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 13 KB
13 KB 43ms
41ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/prod1.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0b588f1de5a96ba7083455bc4659314b1d20ae3db454da242703026cc7e0fa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13065
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H3 200 text.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 2 KB
2 KB 47ms
45ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/text.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dc5809729bc8a27a11b113e30263b747d48f56eb2fedf08ec44d2205ed8a043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1819
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H3 200 visual.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 5 KB
5 KB 47ms
46ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/visual.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31a19c4591acac3b734484d3120caf6aaf32aec084740b1b07737aa121ff2d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5529
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H3 200 bg.png
s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/ Frame 1924 47 KB
47 KB 45ms
44ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/bg.png

Requested by

Host: 9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
URL: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29650b55a7b4fe07d04b6ed6c41c4f3d810993e17eb4f041dd2529cb1e21f8d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/15037821586992817142/300x250_Samsung%20S22/_export/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 07:00:01 GMT
x-content-type-options: nosniff
age: 10811
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48545
x-xss-protection: 0
last-modified: Fri, 25 Nov 2022 10:19:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:00:01 GMT

GET
H/1.1 206
Partial Content 480_650.mp4
cdn.mox.tv/data/X1XrxbFfg33fxBZ/1399/video/1921/ 485 KB
485 KB 45ms
15ms Media
video/mp4 212.8.250.43
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mox.tv/data/X1XrxbFfg33fxBZ/1399/video/1921/480_650.mp4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.43 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: customer.worldstream.nl
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 6e43822fec19d2047d76d74a7b520993019fdf913a8ed15a8614a62795b91b34

Request headers

Referer: https://www.lebanonfiles.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Range: bytes=38174720-

Response headers

Date: Tue, 29 Nov 2022 10:00:12 GMT
Last-Modified: Thu, 02 Sep 2021 16:36:15 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6130fd7f-24e1341"
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Content-Range: bytes 38174720-38671168/38671169
Connection: keep-alive
Content-Length: 496449

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AD24 17 KB
6 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 localstore.js Show response
script.4dex.io/ Frame 3F17 483 B
765 B 424ms
21ms Script
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 23 Nov 2022 15:43:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 494942
etag: W/"922cffdd75f7192f75231d92684885aa"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v2TFB3eTbCEsBHqMdyolFYcG8S%2BZ44lufDyh86zB7qhy5KAgrkvyZMBlas5uYbQlhlCMBpJGxo8pJUrGFcYvO1aXkRHhElEj%2BwpTkIklrCzQrVnBTx1ihx4wwOdRlNVT9wBKZ3LwDdo8Vlev"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
cf-ray: 771a7eba1f90903a-FRA

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame 3F17 19 B
742 B 421ms
8ms XHR
application/json 18.159.159.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.6.0&referrer=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tmax=2000

Requested by

Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.159.159.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
accept-ch: sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness
x-auction-status: 17
content-type: application/json; charset=utf-8
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ Frame 3F17 0
342 B 425ms
14ms XHR
application/json 81.17.55.99
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 81.17.55.99 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
vary: Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.lebanonfiles.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-length: 0

GET
H2

200

ROS Show response
pbjs.e-planning.net/hb/1/58d04/1/www.lebanonfiles.com/ Frame 3F17
Redirect Chain

https://pbjs.e-planning.net/pbjs/1/58d04/1/www.lebanonfiles.com/ROS?rnd=0.23348629279783029&e=21105888%3A300x600&ur=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25...
https://pbjs.e-planning.net/hb/1/58d04/1/www.lebanonfiles.com/ROS?ct=1&r=pbjs&rnd=0.23348629279783029&e=21105888%3A300x600&ur=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25...

511 B
929 B

16ms
15ms

XHR
application/json

185.172.90.251
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://pbjs.e-planning.net/hb/1/58d04/1/www.lebanonfiles.com/ROS?ct=1&r=pbjs&rnd=0.23348629279783029&e=21105888%3A300x600&ur=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&pbv=6.6.0&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F
Protocol: H2
Server: 185.172.90.251 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: ads.us.e-plannning.net
Software: openresty /
Resource Hash: c73540ec8c95edc3800a89b111dc6010ae04476b5bf58a9556786774360a744f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

expires: Tue, 29 Nov 2022 10:00:13 GMT
date: Tue, 29 Nov 2022 10:00:13 GMT
server: openresty
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-allow-origin: https://www.lebanonfiles.com
content-type: application/json
cache-control: max-age=0, no-cache
access-control-allow-credentials: true
content-length: 511
x-sid: AMS-928

Redirect headers

date: Tue, 29 Nov 2022 10:00:13 GMT
server: openresty
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-allow-origin: https://www.lebanonfiles.com
location: /hb/1/58d04/1/www.lebanonfiles.com/ROS?ct=1&r=pbjs&rnd=0.23348629279783029&e=21105888%3A300x600&ur=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&pbv=6.6.0&ncb=1&vs=F&crs=UTF-8&fr=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F
content-type: text/html; charset=iso-8859-1
access-control-allow-credentials: true
x-sid: AMS-928

GET
H2 200 arj Show response
projectagora-d.openx.net/w/1.0/ Frame 3F17 73 B
145 B 57ms
42ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://projectagora-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=5d1e3500-d7a6-4b10-8c74-9802b52b4efa&nocache=1669716012737&schain=1.0%2C0!projectagora.com%2C102200%2C1%2C%2C%2C&aus=300x600&divids=21105888_lebanonfiles.com_ros-1_300x600&aucs=&auid=543974604
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 30b8952775452fc198621a2ef734e43b7fcc23dcec11f37a6ab9d11116d5cd4d

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
mp.4dex.io/ Frame 3F17 114 B
449 B 465ms
59ms XHR
application/json 2606:4700::6812:272
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:272 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36bad0b0b946d0f77e3b301fd01aa58afe740e8b29c2a4fb62068d7e970f38f3

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
x-err: Shapings: no adunits with size and seat and mapping
x-version: 3.0.0-gcp-ams
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 771a7eba2b21900a-FRA
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ Frame 3F17 241 B
805 B 582ms
179ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21034&site_id=302206&zone_id=1987608&size_id=10&rp_schain=1.0,0!projectagora.com,102200,1,,,&rf=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&tk_flint=pbjs_lite_v6.6.0&x_source.tid=5d1e3500-d7a6-4b10-8c74-9802b52b4efa&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.2906224892724776
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 75d9b1d30228fb0961fd7f77787e78234346b194d9f1dd47292bd5a8f20ad137

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.lebanonfiles.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 241
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 3F17 139 B
994 B 22ms
21ms XHR
application/json 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

1e67f96d653dd631827a449e47ee734ed32c17090681adf7f4b904f2cbe03044

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:12 GMT
AN-X-Request-Uuid: 34ccdf91-f6b6-4f20-98f4-f7efad37b4eb
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 139
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ Frame 3F17 37 B
568 B 555ms
156ms XHR
application/json 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=660899&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2215995358c3bb3b4%22%2C%22site%22%3A%7B%22ref%22%3A%22https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F%22%2C%22page%22%3A%22https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.6.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2216c72ad44539402%22%2C%22banner%22%3A%7B%22topframe%22%3A0%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22660899%22%2C%22sid%22%3A%22300x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A0%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22projectagora.com%22%2C%22sid%22%3A%22102200%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%7D
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50c02e7a7b9d6dc4bd54fabe9aaf66e27889ac728899efca0fc573a73603937d

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AnINQfyH7XK%2FqGMuDFjoepAkMJBndnDSDOFFuXOatk%2Bgh7rp54IeaEUODR2EU3ucFhVE8eh728BCj1uM0ADugBqD7ViwhUrrvyp1HgviXTWiU82Nu42WRUBUbZA4NIoTzNa3RcJR"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 771a7eba2b6e9b5b-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ Frame 3F17 0
162 B 445ms
48ms XHR
text/plain 3.65.191.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/prebid/latest/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.191.35 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-191-35.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 180E 0
747 B 16ms
15ms Script
text/html 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:12 GMT
AN-X-Request-Uuid: 9b099fe8-daba-46d1-af5c-b52a9b5b6992
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 81C4 0
0 68ms
68ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvYTbCBKwDKz9ZYARWU_2EPSiNXJ0zCxM5I3nX99fnbAi4C4ZDCa6pizlyf55Iz4SyPQ2tzOIxwMwkQWe0_Gi3K41lfJbiyWOZoYdwt4W2xpqt1n-OJynOL4V7D5lBoIQrred8-5qMIGnG-Bic1KAmLkrFEALEGxU4e-2bNnUtWER2Z6EqMwToYL88C55PTm23H-1ivmFhwwIQXtFZ8YkhYHXx1IC4UONySvIwxMBU8W9RnpKnR2MOuXqGi_R-nlnXX-2WA3o3Vl1huSj7wE4lQzVv_R7OSXnr8lLqSfTQiKB8l8PAAH2-4eBERtEH_A32dJdLzKTSkBQjm8eOmdzBPYgGclLDKuxN9E9r0vAGZCnPUheIayBozb_AqMtO4mKPw1jP3NOS_VAUEQQYvGpiTGM4gLNWnI2HDgWSxHhx-pHESI1hj1rhkN_D_Vk-fKAXWL9n00l2HaVLynvuAdqaCMuDCghht0oW_5P2wNKqvdPDc3K4PuKPtReLg1qsgqRPjncnkv_AM9gFFDZQPCBm5rHGsjfwvElMMu3zvjGhtyHI_O6cKVZ0bx43ncNrCMdNaL6PPYQamZRXMvQL2pxlX-zqGJpNsQY7zWp5FKVytabz3tS3OyDkYrjLlHYQBZmgreq6Sk-uriRILfrtD3_-kNWiSF06oi6ojZsth5vyak1Bd5pjgr5vF3tnjM87vg2con3O2_UiQcmm_RCvDRnpnUnvFFyHh3bGv4nPDR4zKMP7h9jjoGgpWUKinfbJOCINiuECGlbNSD7SxtLk3hqdUCwMKxTaSKqvwD3saUBE6fsqjAzxIh1xagSP2W9OwA1Eb_AyPUuwd-KCRMpQo7SW1u6vq2XZnWM60YQiUUwwqLA2KubZ7n8NRh58nFLnJZCnES01UKCRg82rSL0Ld6uJBsxfytpqIDc3_ohJrO1ttila8cbMftpvVPp_jllu3H4Xv9F6jMcITJQp0mR-IWJb2HSlbX_Wy0KtY0VjAy3ZDuR2YeSVYX_JRAYRTHvKSpWVKj3E70vTvc4xWQUEVf4gKeI43CVn3ROjWmA44JQyv8kAHM7fgeAt8AsRUe0i2przZD4C4HDrHBAQL5PZaR5pjjQzfZ_la_O_5ZWZrWF7R1EObPok9IsNOWHzEN3OkbrOKxDtZRLD3xLzEOF3RQz1EzgSRdesREn8KStxMsZwq5MsnqqNc6dHRwSRM5KZcz5qD2CRx3inJwTbDLyrk1K8ZNmAcWUKnn2VUaYwKvrh7JJcQuZcF0Rgo4P5CBdgQG5vSo5QhKiD2G_Jhoj66kvgnZr_1geNM2NF9_Lp5xaZsB7muIXItVBs8lZ2tNcQXWA&sai=AMfl-YRhu933-tC-pb2Xxe1w_oHCeJ7g3oKbPR7pk0tQSbVtHjVdiD6muKahVj4lJMryPfp1j6homwYS3XgvaH_u_-20GdbdCP0EFwk3Epd6shSDRJNQzmiB47P7owo9K1-GK1-keS2mbwqGu9n6k3SC3_qddg1dyKAU7zgmcvfuyepKKVVGJqH7zurtoFFaMA3TKjPAiriEOSdTlSRy8TNvvTXJPo8T8JsAEi5lDIb0-aCjBZsfFT3Znw9sceUwFstI68Bc8cjgkIdZHBbfPMwSiIHcbmXJJj2_KndXlAti1hgeVVFNXzqVY_nYFnoVPk5w&sig=Cg0ArKJSzOExqiN-84z7EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2066&vt=11&dtpt=1492&dett=3&cstd=571&cisv=r20221110.17502&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:12 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:12 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/live/ Frame A3E3 98 KB
21 KB 614ms
583ms XHR
text/xml 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/live/ads?iu=%2F21679382043%2C22548546259%2Fmt_video_NPR%2Fmt_lebanonfiles.com_video&description_url=http%3A%2F%2Flebanonfiles.com&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3899691469948190&cust_params=mt_fln%3D1.8&sdkv=h.3.546.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=445&ptt=20&adk=3091252833&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.546.0&sid=E00C6D49-3C80-4BC5-AE63-C0D9A12E7C35&nel=0&eid=44731965%2C44748969%2C44750822%2C44765701&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=1669716012957&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&scor=444682248390253&ged=ve4_td5_tt1_pd5_la5000_er2014.460.2015.1140_vi0.0.1200.1600_vp0_ts1_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

0ab4d7bca0e164c36fb98693f25c43926905329df406b5b03fbcd57b18df5067

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21640
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: ltt
google-creative-id: -1
x-frame-options: SAMEORIGIN
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame A3E3 99 KB
18 KB 561ms
532ms XHR
text/xml 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F21830442390%2C22679584040%2Flebanonfiles.com_%2Fvast_15&description_url=http%3A%2F%2Flebanonfiles.com&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3899691469948190&sdkv=h.3.546.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=445&ptt=20&adk=3091252833&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.546.0&sid=E00C6D49-3C80-4BC5-AE63-C0D9A12E7C35&nel=0&eid=44731965%2C44748969%2C44750822%2C44765701&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=1669716012961&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&scor=444682248390253&ged=ve4_td5_tt1_pd5_la5000_er2014.460.2015.1140_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0eb88affc283ae978792e1c5ea1e20d36e95457f9de3cd2b32f7b37cef2fb6dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18012
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame A3E3 92 KB
17 KB 392ms
366ms XHR
text/xml 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F52555387%2C22679584040%2Flebanonfiles.com_video_preroll&description_url=https%3A%2F%2Flebanonfiles.com&tfcd=0&npa=0&sz=400x300%7C640x480&max_ad_duration=30000&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3899691469948190&sdkv=h.3.546.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=445&ptt=20&adk=3091252833&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.546.0&sid=E00C6D49-3C80-4BC5-AE63-C0D9A12E7C35&nel=0&eid=44731965%2C44748969%2C44750822%2C44765701&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=1669716012963&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&scor=444682248390253&ged=ve4_td5_tt1_pd5_la5000_er2014.460.2015.1140_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53c6588130f702aa2a8c2a2d47d5c939ea24caf90f7e08a3becb3bbdb39a58ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17072
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/live/ Frame A3E3 94 KB
21 KB 573ms
549ms XHR
text/xml 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/live/ads?iu=%2F21986089839%2C22548546259%2Fivm_video%2Fivm_lebanonfiles.com_video&description_url=http%3A%2F%2Flebanonfiles.com&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3899691469948190&cust_params=mt_fln%3D0.8&sdkv=h.3.546.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=445&ptt=20&adk=3091252833&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.546.0&sid=E00C6D49-3C80-4BC5-AE63-C0D9A12E7C35&nel=0&eid=44731965%2C44748969%2C44750822%2C44765701&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=1669716012965&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&scor=444682248390253&ged=ve4_td5_tt1_pd5_la5000_er2014.460.2015.1140_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ac79df96ec401040ca88baf8005e3988451050800e3a53f6da802e113eda54b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21497
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: ltt
google-creative-id: -1
x-frame-options: SAMEORIGIN
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/live/ Frame A3E3 94 KB
21 KB 499ms
476ms XHR
text/xml 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/live/ads?iu=%2F21986089839%2C22548546259%2Fivm_video%2Fivm_lebanonfiles.com_video&description_url=http%3A%2F%2Flebanonfiles.com&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3899691469948190&cust_params=mt_fln%3D0.5&sdkv=h.3.546.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=445&ptt=20&adk=3091252833&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.546.0&sid=E00C6D49-3C80-4BC5-AE63-C0D9A12E7C35&nel=0&eid=44731965%2C44748969%2C44750822%2C44765701&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=1669716012967&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&scor=444682248390253&ged=ve4_td5_tt1_pd5_la5000_er2014.460.2015.1140_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

f75156f93aa86b76e208d13695fd378286d42dc0c37fea9f2f6e652e205405b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21163
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: ltt
google-creative-id: -1
x-frame-options: SAMEORIGIN
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/live/ Frame A3E3 94 KB
21 KB 621ms
601ms XHR
text/xml 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/live/ads?iu=%2F21986089839%2C22548546259%2Fivm_video%2Fivm_lebanonfiles.com_video&description_url=http%3A%2F%2Flebanonfiles.com&tfcd=0&npa=0&sz=400x300%7C640x480&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3899691469948190&cust_params=mt_fln%3D0.3&sdkv=h.3.546.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&sdki=445&ptt=20&adk=3091252833&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.546.0&sid=E00C6D49-3C80-4BC5-AE63-C0D9A12E7C35&nel=0&eid=44731965%2C44748969%2C44750822%2C44765701&url=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&dt=1669716012969&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&scor=444682248390253&ged=ve4_td5_tt1_pd5_la5000_er2014.460.2015.1140_vi0.0.1200.1600_vp0_ts0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

14d3d559ef27a7a44a705d98247b9383448dc0c31b3231691d7b2c101ab4188e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21010
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: ltt
google-creative-id: -1
x-frame-options: SAMEORIGIN
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F093 43 B
215 B 176ms
175ms Image
image/gif 2600:1f13:800:7781:805:604a:656f:8be8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1269461&asId=841e14c7-6476-964f-cc4a-adf43ca24c4a&tv=%7Bc:vlHBtQ,pingTime:-10,time:1705,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA3LjAuNTMwNC4xMjEgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1669716013029%7C%7Cb05cfb8e4cebee0cbc40caa20f0bf88c%7C%7C6663fc817094191839d96ef6de7d9494%7C%7C265e99d8aa3b8c194989be452505ca41%7C%7Ce7f238cdaaea663e1dec8b76b17aa2ba%7C%7Cd0ca2e1ebc16c426754910a7cc899fd2%7C%7C8691636d82e438a2c8c2160081dcc68c%7C%7C41fd06d0b25cf488951fa0c2083ae1ef%7C%7C1663701684,im:%7Bpci:%7Btdr:292%7D,imprf:%7Bttecl:1724,ecd:179,tsecr:400%7D%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7781:805:604a:656f:8be8 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame C499 36 KB
16 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43705
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBF0 0
20 B 82ms
81ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bl_6oKtiFY_aFKNvox_AP0DQAAAAAOAHgBAI&bg=!Pj2lPXnNAAbvMpMzzzI7ACkAdvg8WltUIfYfcDh7-l65kWMrZl--S0fDz9a_OobigbElsIrSotg-xQIAAAO2UgAAAANoAQeZAvYOLuSb3GWJkj0bQwC592ffHVfnRnVm4XwcfcMhSP0bvDEH20MNsENLm9cp3VHt4K3KqVpOGsgytnUG29zzx5iL88ELAoQNMWJdRNWKo9xO8K4TSrCLBkeJ5kykKFm3QCjSnL7DMnAyWtQO1_GS6TRCvb37nIzMbkTF689aWwCOjdJ_GXdjynAmxtXQh_Vv0dyuFm3gYYBe1vx1ip4ic7aBVDHQhqpXUd4aGHrjdHwu-nIR6mwgxdIzh-S8_Iz27RJb-522v_j06u4jQlbupNZIx3X13tb5uraVnP3iVeBV-tboM1V8uNwgL2lhGG3OCkeHicYyr_yTViWGre8i_-100RjZC3pDRkZ3RmXHeAnMhs4TsBtmEEciMD7sxKyHdt3CgAauyJcu2L5jQ4BFJx7kYolZ_bEGmohcYIhlDzzO5SqRVmg2cUBd5TqBHjtof_xA9ODtRdK-ZHnN_6n67oUy15i6HePpK6KHq4n-DIWprraSU1VWj9j1kCxDu0Y6cOzZ9arb4d5zNmHJVewqVUkbAEpBYNaR-WrAoVNOK9LrSC2vnaNLROP0FFFJ79IYZYrBigY7lSelWPYq6hoTTI9nyhNGc6KRbBHZFybSuL-p53NTAGLQELCLxmRBidBJ1OC8klGFfn1ZuFniMm7PnBksMvnQnGerV0cbnmYlayynF98TtGnO5Kc_7ReEDu_Sh5cRChGmkSK3zyG-MpA_GLvZmJTOPuBtQjdij1SgwC0Fgh4l_GBMk2NGI87FB1-YixpDNzZdUQnvdliRQtjki-BeH8rJAzy2KfPmps61xjE6d5dwmhcTVkirLZJL-IuVTBSp3I4Se7HSPONSCCcSDPpVGs8DnQTIN5b1FkBGAh2YpdjBTmAm7K-hTvVGj-ts9rCcuwkDai_CSjkNwKa36tULcri_t96vpIRjWwNUukG60OMCa8LOD8xrAwcM3kBvgsQXGgrAKNrmErIZWCvb386HKbZDW8IpMs8j_xXHqDVZOLXhxe4zzA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200 23.json Show response
id5-sync.com/g/v2/ Frame 3F17 216 B
630 B 21ms
21ms XHR
application/json 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/23.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/156400/7371/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7d8ee1f9b1c62541ee3aea31b87d5528e6c6afe963f14840c31c57697b693d3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 id Show response
id.crwdcntrl.net/ Frame 3F17 43 B
320 B 44ms
44ms XHR
application/json 54.75.190.240
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/156400/7371/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.190.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-190-240.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache
x-server: 10.45.8.64
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 25BE 78 KB
27 KB 53ms
53ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.projectagora-adtag-library.com
URL: https://cdn.projectagora-adtag-library.com/adtag/latest/pav2.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc0c954e7dee4a71fc76a1f9437bf0303aa2882a7b9ee99e4803702e535804db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27211
x-xss-protection: 0
server: sffe
etag: "1406 / 389 of 1000 / last-modified: 1669715139"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 29 Nov 2022 10:00:13 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ Frame 3F17 74 KB
23 KB 59ms
40ms Fetch
application/javascript 2606:4700:20::681a:8a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: XY5JYKRQ6YMYH3XB
age: 605458
x-amz-id-2: 9THHfDwzMqMAFwJNBEOt3ymQIMEj38s0kHaB05MXWuJ6n1PB7nLfFnB04O6xodSKuKaVagyClnw=
last-modified: Tue, 22 Nov 2022 09:44:15 GMT
server: cloudflare
etag: W/"c56b6332dacf72f135afcd153ae22448"
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WK4CNOIv85vKViIB9TMo8Bt7B7bt9mCwcLRavgBp81bfm5wI51VrisdbK6b9hK34aerQwzYSG%2BuGGz%2FXuIdM5nhAdYWmXxqcCyFOLtNswFRYaZxDHCU%2FgTCKzH36xu7kkDIWMSof3xztSva1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
cf-ray: 771a7ebd0f009bb3-FRA

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 309D 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQ_dEKtiFY6f4Ja25x_APlvqBqAgAAAAAOAHgBAI&bg=!i4iliMzNAAbvMpMzzzI7ACkAdvg8WiXh8Y3zJyTpvkMFBt9zt1g5ixdoW-othzPRFJkdet7LNsLXGQIAAAQVUgAAAANoAQcKAKGFj3muBt7EtHQwAcY29HtA5Ldmd5js-VNIwvLe1aRlkgTIthbiB6jgEOQCdn8IrGvtrnOjrkQHdUe0pmHSF-8FuhCZ0fDXybac1X1EOhcy9KWLuJCgZAMLACtgDIH3zPIwrZFzoemD3oYH-9QbCEm80Yc8lZk0ShpOBVB0h5EPnJI44PLtUhbL7CFn7MwrXsYznbhYTQubwfCIjLeAmwH7MJkC9guraA2WmONjuBXQXtNt9XZBSUidjcGECdXWzgH1KK5Nrw17KnN7nHaPsAH5EkFVfRzulSxAGgby81CDtq3d-1-12bskrkk1MaOuauAmd0rxm26KzXhyD5N0cH0UxlCwwVN72drj94guProq3-NmBuDvOO4KL5hBrdO74mExiOg36vdqqKd1MnF7meId9SLZbcJCZsa807ef8AN02iVF8UeD4c5BTH-ICmhembDntVU7ZrfPcwqKbSnzn9C0o_S0JiF79mDYlIERXwlYD8S8CgV3rrq1o-lENao8n3NtoXtvOqDEs23J9-Zy15CcnMalmbkbd6_yBk0MRiLyVlNkUH1NjTPjEcX0KZddTxIG5pPBc1a70rxitYoCxrKX8ACpN9SjWRj4auieZ7pnzAm3SoWCWex-BCHScOA4SRU5fwsF9woXJbrqj2NzsFRPyPuTyLJcTrmBoeLujbAJWDzn9GinYURasmQhd_lpKvLS8oEqWRrfO09s2cm_K5DLNQNmtWA5i3tpf5ZP3vNk_8I8qayj3EsBmAgg1SMPMV9VRG1-21xYke9jRtrh3xyz_Wk8tKAhh3IL5VbkO-hfF0-dVgMPa8GMZXLX6h2GGv26JZBBioKFmNW8dMMng2ZIj6rte78F4VZXLoi0lei7wE9jcoXD1i6Rj_8KNxlNgD9Ivaw5qAncLx1LyDZj09rrGfk6uxHU63iP11pkYdd-HN88TOlIE2v2_-pqevs0sFqlSBLOuQK29mCYyX6qwGcd01ikhfnZNkOSLB6V9c4kxN-KOW-r6NYW8fOXah4Zze6oAsnWKunwvBrFcdGBhLPbEgkdDyszfRKNgCnxfyOahw0LdBdPm7APFIbfRycGTFW5LmEjg2JQ5WcQIT6VQ9ZtFuDp6zuDnaqA-f4JG1l8izx5-2N1Fzw-iuR4E2MIs_LDv-azCc457mxJ3kpiJQDqdpNqUUJCUu5-3qLPMlThygjhEDUrEWwO6Vkwz4HhTQoOiucIwv3ZNiV4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 37ms
36ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 29 Nov 2022 10:00:13 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 321724
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.lebanonfiles.com%2F&domain=www.lebanonfiles.com&cw=1&pbt=1&lsw=1
https://mug.criteo.com/sid?cpp=BAGfmnxUOVVZQjZuTUFoaHhCclRlQWd2ZmdEUUc0by92SnI2Zjg0K0FDbW10ZnNlWFMrWitubXFPYlpyNHRZZko2REd2RnZxeDlONlVvV0dndEltNGFYZ3V6U2RubERvUFJGZ2M2SGlFTFh6eGNsMDJnQnJOZmoza2lkWV...

450 B
714 B

24ms
21ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=BAGfmnxUOVVZQjZuTUFoaHhCclRlQWd2ZmdEUUc0by92SnI2Zjg0K0FDbW10ZnNlWFMrWitubXFPYlpyNHRZZko2REd2RnZxeDlONlVvV0dndEltNGFYZ3V6U2RubERvUFJGZ2M2SGlFTFh6eGNsMDJnQnJOZmoza2lkWVJvNEZ5ZExSYUZXcFlYUGJzMFo4MUpuUXdVVjVxRllMUTA0R1ZKWWNJcGxJMmJXbVlCVFdmNDZJWWpDVUc1dVZGOVhSMlN5cFAxTlRsOURZZlBMdVZvUGIwWXNCOW9oSnlYQjZQQVk0SElmQ08vZDd6R0s2cHordWR1QW94cG9PZ0FHMUU2UGRlWWdKL2FodUZaeXhaZ3g4NU82VlBhd0lPbzlEQ2ZURUg5M3NRaTh4NjE1ND18&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a2eac75312e407c4f02f55f8bfe5426763ebae8180de3fc91aaeb47823dca3fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:12 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3734368
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
access-control-allow-methods: GET
location: https://mug.criteo.com/sid?cpp=BAGfmnxUOVVZQjZuTUFoaHhCclRlQWd2ZmdEUUc0by92SnI2Zjg0K0FDbW10ZnNlWFMrWitubXFPYlpyNHRZZko2REd2RnZxeDlONlVvV0dndEltNGFYZ3V6U2RubERvUFJGZ2M2SGlFTFh6eGNsMDJnQnJOZmoza2lkWVJvNEZ5ZExSYUZXcFlYUGJzMFo4MUpuUXdVVjVxRllMUTA0R1ZKWWNJcGxJMmJXbVlCVFdmNDZJWWpDVUc1dVZGOVhSMlN5cFAxTlRsOURZZlBMdVZvUGIwWXNCOW9oSnlYQjZQQVk0SElmQ08vZDd6R0s2cHordWR1QW94cG9PZ0FHMUU2UGRlWWdKL2FodUZaeXhaZ3g4NU82VlBhd0lPbzlEQ2ZURUg5M3NRaTh4NjE1ND18&cppv=2
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 369668
content-length: 0
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
393 B 62ms
61ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=prebid&fmt=json
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: a93839051aecac7c5d17269448df0ee097f6a102e10edb222c4d379970a05b66

Request headers

Referer: https://www.lebanonfiles.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Thu, 29 Dec 2022 10:00:13 GMT

GET
H/1.1 200
OK sync.html Show response
s.console.adtarget.com.tr/ Frame 6D9D 2 KB
1 KB 454ms
21ms Document
text/html 185.83.70.2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.83.70.2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 7488095254184c79f6f35f2f57dc737d1fb49871bc37b05955f7d9b8aa36fec6

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.lebanonfiles.com
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 800
Content-Type: text/html; charset=UTF-8
Date: Tue, 29 Nov 2022 10:00:13 GMT
Server: Adtelligent
X-Robots-Tag: noindex

GET
H2 200 connectmyusers.php Show response
cdn.connectad.io/ Frame 9112 1 KB
744 B 73ms
50ms Document
text/html 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connectad.io/connectmyusers.php?
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 771a7ebe097c9b8f-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:13 GMT
server: cloudflare

GET
H2 204 d
ic.tynt.com/r/ Frame 3501 0
0 419ms
111ms Document
text/plain 67.202.105.31
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ic.tynt.com/r/d?m=xch&rt=html&gdpr=0gdpr_consent=&us_privacy=&ru=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D304056%26extuid%3D33XUSERID33X
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.31 Palos Park, United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip31.67-202-105.static.steadfastdns.net
Software: nginx/1.16.1 /
Resource Hash

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: "no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false"
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: "Sat, 26 Jul 1997 05:00:00 GMT"
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
server: nginx/1.16.1

GET
H/1.1

200
OK

csync Show response
sync.adtelligent.com/ Frame 5972
Redirect Chain

https://csync.loopme.me/?pubid=11378&gdpr=${&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D319130%26extuid%3D%7Bviewer_token%7D}&gdpr_consent=$...
https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=ef3ad599-7afb-456a-acd1-dd01053ed131&gdpr_consent=${&gdpr=${

0
404 B

384ms
144ms

Document
text/plain

62.149.1.122
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=ef3ad599-7afb-456a-acd1-dd01053ed131&gdpr_consent=${&gdpr=${
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.1.122 Vyshhorod, Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software: Adtelligent /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Tue, 29 Nov 2022 10:00:13 GMT
Etag: 04172fc93c99c15c
Server: Adtelligent

Redirect headers

content-length: 0
date: Tue, 29 Nov 2022 10:00:13 GMT
location: https://sync.adtelligent.com/csync?t=a&ep=319130&extuid=ef3ad599-7afb-456a-acd1-dd01053ed131&gdpr_consent=${&gdpr=${
server: _

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B4F3 52 KB
17 KB 8ms
7ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 18477
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 29 Nov 2022 10:00:13 GMT
ETag: W/"623de86a-cf34"
Expires: Tue, 22 Nov 2022 04:52:03 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 6, 339662
X-Served-By: cache-lga13626-LGA, cache-hhn4036-HHN
X-Timer: S1669716014.750662,VS0,VE0

GET
H2 200 / Show response
ads.us.e-planning.net/uspd/1/ Frame EF08 2 KB
1010 B 80ms
21ms Document
text/html 185.172.90.251
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.90.251 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: ads.us.e-plannning.net
Software: openresty /
Resource Hash: 72ad5bbe066dbbcd07dcc7a08230dc26b2cc665ab6d8e4872e31d6102256a20a

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, no-cache
content-encoding: gzip
content-type: text/html
date: Tue, 29 Nov 2022 10:00:13 GMT
expires: Tue, 29 Nov 2022 10:00:13 GMT
p3p: policyref="http://ads.us.e-planning.net/p3p/eplanning.p3p", CP="NOI DSP COR NID CURa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
server: openresty
x-sid: AMS-928

GET
H2 200 pbjs Show response
sync.quantumdex.io/usersync/ Frame 4B93 4 KB
1 KB 143ms
114ms Document
text/html 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/pbjs
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid7.17.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1449151168f5ede9d4d56a08befc3d94253f42afe654c5337a829329899392e

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 771a7ebe2b509158-FRA
content-encoding: gzip
content-type: text/html
date: Tue, 29 Nov 2022 10:00:13 GMT
server: cloudflare

GET
H2

200

cookie
a.vidoomy.com/api/rtbserver/
Redirect Chain

https://x.bidswitch.net/sync?ssp=vidoomy
https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=cee4ed4f-9f95-473b-a9d7-9b81db31a389

43 B
356 B

32ms
31ms

Image
image/gif

18.184.201.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=cee4ed4f-9f95-473b-a9d7-9b81db31a389
Protocol: H2
Server: 18.184.201.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-201-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: none
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,PATCH,OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-VD-C
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 43

Redirect headers

location: //a.vidoomy.com/api/rtbserver/cookie?i=BS&uid=cee4ed4f-9f95-473b-a9d7-9b81db31a389
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

setuid
a-prebid.vidoomy.com/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58531/occ?gdpr=0&gdpr_consent=undefined
https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A&gdpr=0&gdpr_consent=

0
457 B

66ms
8ms

Image
text/plain

18.184.201.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A&gdpr=0&gdpr_consent=
Protocol: H2
Server: 18.184.201.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-201-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Accept-Encoding, Origin
expires: 0

Redirect headers

location: https://a-prebid.vidoomy.com/setuid?bidder=verizonmedia&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A&gdpr=0&gdpr_consent=
date: Tue, 29 Nov 2022 10:00:13 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 cookie
cm.adform.net/ 43 B
106 B 103ms
20ms Image
image/gif 37.157.4.25
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Frtb.adxpremium.services%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.4.25 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ 0
239 B 90ms
8ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-lupon&gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 cookie
cm.adform.net/ 43 B
105 B 103ms
21ms Image
image/gif 37.157.4.25
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadf%26gdpr%3D0%26gdpr_consent%3Dundefined%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.4.25 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2

200

setuid
a-prebid.vidoomy.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fa-prebid.vidoomy.com%2Fsetuid%3Fbidder%3Dadnxs%26gdpr%3D0%26gdpr_consent%3Dundefined%26uid%3D%24UID
https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=undefined&uid=7999702989176737213

0
425 B

69ms
11ms

Image
text/plain

18.184.201.238
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=undefined&uid=7999702989176737213
Protocol: H2
Server: 18.184.201.238 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-201-238.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
vary: Accept-Encoding, Origin
expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:13 GMT
AN-X-Request-Uuid: 5fd23f55-966d-4185-aaf7-3bbdd9eedc17
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://a-prebid.vidoomy.com/setuid?bidder=adnxs&gdpr=0&gdpr_consent=undefined&uid=7999702989176737213
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ 0
191 B 108ms
27ms Image
text/plain 66.155.71.25
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=120&gdpr=0&gdpr_consent=undefined&redir=https%3A%2F%2Fa.vidoomy.com%2Fapi%2Frtbserver%2Fcookie%3Fi%3DCEN%26uid%3D%7BuserId%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
DATA 200
OK truncated
/ 214 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fcc82a5da2fa1f795ee46a412472ba884f141396c533486d6d7d2a9156f68f39

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 25BE 381 KB
129 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:31:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 29 Nov 2023 09:31:58 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ Frame 25BE 624 B
240 B 49ms
49ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d147d3de6dfdac85b58d3e3aac04a689d46bf74ad329033a61cb61dcdcfbbdab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 215
x-xss-protection: 0
expires: Tue, 29 Nov 2022 10:00:13 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame A3E3 0
327 B 365ms
114ms Ping
image/gif 2607:f8b0:4002:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lb21swdl&c=6088149852364&slotId=3044074926182&qqid=CJKm4e6Q0_sCFeOC_QcdvQ4ORg&gqid=LdiFY9mVDIWO7_UPk9q14Ag&fb=ima_html5-lima&sdkv=h.3.546.0&mrd=4&aab=1&itv=1&eee=missing-element&bi=missing-id&vast_v=4.0&ghmsh_eids=44731965%2C44748969%2C44750822%2C44765701&icc=1&icrh=0&icri=0&icrs=1&icru=0&icp=GoogleWhyThisAd&icdi=18x18&vmfc=2&vhc=0&wta=1&hghme=1&met.4=ghmsh_s.lb21sxi1~ghmsh_s.lb21sxi2~ghmsh_s.lb21sxi2~ghmsh_s.lb21sxkl~ghmsh_s.lb21sxkl~ghmsh_s.lb21sxkl~ghmsh_s.lb21sxmc~ghmsh_s.lb21sxmc~ghmsh_s.lb21sxmc~ghmsh_s.lb21sxmi~ghmsh_s.lb21sxmj~ghmsh_s.lb21sxmj~ghmsh_s.lb21sxmz~ghmsh_s.lb21sxmz~ghmsh_s.lb21sxn0~ghmsh_s.lb21sxnp~ghmsh_s.lb21sxnp~ghmsh_s.lb21sxnq&ghmsh_mi=22%2C18%2C&ghmsh_vi=134%2C136%2C243%2C247%2C396%2C398%2C&ghmsh_ai=139%2C140%2C250%2C&ghmsh_gvt=0&ams=1&vs=1280x720&vc=avc1.64001F&mt=video%2Fmp4&vsrc=youtube&bit=22&cpn=CXIZ03fA6hgnsfNR
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4002:c08::5e Atlanta, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 help_outline_white_24dp_with_3px_trbl_padding.png
imasdk.googleapis.com/formats/wta/ Frame A3E3 453 B
478 B 39ms
39ms Image
image/png 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imasdk.googleapis.com/formats/wta/help_outline_white_24dp_with_3px_trbl_padding.png?wp=ca-video-pub-3191289882045155

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e519cc4b7b8fdc64a7aaafc1b808cde266a234205aac0d6c55589c12446d565e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:31:51 GMT
x-content-type-options: nosniff
age: 1702
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 453
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: image/png
cache-control: public, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 29 Nov 2022 10:21:51 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/live/interaction/ Frame A3E3 42 B
65 B 90ms
89ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/live/interaction/?ai=C_i8cLdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBLEET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pmfek5a4fc6Zq7YfKvjWe13YREwhk_3Hvnwj2WHFkeCb6r-Cxgqkt0nT8V47s1jrJbS46ng3gKCUJI-t8Jutwd8fMwZAZuPl2O113yO6fyTa44c737ME5mHnj25ruqc4q_cU9oATiqqoJDZ6ePVNq_2lPzCWcNk90eBPZp_q7bKphfBe6BG0asfHwFgE5WmVOyalKxJ3MQT2JkK2OkZnmM91W49w5eQ0LUIeNcmREV2RoIdcmRLzPOx1YNoi0Rdf8qgNE7jwO-OF45UtCWXo0MCU-ZS9HyFHjp7wgIPemZFVsSB2DKzBzRIOtCvSVuSE1NPWx3EAUwASS__aGlQTgBAGgBlSAB6r4zpUBqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECxCUNTaHu9qVKrgAoDmAsByAsB0AsPuAwBmg0BD7AT8K-ZEdgTAtgUAdAVAagWAfgWAYAXAQ&sigh=GFi86AiDXw0&label=show_ad

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
x-content-type-options: nosniff
server: ltt
x-frame-options: SAMEORIGIN
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
pubads.g.doubleclick.net/gampad/live/ Frame A3E3 0
0 121ms
121ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/gampad/live/adview?ai=CHGMALdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBLIET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pufc6KxQbt2SZNas8TgF4KULNJzpp_3HilQ1Qbs9RcCbSqsixxSttW5aVpIDF1jq8Qy464wjgKLniyFFlO-vJfjCPNJMDOgl31pxyymIaPDVX6Dz1j01ukYzgfpHuqTsoCMY9o_HjX6sJD2udyFBu_5xMPSacNrp3jRDZpw-4malhfOK58W4asQTz4wI5WpBNPKpKpGjPiVmIQmCIgEsRNMYUGNEyKwcr0I7OWwRbka5lslAgoSnONiqAPkoLzEYRRZN91Z0CzYef_IlNFX2bGbo-YSX_yf1ujJ4gK-R8axlr5xahKzxnw4OpAEyemyE7Iky96SbzGMAEkv_2hpUE4AQBkgUNCCIQAxgBSPuy2gFQAaAGVIAHqvjOlQGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEENPTU6gIAdIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsBsBPwr5kRwhMGGL6HseoC2BMC2BQB0BUBqBYBgBcBshceChwIABIUcHViLTMxOTEyODk4ODIwNDUxNTUYzZ5r&sigh=A0OFKcpMVco&cmd=Ch1jYS12aWRlby1wdWItMzE5MTI4OTg4MjA0NTE1NRAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&cid=CAQSPADq26N9-41vcDaIs6sCU-d8qgU5arTJ9DLssnwORhaAA5uUtMrvY9lEwQY2i9LxjElXB1GSG9b-4H9xkhgBIBM&vt=10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 180E 0
747 B 20ms
20ms Script
text/html 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:13 GMT
AN-X-Request-Uuid: 40cb4125-8053-4da6-9adb-919066bab2ec
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 16ms
16ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 29 Nov 2022 10:00:13 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 425910
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FCFA 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bp7qoKtiFY4W8JtbWgAfs94ngBQAAAAA4AeAEAg&bg=!V1SlVBDNAAbvMpMzzzI7ACkAdvg8WtCWfbTv_vFu0bOVZdW6ycpD5gA0HHP0oGN_UrVEG_k0ObQZaAIAAARDUgAAAANoAQeZAvSo6WuoJzoGhoRq7TB1eUKn0p__jtQzluHCQj-3OZts4EFwFjbzwjjA6uygKdrwncI4U6DnKNt3EEbAjmjlrLAvgQB7a2iwcop1jmGeHBw_pIF1LZ9D27COnbAFhF3YY_A0C7-o_WjwoDcCAhRJuZRtx-cYfffz7wrCuuQQ-WvTdz5KBPs-Dp949PhlmqdJb-0-UFZ82nZ94_86iFY8M7BEtnfM9fN8UoSyzjOjpszyZ2DSVWmSRKR6mvgpLf6hny5OJoh3qScb6rG9mN7v-fJiTzD6eks3hcz0A7b6jw-GPXpSmBUG32WbZbDNGNtG-LaF__kcLwHa3SblNfPWDZNUnoJaaRcaJ_dJnMvQQpWl6H8sDGtmARwVHchXUR5uk9h9kBoOH7xwjYBYW52KCCuxUUsSZheNKNZXRv01Ybzoq4waDNL0TlBwwJaQBE_ZFQdBXYtEMhKqRiT4MQioj6XhZy3UTnVhZb33k1-lO4h47HMfE7sQ_jEA6DopM-uVcdBspbbomnewgQM6XGv5fA6Y6Tdgfh_HxEvVDhYh43TLx4Jmps7sMOOIpFJ3f51NZbjDETRWookLgzsfWVytSrgUAc6sQseCyrtpTsMyTA9gvlPXlBCvU0uIeM6LO1q8tJIk3RSdAI1u_YMMJjYBmHlOj8NPROpNes9TbF89Z1Ljn7Jh-gRjbne9io1n1NGUZ4dFqVp69W-46bbIMDTkkUBzMScc_J5iRYfSk2AuvaVdTCguuAy5tlXhWWTebuyqYllgZcnWAoqXIwJbeAVmdYtNEhtBpoUTep6RAtAyMzjz9NwVZnpQXTalpc6HXhimeQcaHxWm2ZGWr2OOLg_YuR1VCBSD3V9VV7GGeI241c89JWRXkROQeSy2TQrxL_xvZ_v51nsD-c5GA2me2Gt50tCrk6-jXM1UD3Ud5WVnhWYS2S61BCYr9P-xzD1pg7GXnA7LRmH9fE2jVqKk7UamhKMuoglsd4tP3sf5l6ZQX1D0gyPzNkM

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200 ptag Show response
a.audrte.com/ Frame EF08 5 KB
2 KB 3489ms
3129ms Script
text/plain 3.223.194.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://a.audrte.com/ptag?p=M1353665098
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.194.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-194-189.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: a39eb6ba3f712ad85ac5b01d3046f664cf22baf0e9eaf94a12fa957b07b168db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:17 GMT
Content-Encoding: gzip
Server: nginx/1.18.0
Vary: accept-encoding,origin,access-control-request-headers,access-control-request-method,accept-encoding
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-transform, public, max-age=3600
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1649

GET
H2 200 lotame20220615.js Show response
s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/ Frame EF08 566 B
521 B 157ms
18ms Script
application/x-javascript 185.172.90.250
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.90.250 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 4f618d20d85f3163d72432606f3afa3c17b6c79954f967ec3df9a710503c9df4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
last-modified: Wed, 15 Jun 2022 16:21:31 GMT
server: openresty
etag: W/"62aa070b-236"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Sun, 28 Nov 2027 10:00:13 GMT

GET
H2

200

um
u-ams03.e-planning.net/ Frame EF08
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D8103fa85295fbe60%26fi%3Dfcb616ccaf9c767b%26uid%3D%24UID
https://u-ams03.e-planning.net/um?dc=8103fa85295fbe60&fi=fcb616ccaf9c767b&uid=7999702989176737213

42 B
104 B

89ms
14ms

Image
image/gif

185.172.90.252
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams03.e-planning.net/um?dc=8103fa85295fbe60&fi=fcb616ccaf9c767b&uid=7999702989176737213
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 185.172.90.252 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

server: openresty
date: Tue, 29 Nov 2022 10:00:14 GMT
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:13 GMT
AN-X-Request-Uuid: 74c65133-6d78-4204-988f-8dab5ffe60bf
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://u-ams03.e-planning.net/um?dc=8103fa85295fbe60&fi=fcb616ccaf9c767b&uid=7999702989176737213
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

us
sync.go.sonobi.com/ Frame EF08
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3De64f73568d2b3c34%26fi%3Dfcb616ccaf9c767b%26uid%3D%24UID&partner=eplanning
https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzc...

0
500 B

429ms
105ms

Image
text/plain

69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzczNGMQ____________ASp1aHR0cHM6Ly91LWFtczAzLmUtcGxhbm5pbmcubmV0L3VtP2RjPWU2NGY3MzU2OGQyYjNjMzQmZmk9ZmNiNjE2Y2NhZjljNzY3YiZ1aWQ9dWEtMzdlYzBjODMtYWFhZC0zOGQ5LThjNzMtOWQ0NzdjMTc3MzRjMgISBjgB

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

HTTP/1.1

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-5-145
Content-Type: text/plain; charset=utf8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us?gdpr=&gdpr_consent=&us_privacy=&loc=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D18%26buyeruid%3D%5BUID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzczNGMQ____________ASp1aHR0cHM6Ly91LWFtczAzLmUtcGxhbm5pbmcubmV0L3VtP2RjPWU2NGY3MzU2OGQyYjNjMzQmZmk9ZmNiNjE2Y2NhZjljNzY3YiZ1aWQ9dWEtMzdlYzBjODMtYWFhZC0zOGQ5LThjNzMtOWQ0NzdjMTc3MzRjMgISBjgB
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store
content-length: 0
vary: origin
expires: 0

GET
H2 200 dtscout20220831.js Show response
s.e-planning.net/esb/4/0/1992d/1cb3be2948515989/ Frame EF08 478 B
514 B 130ms
19ms Script
application/x-javascript 185.172.90.250
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/1cb3be2948515989/dtscout20220831.js
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.90.250 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: bc9316039e195480aa7580b1acd1619b0d1290c164abcd64ce536f15a32f0996

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:13 GMT
content-encoding: gzip
last-modified: Wed, 31 Aug 2022 19:37:37 GMT
server: openresty
etag: W/"630fb881-1de"
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=157680000
expires: Sun, 28 Nov 2027 10:00:13 GMT

POST
H2 204 csi
csi.gstatic.com/ 0
45 B 265ms
114ms Ping
image/gif 2607:f8b0:4002:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&top=1&puid=1~lb21svwx&c=6088149852364&slotId=3044074926182&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4002:c08::5e Atlanta, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B4F3 0
747 B 19ms
18ms Script
text/html 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:13 GMT
AN-X-Request-Uuid: 5a9f2a6b-5d42-48a4-bbc5-9e8cfb9c5911
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 31B3 0
20 B 74ms
74ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4MRVKtiFY5u_KIyxx_APuOCXsAcAAAAAOAHgBAI&bg=!pKelp-PNAAbvMpMzzzI7ACkAdvg8WtyrZ0LWU2xzcDzmOEvoKkyMz9dkg_2DZ61FlAhMJn5ecrdgWwIAAAStUgAAAANoAQcKAJ3MGZqKVYMd6jjcpXreKF9rr466w0-E6q9rKzTJkVEKNpInGMOm5mFRQmd8Hd7BRlyUGOZAfdDWYSZ92bLYDUgIz0mWgfLt3WMPu6uUWROD20meq43ZbbHhAkwSzAOQ-L5-RlIHfHktP4d96eAQK_7ybTz5sMVxjV_TmKralW-viBBQWcNkUQaSbiZn5p7gGt_04iW4i9ORBtrlimp2mQL8kn-i2nQ343G96EALu6e3rzIwmzd0f8KPiYvuwoIwB0ktTGGDt3gjXgI44h3w0xp0ppJp6-J7I-2QcjWm-mJzEQjDAiup8LelUgSFxOsMRWoPDCPoQ7vSin42i0hUn46Um2Zl4E7tUtv2GHpIvT6zu9aHvWkoK5F5i3A86yaS7LUmeB1xkNr7f6zrVCyifjpuL97fZ7nJ2RwUQenPay2lY44bAjzwBorK_XpnJaASQnXtHeQucmoQ4QvkiyZZWN_Y6qekgTLVw0WdDA88bYFswPLJWpM9c-krnlK2C-w0kyPUjIRr5zJtxlhWtvqBYHFgm66imLBcffoTSPt_-wzS_xzA6t2c5b-mjO9v_CcDCjnnb0rYDVfUA9wPysc0GcZ7LntUYbmqKE8-kFWZ_ZmlgZ0lqPrXfPlGstcjZfB9MD_7nO11llVCwDLlLtMS7O1WXCUtTSuNDfs6dElfkqTqAZSfuarcuMGK1po6d-DPsuHimBAG7pF-HAuuJt94jcFz99hVpiXAbbSMlqfMICv2craKojduNEvUp7eBV96ZcmuLJADF6ir84obxkS91vBn7AEYE1mkClYB4oqoL8UFpQIXX3xR8i5cF18dHSV-0PBIVG36e1pfpG17Y8mLYGu2u8O75UgLbTVGzZ3Md6b_-nCyjU5DpR3zxrqjO6iKLDkWjSqVI_7_l7Chx0sWMEQLsdC82q7fnmbKMBBQgcAPjoMW81-EqnP24SgHz9nQ5vqMfOL3P2BgG6giluGQAgDYqNufn9R55LWYVMIwkiDgL3RV-QU4jqeWov1p5-IMzB75qkIvWKycToBuup3ZtydqGU48tgeL1FRKPkcbxyJF2oGl4ziMq85rDfeRESRPissh15JRB8kgfq_DbNCsjxpsylnLNnWgl6H4YTMF0GZhQTHJs7x0j9aCG6bnFS3PmdAMgPFMCCu7oQfYV6rjm-YmYl0lNHm7YhtJm4ieTlUmdCdAXifhXJgu-Vvvi6BzWKLru8iezC_Sb_xfPvQc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 6E77
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?&p=eplanning_eu&endpoint=eu
https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu

281 B
410 B

59ms
8ms

Document
text/html

23.203.77.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.77.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-77-3.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 233
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:14 GMT
etag: "403b9-119-5ec73a0a33d00"
last-modified: Wed, 02 Nov 2022 02:30:44 GMT
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 29 Nov 2022 10:00:14 GMT
location: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
server: AkamaiGHost

GET
H2 200 usermatch Show response
ssum.casalemedia.com/ Frame AC0D 2 KB
1 KB 144ms
73ms Document
text/html 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5a25bfa6d79807a649d9c6dd4c37c7ddacd52bf4114bd6514594a5dfd59a8c8

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 771a7ec0394a9a3f-FRA
content-encoding: br
content-type: text/html
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dH0%2BJQmqAqah0HudPVVysvyMNqq0LwURtQn6NowTL%2FchZrcrmiIpQsbN9H3Bho2F58eTTnv0%2BS2KYRk3gJXegeBg6LJHLQ2P3UoLzH4WSTUP3yye%2FAR73n%2FE4%2B%2FME%2Bto8loiaiI%2B"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 navegg_2022_01_br.html Show response
i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/ Frame 29C4 1 KB
998 B 74ms
7ms Document
text/html 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://i.e-planning.net/esb/4/1/3fb8/2c3914c3ca0f7642/navegg_2022_01_br.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 Lovettsville, United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: fda04c7b27b3db6bda165e1d1324e7c475edc1f3cc06e927a78f739d74992fcb

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=157680000
cf4age: 0
cf4ttl: 157680000.000
content-encoding: gzip
content-length: 624
content-type: text/html
date: Tue, 29 Nov 2022 10:00:14 GMT
etag: W/"61ddbb71-5f5"
expires: Wed, 20 Oct 2027 17:11:26 GMT
last-modified: Tue, 11 Jan 2022 17:16:33 GMT
server: CFS 0215
x-cf-reqid: b660b11313a41983392d89ac0711ff9c
x-cf-tsc: 1666372287
x-cf1: 29080:fE.fra2:co:1585621119:cacheN.fra2-01:H
x-cf2: H
x-cf3: M
x-cff: B

GET
H2 200 / Show response
spl.zeotap.com/ Frame 223E 9 KB
2 KB 118ms
70ms Document
text/html 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd086c9dc7c48642bacd28796ff61271d91ce9c0312ca78a2ea484a723c65040

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://ads.us.e-planning.net
cf-cache-status: DYNAMIC
cf-ray: 771a7ec01e9a6961-FRA
content-encoding: br
content-type: text/html
date: Tue, 29 Nov 2022 10:00:14 GMT
server: cloudflare
vary: Origin
via: 1.1 google

GET
H/1.1 206
Partial Content videoplayback
rr1---sn-5hne6nzs.googlevideo.com/ 4 MB
4 MB 121ms
16ms Media
video/mp4 2a00:1450:400e:9::6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr1---sn-5hne6nzs.googlevideo.com/videoplayback?expire=1669744813&ei=LdiFY_rXG5OogQeBh7SYBA&ip=2a03:1b20:6:f011::6e&id=3433937c4419bf02&itag=22&source=youtube&requiressl=yes&mh=zr&mm=31&mn=sn-5hne6nzs&ms=au&mv=m&mvi=1&pl=48&susc=gvp&acao=yes&ctier=L&mime=video/mp4&vprv=1&dur=15.046&lmt=1668637598606344&mt=1669715623&txp=5432434&sparams=expire,ei,ip,id,itag,source,requiressl,susc,acao,ctier,mime,vprv,dur,lmt&sig=AOq0QJ8wRAIgQquVTetv1oyeUGJAjaSfvEe_jMqUUJGcDGYx6JlnkGACIASh_NJc35d42X-6acPND5PGezviXOANMmmXg4jGFEJu&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AG3C_xAwRQIgaj4lTQYSMOhpaRYEOUY5jM13QC9GCJsscPG56obVSJgCIQCCO5PUxV7sX_8j4XgJsjQC12CGoOrI7PXbpVVlG1uEvg==&cpn=OWHxr0SurlpKtJh9

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:9::6 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

a16053bead16bb05915e62c0e9a378dcc219c6cc7947fddca0c44d86b814e9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.lebanonfiles.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 29 Nov 2022 10:00:14 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 16 Nov 2022 22:26:38 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-3729634/3729635
Cache-Control: private, max-age=28499
Cross-Origin-Resource-Policy: cross-origin
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 3729635
Expires: Tue, 29 Nov 2022 10:00:14 GMT

GET
H2 204 1
sync-eu.connectad.io/syncer/ Frame B07E 0
0 108ms
87ms Document
text/plain 2606:4700:10::6816:37ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-eu.connectad.io/syncer/1
Requested by: Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:37ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://cdn.connectad.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 771a7ebfee639b8f-FRA
date: Tue, 29 Nov 2022 10:00:14 GMT
server: cloudflare
via: 1.1 google

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame 25BE 107 B
122 B 48ms
47ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 25BE 107 B
122 B 46ms
46ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.lebanonfiles.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 25BE 31 KB
11 KB 227ms
226ms XHR
text/plain 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=560991975837033&correlator=3798612641590505&eid=21068767%2C44777897%2C21065724&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fif&iu_parts=21894097782%2CLfiles_AgoraPB_300x600(1)_Desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&ifi=1&adks=2203638915&sfv=1-0-40&eri=4&sc=1&cookie=ID%3D876d9e89546f7311-226a6169f2d70058%3AT%3D1669716008%3AS%3DALNI_ManxOX3-PHDEeR0N5Is-jpjnSEPVw&cdm=www.lebanonfiles.com&gpic=UID%3D00000b8a113c8986%3AT%3D1669716008%3ART%3D1669716008%3AS%3DALNI_Mb0F5kCvD8FOgYQJZl8nNlMgaXqPA&abxe=1&dt=1669716014053&dlt=1669716010850&idt=3133&adxs=-12245933&adys=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=nkgy4tmr6d53&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=2&url=lebanonfiles.com&loc=https%3A%2F%2Fwww.lebanonfiles.com%2Farticles%2F%25D8%25A3%25D8%25AE%25D8%25A8%25D8%25A7%25D8%25B1-%25D8%25A7%25D9%2584%25D8%25B3%25D8%25A7%25D8%25B9%25D8%25A9%2F%25D9%2586%25D9%2588%25D9%2581%25D9%2588%25D8%25B3%25D8%25AA%25D9%258A-%25D9%2582%25D8%25B5%25D9%2581-%25D8%25A3%25D9%2588%25D9%2583%25D8%25B1%25D8%25A7%25D9%2586%25D9%258A-%25D8%25A8%25D8%25B5%25D9%2588%25D8%25A7%25D8%25B1%25D9%258A%25D8%25AE-%25D9%2583%25D8%25A7%25D9%2584%25D9%258A%25D8%25A8%25D8%25B1-%25D8%25B9%25D9%2584%2F&top=www.lebanonfiles.com&frm=23&vis=1&psz=0x0&msz=0x0&fws=256&ohw=0&ea=0&ga_vid=1219796233.1669716008&ga_sid=1669716014&ga_hid=953832717&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f83882a65d74a9bade730f55ced7a9c8fe8736224f7f771094adb3293485d945

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11459
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.lebanonfiles.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 25BE 14 KB
11 KB 87ms
87ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022111501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c3fcfbb1d6734faf29b3e830d4e59952abd7512623f4c4e979edc43afb8f2c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11009
x-xss-protection: 0

GET
H2 200 container.html Show response
b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3A5D 6 KB
3 KB 96ms
45ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: Wed, 29 Nov 2023 10:00:14 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 4B93
Redirect Chain

https://hbx.media.net/cksync.php?cs=1&type=pbs&ovsid=setstatuscode&bidder=medianet&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dmedianet%26uid%3D%3C...
https://sync.quantumdex.io/setuid?bidder=medianet&uid=0000EEA

43 B
94 B

116ms
115ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=medianet&uid=0000EEA
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 771a7ec0b8a99158-FRA
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
strict-transport-security: max-age=86400 ; includeSubDomains, max-age=604800
date: Tue, 29 Nov 2022 10:00:14 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
location: https://sync.quantumdex.io/setuid?bidder=medianet&uid=0000EEA
content-type: text/html
cache-control: max-age=0, no-cache, no-store
content-length: 154
x-mnet-hl2: E
expires: Tue, 29 Nov 2022 10:00:14 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 4B93 0
277 B 68ms
15ms Image
text/plain 72.251.249.9
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsovrn%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 29 Nov 2022 10:00:14 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H/1.1

204
No Content

merge
ce.lijit.com/ Frame 4B93
Redirect Chain

https://ssp.disqus.com/redirectuser/?partner=valueimpression&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dzeta-global%26uid%3DBUYERUID
https://ce.lijit.com/merge?pid=279534&3pid=ua-37ec0c83-aaad-38d9-8c73-9d477c17734c&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNI...

0
311 B

108ms
28ms

Image
text/plain

216.52.2.48
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=279534&3pid=ua-37ec0c83-aaad-38d9-8c73-9d477c17734c&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzczNGMQ____________ASpgaHR0cHM6Ly9zeW5jLnF1YW50dW1kZXguaW8vc2V0dWlkP2JpZGRlcj16ZXRhLWdsb2JhbCZ1aWQ9dWEtMzdlYzBjODMtYWFhZC0zOGQ5LThjNzMtOWQ0NzdjMTc3MzRjMgIMBjgB
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Server: 216.52.2.48 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Expires: Fri, 20 Mar 2009 00:00:00 GMT
Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
X-MERGE: GDPR Optout true
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ams1
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

location: https://ce.lijit.com/merge?pid=279534&3pid=ua-37ec0c83-aaad-38d9-8c73-9d477c17734c&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNID%5D%26r%3DCid1YS0zN2VjMGM4My1hYWFkLTM4ZDktOGM3My05ZDQ3N2MxNzczNGMQ____________ASpgaHR0cHM6Ly9zeW5jLnF1YW50dW1kZXguaW8vc2V0dWlkP2JpZGRlcj16ZXRhLWdsb2JhbCZ1aWQ9dWEtMzdlYzBjODMtYWFhZC0zOGQ5LThjNzMtOWQ0NzdjMTc3MzRjMgIMBjgB
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store
content-length: 0
vary: origin
expires: 0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 4B93
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=7999702989176737213

43 B
94 B

126ms
126ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=7999702989176737213
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 771a7ec05fbd9158-FRA
content-length: 43
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
AN-X-Request-Uuid: 8572d79b-65ed-4b2a-a9d7-b896ea86e7ec
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=7999702989176737213
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame 4B93
Redirect Chain

https://ups.analytics.yahoo.com/ups/58424/occ
https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A

43 B
128 B

118ms
118ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 771a7ec05fb69158-FRA
content-length: 43
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=verizon-display&uid=y-1ukrxXJE2uGkygX4yCP3RRMOVRJ6ps5lDZq97VQ-~A
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 204 v1
match.sharethrough.com/FGMrCMMc/ Frame 4B93 0
35 B 52ms
10ms Image
text/plain 18.194.69.136
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.69.136 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-69-136.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT

GET
H/1.1 200 0.gif
id5-sync.com/i/495/ Frame 4B93 43 B
1 KB 9ms
7ms Image
image/gif 141.95.98.64
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dinmobi%26uid%3D%7BID5UID%7D

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 29 Nov 2022 10:00:13 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

GET
H2 204 /
s.ad.smaato.net/c/ Frame 4B93 0
239 B 44ms
9ms Image
text/plain 2600:9000:211e:600:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=p&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsmaato%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:600:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-cache, must-revalidate
via: 1.1 cb1bcb02f5d0667fafd0890701965f18.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: JwDCyND1ViawR4ePHHkcIXePegqLissc80Oe7aC0oaaoDX6G7Y_ucg==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H2

200

setuid
sync.quantumdex.io/ Frame 4B93
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D&crf=1
https://sync.quantumdex.io/setuid?bidder=between&uid=cafdc05c-8c5a-524d-9211-2f1af194f737

43 B
94 B

117ms
116ms

Image
image/gif

2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=between&uid=cafdc05c-8c5a-524d-9211-2f1af194f737
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 771a7ec119889158-FRA
content-length: 43
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=between&uid=cafdc05c-8c5a-524d-9211-2f1af194f737
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 8835 2 KB
1 KB 138ms
71ms Document
text/html 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2489c0d69131797cc1d7fdfe8a90013ed66e9b6d1411136bad2cc7a49b609d7

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 771a7ec08967911e-FRA
content-encoding: br
content-type: text/html
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uuzrIEnHa2K73cUG0WTe3QrhVtO2CDHQQeuzxh6R7%2B%2BOSIAoUtKiC1efSY13o%2BpE8v6UBTvOm6%2FIW3nKnoLUMNFhy5M6rbIXN2WfyuYZpfbYupgQJwnkmFl6WhVL0Nt9iYgZFlghYB%2BWfw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 204 pbsync
usermatch.targeting.unrulymedia.com/ Frame A74D 0
0 80ms
13ms Document
text/plain 213.19.147.44
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://usermatch.targeting.unrulymedia.com/pbsync?gdpr=${GDPR}&consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&rurl=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.44 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 1714
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-valueimpression&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east

281 B
410 B

29ms
9ms

Document
text/html

23.203.77.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.77.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-77-3.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 233
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:14 GMT
etag: "403b9-119-5ec73a0a33d00"
last-modified: Wed, 02 Nov 2022 02:30:44 GMT
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 29 Nov 2022 10:00:14 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east
server: AkamaiGHost

GET
H2 204 /
onetag-sys.com/usync/ Frame BAA0 0
0 14ms
8ms Document
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 0586 15 KB
6 KB 10ms
6ms Document
text/html 88.221.168.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=104882
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:14 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Wed, 30 Nov 2022 15:08:16 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 0586 3 KB
3 KB 17ms
15ms Script
text/html 185.64.189.115
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=92199739&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 17ef10acb55dea74042156169d79ad9c3007d4c0d03a8c2e61964c14ebcbb50c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 25BE 17 KB
6 KB 72ms
70ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:14 GMT

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 6E77 34 KB
10 KB 12ms
11ms Script
text/html 23.203.77.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.77.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-77-3.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8bcf9a2d833eb44fca72ad4cf060ddef063d3d6e4bb2266e6eb3e906c6bb2dac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
last-modified: Tue, 29 Nov 2022 03:21:09 GMT
server: Apache/2.2.15 (CentOS)
x-powered-by: PHP/5.3.3
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control: max-age=62455
content-length: 10066
expires: Wed, 30 Nov 2022 03:21:09 GMT

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 1714 34 KB
10 KB 7ms
7ms Script
text/html 23.203.77.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.203.77.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-203-77-3.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8bcf9a2d833eb44fca72ad4cf060ddef063d3d6e4bb2266e6eb3e906c6bb2dac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
last-modified: Tue, 29 Nov 2022 03:21:09 GMT
server: Apache/2.2.15 (CentOS)
x-powered-by: PHP/5.3.3
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control: max-age=62455
content-length: 10066
expires: Wed, 30 Nov 2022 03:21:09 GMT

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame 223E 0
0 15ms
14ms Image
text/html 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 223E 170 B
188 B 48ms
48ms Image
image/png 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

159.248.227.35.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://pixel.tapad.com/idsync/ex/push?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26...
https://pixel.tapad.com/idsync/ex/push/check?partner_url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BTA_DEVICE_ID%7D%26zpartnerid%3D5%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent...
https://mwzeom.zeotap.com/mw?cid=11a965a9-be4e-43ef-9b0c-aaf66beecd44&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074...

95 B
152 B

113ms
112ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=11a965a9-be4e-43ef-9b0c-aaf66beecd44&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec2ddb66961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://mwzeom.zeotap.com/mw?cid=11a965a9-be4e-43ef-9b0c-aaf66beecd44&zpartnerid=5&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 403 /
dmp.adform.net/serving/cookie/match/ Frame 223E 0
331 B 126ms
25ms Image
text/plain 37.157.5.142
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dmp.adform.net/serving/cookie/match/?party=1105&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

Requested by

Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.142 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 223E 70 B
264 B 39ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361&gdpr=1&gdpr_consent=
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 cm
trc.taboola.com/sg/zeotap/1/ Frame 223E 0
161 B 46ms
16ms Image
text/plain 2a04:4e42:400::300
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/zeotap/1/cm?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-vcl-time-ms: 9
date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 varnish
x-cache-hits: 0
server: nginx
x-timer: S1669716014.264187,VS0,VE9
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-served-by: cache-hhn4024-HHN

GET
H/1.1 200
OK u
dmp.v.fwmrm.net/ad/ Frame 223E 0
411 B 641ms
117ms Image
text/html 2600:1f16:e61:3f02:77d9:b48f:f0d0:e412
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.v.fwmrm.net/ad/u?mode=echo&cr=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1368%26env%3DmWeb%26cid%3D%23%7Buser.id%7D%26gdpr%3D%24%7BGDPR_ENFORCED%7D%26gdpr_consent%3D%24%7BGDPR_CONSENT%7D
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f16:e61:3f02:77d9:b48f:f0d0:e412 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Content-Type: text/html
P3P: policyref="https://www.freewheel.tv/w3c/p3p.xml",CP="ALL DSP COR NID"
Cache-Control: no-store
Connection: keep-alive
Keep-Alive: timeout=300
Content-Length: 0
Expires: 0

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 223E 0
41 B 19ms
13ms Image
text/html 185.64.189.115
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?gdpr=1&gdpr_consent=&rd=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1384%26env%3DmWeb%26cid%3D%23PM_USER_ID%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000cce0c-25f4-479f-6dd5-4755453376aa%26reqId%3D835b1cc0-6534-4074-4d30-afd2a5feee4b%26zdid%3D1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Tue, 29 Nov 2022 10:00:13 GMT
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
https://sync.tidaltv.com/genericusersync.ashx?dpid=3169&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=136...
https://mwzeom.zeotap.com/mw?cid=067733f7-8960-4179-96ed-2b583cca373e&zpartnerid=317&gdpr=1&gdpr_consent=

95 B
152 B

97ms
93ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=067733f7-8960-4179-96ed-2b583cca373e&zpartnerid=317&gdpr=1&gdpr_consent=
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec30e096961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=067733f7-8960-4179-96ed-2b583cca373e&zpartnerid=317&gdpr=1&gdpr_consent=
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=000cce0c-25f4-479f-6dd5-4755453376aa&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=000cce0c-25f4-479f-6dd5-4755453376aa&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env...
https://mwzeom.zeotap.com/mw?cid=39549946983054876980845119877463050484&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-...

95 B
152 B

99ms
98ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=39549946983054876980845119877463050484&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec2fddb6961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

DCS: dcs-prod-irl1-2-v045-0bb46f593.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: Mt7AGwirRJU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://mwzeom.zeotap.com/mw?cid=39549946983054876980845119877463050484&zpartnerid=314&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 /
loadeu.exelator.com/load/ Frame 223E 0
324 B 141ms
32ms Image
text/plain 54.78.254.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadeu.exelator.com/load/?p=709&g=008&j=0&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET zeotap.php
bn01.er.bemail.it/ Frame 223E 0
0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%25%25COOKIE%25%25%26env%3DmWeb%26zpartnerid%3D563%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_con...
https://mwzeom.zeotap.com/mw?cid=7171375673745340571&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-...

95 B
152 B

95ms
95ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=7171375673745340571&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec169b86961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?cid=7171375673745340571&env=mWeb&zpartnerid=563&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

check
pixel.tapad.com/idsync/ex/receive/ Frame 223E
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=2885&partner_device_id=000cce0c-25f4-479f-6dd5-4755453376aa
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=000cce0c-25f4-479f-6dd5-4755453376aa

95 B
122 B

73ms
40ms

Image
image/png

35.227.248.159
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=000cce0c-25f4-479f-6dd5-4755453376aa

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

Server

35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type: image/png
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2885&partner_device_id=000cce0c-25f4-479f-6dd5-4755453376aa
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://idsync.frontend.weborama.fr/ids?key=zeotap&value=000cce0c-25f4-479f-6dd5-4755453376aa&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://idsync.frontend.weborama.fr/ids?key=zeotap&value=000cce0c-25f4-479f-6dd5-4755453376aa&url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fwebouuid%3D%7BWEBO_CID%7D%26env%3DmWeb%26zpartnerid%3D431%26...
https://mwzeom.zeotap.com/mw?webouuid=cd7g/F2JM37ux3Pi/3kVOu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-40...

95 B
152 B

56ms
56ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?webouuid=cd7g/F2JM37ux3Pi/3kVOu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec3df8c6961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
last-modified: Tue, 29 Nov 2022 10:00:14 GMT
server: Weborama Collect Frontend
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
location: https://mwzeom.zeotap.com/mw?webouuid=cd7g/F2JM37ux3Pi/3kVOu&env=mWeb&zpartnerid=431&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
H2 404 2.gif
dmp.theadex.com/d/949/i/ Frame 223E 0
84 B 66ms
10ms Image
text/plain 185.15.245.82
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.theadex.com/d/949/i/2.gif?axd_fuid=000cce0c-25f4-479f-6dd5-4755453376aa&axd_pid=175
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.15.245.82 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: 0

GET
H2 404 tpid=000cce0c-25f4-479f-6dd5-4755453376aa
bcp.crwdcntrl.net/map/c=13620/tp=ZEOT/ Frame 223E 49 B
264 B 59ms
30ms Image
image/gif 54.75.190.240
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=13620/tp=ZEOT/tpid=000cce0c-25f4-479f-6dd5-4755453376aa?https://mwzeom.zeotap.com/mw?pid=${profile_id}&zpartnerid=637&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.190.240 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-190-240.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.31.62
content-length: 49
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ZTAP
https://ups.analytics.yahoo.com/ups/58697/cms?partner_id=ZTAP
https://mwzeom.zeotap.com/mw?cid=y-KUZKirxE2ooiFcol4Ez2yN9qN4tj_dkPMA--~A&zpartnerid=570&env=mWeb

95 B
152 B

41ms
40ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=y-KUZKirxE2ooiFcol4Ez2yN9qN4tj_dkPMA--~A&zpartnerid=570&env=mWeb
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec468d86961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=y-KUZKirxE2ooiFcol4Ez2yN9qN4tj_dkPMA--~A&zpartnerid=570&env=mWeb
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=DEU&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zd...
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1361&cid=h6O4Jsk0KNFP0pxU4ngPit6f%2F0F29XFy%2BS41iYitP1U%3D

95 B
152 B

52ms
51ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1361&cid=h6O4Jsk0KNFP0pxU4ngPit6f%2F0F29XFy%2BS41iYitP1U%3D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec418116961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1361&cid=h6O4Jsk0KNFP0pxU4ngPit6f%2F0F29XFy%2BS41iYitP1U%3D
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
expires: 0

GET
H2 200 v2
odr.mookie1.com/t/ Frame 223E 43 B
356 B 246ms
45ms Image
image/gif 34.98.67.61
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2?tagid=V2_746632&src.visitorId=000cce0c-25f4-479f-6dd5-4755453376aa&gdpr=1&gdpr_consent=&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
server: Apache
content-type: image/gif;charset=UTF-8
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 223E 0
337 B 35ms
30ms Image
text/plain 52.16.228.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=141838&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.228.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-228-49.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-served-by: beacon-n015-dub-prod.krxd.net
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: private, no-cache, no-store
x-request-time: D=42 t=1669716014
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 /
sync.richaudience.com/1988B3F6BED450961C9D70DD91/ Frame 223E 95 B
359 B 197ms
17ms Image
image/png 168.119.149.178
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.richaudience.com/1988B3F6BED450961C9D70DD91/?uuid=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 168.119.149.178 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.178.149.119.168.clients.your-server.de
Software: nginx/1.14.2 /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/png
date: Tue, 29 Nov 2022 10:00:14 GMT
server: nginx/1.14.2
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_co...
https://sync-tm.everesttech.net/ct/upi/pid/cQZGoH6Q?redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D876%26env%3DmWeb%26cid%3D${TM_USER_ID}%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr...
https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=Y4XYLgAAAQWkKgAF&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd...

95 B
152 B

49ms
46ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=Y4XYLgAAAQWkKgAF&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&_test=Y4XYLgAAAQWkKgAF
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec35eb86961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

x-served-by: cache-hhn4083-HHN
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1669716015.594014,VS0,VE0
x-cache: HIT
location: https://mwzeom.zeotap.com/mw?zpartnerid=876&env=mWeb&cid=Y4XYLgAAAQWkKgAF&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&_test=Y4XYLgAAAQWkKgAF
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://pixel.mathtag.com/sync/img?mt_exid=10092&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%5BMM_UUID%5D%26env%3DmWeb%26zpartnerid%3D979%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_co...
https://mwzeom.zeotap.com/mw?cid=a0c26385-d82c-4500-b987-c9e88ac67507&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc...

95 B
152 B

54ms
53ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=a0c26385-d82c-4500-b987-c9e88ac67507&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec468ce6961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: MT3 169 32252b7 master cdg-pixel-x28 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Location: https://mwzeom.zeotap.com/mw?cid=a0c26385-d82c-4500-b987-c9e88ac67507&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Tue, 29 Nov 2022 10:00:13 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 223E
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=zeotap&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
https://mwzeom.zeotap.com/mw?zpartnerid=768&cid=POkKfy8T&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=000cce0c-25f4-479f-6dd5-4755453376aa

0
337 B

31ms
30ms

Image
text/plain

52.16.228.49
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=000cce0c-25f4-479f-6dd5-4755453376aa
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 52.16.228.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-228-49.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

x-served-by: beacon-n024-dub-prod.krxd.net
date: Tue, 29 Nov 2022 10:00:15 GMT
cache-control: private, no-cache, no-store
x-request-time: D=30 t=1669716015
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Tue, 29 Nov 2022 10:00:15 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html; charset=utf-8
location: https://beacon.krxd.net/usermatch.gif?partner=zeotap&partner_uid=000cce0c-25f4-479f-6dd5-4755453376aa
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec68df26961-FRA
access-control-allow-headers: *

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame 223E
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd...
https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd...

43 B
568 B

39ms
38ms

Image
image/gif

52.94.223.167
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&dcc=t

Requested by

Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID

Protocol

HTTP/1.1

Server

52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: C8WDJAQZQ7NRFDX3E96B
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 0XYGQJ874C7HJ63HB5YX
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=cda341cb-196c-4da8-897b-752ce4bb588d&id=000cce0c-25f4-479f-6dd5-4755453376aa&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 400 87734
tags.bluekai.com/site/ Frame 223E 0
145 B 185ms
163ms Image
text/plain 69.192.160.219
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/87734?id=000cce0c-25f4-479f-6dd5-4755453376aa&gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1202%26env%3DmWeb%26cid%3D%24_BK_UUID%26BK_SWAP_DEST%3D87734&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.192.160.219 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-219.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-length: 0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://obgpm76tt0a0sgogzhdfe.redinuid.imrworldwide.com/zeo?url=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fzpartnerid%3D1395%26env%3DmWeb%26eventType%3Dmap%26gdpr%3D1%26gdpr_consent%3D%26id_mid_4%3D000...
https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361

95 B
152 B

41ms
37ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec4c9996961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?zpartnerid=1395&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
date: Tue, 29 Nov 2022 10:00:14 GMT
cross-origin-resource-policy: cross-origin
content-length: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://pixel.rubiconproject.com/token?pid=41544&puid=000cce0c-25f4-479f-6dd5-4755453376aa&gdpr=1&gdpr_consent=&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-47554533...
https://mwzeom.zeotap.com/mw?cid=LB21SX9B-T-CTIZ&env=mWeb&zpartnerid=1770&gdpr=1

95 B
152 B

60ms
59ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=LB21SX9B-T-CTIZ&env=mWeb&zpartnerid=1770&gdpr=1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec499406961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

Location: https://mwzeom.zeotap.com/mw?cid=LB21SX9B-T-CTIZ&env=mWeb&zpartnerid=1770&gdpr=1
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 223E
Redirect Chain

https://x.bidswitch.net/syncd?dsp_id=461&user_group=1&expires=5&user_id=000cce0c-25f4-479f-6dd5-4755453376aa&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BBSW_UID%7D%26env%3DmWeb%26zpart...
https://mwzeom.zeotap.com/mw?cid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&env=mWeb&zpartnerid=1771&gdpr=1&gdpr_consent={consent_string}&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f...

95 B
163 B

69ms
55ms

Image
image/png

2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&env=mWeb&zpartnerid=1771&gdpr=1&gdpr_consent={consent_string}&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec159aa6961-FRA
access-control-allow-headers: *
content-length: 95

Redirect headers

location: https://mwzeom.zeotap.com/mw?cid=cee4ed4f-9f95-473b-a9d7-9b81db31a389&env=mWeb&zpartnerid=1771&gdpr=1&gdpr_consent={consent_string}&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 200 mw
mwzeom.zeotap.com/ Frame 223E 95 B
152 B 43ms
43ms Image
image/png 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=1353&env=mWeb&env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec468d26961-FRA
access-control-allow-headers: *
content-length: 95

GET
H2 200 cmp.min.js Show response
spl.zeotap.com/ Frame 223E 557 B
468 B 48ms
46ms Script
text/plain 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/cmp.min.js?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8fbd315c458dc6fb0e7ecda8b13798bbff888a3b2f008817d9b2baf62eede8a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 771a7ec108a36961-FRA
access-control-allow-headers: *

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame AC0D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGjVNouTngN0GQ4t18pTGBE&google_cver=1

43 B
881 B

62ms
45ms

Image
image/gif

104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGjVNouTngN0GQ4t18pTGBE&google_cver=1
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: H3
Server: 104.18.33.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tn8LAW8jjOoi%2Bpj%2BDHpnWX8vNf8nVsHs03dYombi8ytVRcU2RrMCcdtZs25RBKVgGaA%2BoCjqKZ23uEET%2F%2FFXZVHV3FnbF3llOIsZUMR6yGhvMwjpAkJgRaK7nvH9027I0yWcmOY45J4v8w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 771a7ec17fb89090-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGjVNouTngN0GQ4t18pTGBE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame AC0D
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&dcc=t

43 B
855 B

124ms
123ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&dcc=t

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QAWJAAFK1B4KYY7CZCKK
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: E1R5HN2KYAKBM7KCGZAQ
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame AC0D 70 B
264 B 33ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame AC0D 43 B
601 B 35ms
33ms Image
image/gif 2a05:d018:d29:3601:6e4b:8d25:66f8:d8e3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:6e4b:8d25:66f8:d8e3 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame AC0D
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7999702989176737213

43 B
766 B

22ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7999702989176737213
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
AN-X-Request-Uuid: 8ee4dfd9-d39b-4390-91c8-51c5091b1b64
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=7999702989176737213
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ix
ad4m.at/ad/sim/ Frame AC0D 0
0 79ms
31ms Image
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad4m.at/ad/sim/ix
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2

200

rum
dsum.casalemedia.com/ Frame AC0D
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1669802414

43 B
410 B

308ms
111ms

Image
image/gif

172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1669802414
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: H2
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uLpKIbGhG4YB8tkdbLNB96p32rEv7qaWM%2FJg5qqnOLhwUspsrzWot5M4zQXjOCoT%2FbWjV4%2BiPRjm5Pf2v2cMnII%2BAiyrJNQffrX6PvYr1EZpuN%2FIQHeoWYWucErIBMDz3wE2QVD1"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 771a7ec38dfcbb62-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1669802414
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
content-length: 0
expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame AC0D
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=4e7ed0a4-1d90-6a08-34110529

43 B
766 B

10ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=4e7ed0a4-1d90-6a08-34110529
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
server: nginx/1.22.1
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=4e7ed0a4-1d90-6a08-34110529
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146

GET
H2 200 um
u-ams03.e-planning.net/ Frame AC0D 42 B
103 B 17ms
16ms Image
image/gif 185.172.90.252
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-ams03.e-planning.net/um?dc=99e41df815fd80b4&fi=fcb616ccaf9c767b&uid=Y4XYKpVfU9au-VZsFZ28PwAA%265136
Requested by: Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190243&cb=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D99e41df815fd80b4%26fi%3Dfcb616ccaf9c767b%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.90.252 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: ads.us.e-planning.net
Software: openresty /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

server: openresty
date: Tue, 29 Nov 2022 10:00:14 GMT
content-type: image/gif

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 6E77 0
239 B 72ms
9ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=eplanning_eu&khaos=LB21SX9B-T-CTIZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 204
No Content sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 1714 0
239 B 593ms
99ms Image
image/gif 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=pbs-valueimpression&khaos=LB21SX9B-T-CTIZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-valueimpression&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

cm-notify Show response
creativecdn.com/ Frame 9751
Redirect Chain

https://creativecdn.com/cm-notify?pi=admatic
https://creativecdn.com/cm-notify?pi=admatic&tc=1

42 B
243 B

22ms
13ms

Document
image/gif

185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://creativecdn.com/cm-notify?pi=admatic&tc=1
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 42
content-type: image/gif
date: Tue, 29 Nov 2022 10:00:14 GMT Tue, 29 Nov 2022 10:00:14 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache

Redirect headers

content-length: 0
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://creativecdn.com/cm-notify?pi=admatic&tc=1
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame F34B 0
390 B 305ms
144ms Document
text/plain 62.149.1.122
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=738101&extuid=${UID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.1.122 Vyshhorod, Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software: Adtelligent /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Tue, 29 Nov 2022 10:00:14 GMT
Etag: 95ad902d4f7993ec
Server: Adtelligent

GET
H/1.1 200
OK csync Show response
sync.console.adtarget.com.tr/ Frame 6490 0
390 B 305ms
144ms Document
text/plain 62.149.1.122
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.console.adtarget.com.tr/csync?t=a&ep=307565&extuid=${UID}
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.1.122 Vyshhorod, Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software: Adtelligent /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Tue, 29 Nov 2022 10:00:14 GMT
Etag: 95ad902d4f7993ec
Server: Adtelligent

GET
H2 200 cookie Show response
cm.adform.net/ Frame 5598 43 B
105 B 23ms
21ms Document
image/gif 37.157.4.25
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.console.adtarget.com.tr%2Fcsync%3Ft%3Da%26ep%3D307457%26extuid%3D%24UID
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.4.25 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://s.console.adtarget.com.tr/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 43
content-type: image/gif
date: Tue, 29 Nov 2022 10:00:14 GMT
server: nginx

GET
H/1.1

200
OK

csync
sync.adtelligent.com/ Frame 6D9D
Redirect Chain

https://sync.console.adtarget.com.tr/csync?redir=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D318342%26extuid%3D%7Buid%7D
https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=95ad902d4f7993ec

0
384 B

35ms
34ms

Image
text/plain

62.149.1.122
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=95ad902d4f7993ec
Requested by: Host: s.console.adtarget.com.tr
URL: https://s.console.adtarget.com.tr/sync.html?aid=755289
Protocol: HTTP/1.1
Server: 62.149.1.122 Vyshhorod, Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software: Adtelligent /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.console.adtarget.com.tr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Adtelligent
Etag: 04172fc93c99c15c
Content-Length: 0

Redirect headers

Location: https://sync.adtelligent.com/csync?t=a&ep=318342&extuid=95ad902d4f7993ec
Date: Tue, 29 Nov 2022 10:00:13 GMT
Server: Adtelligent
Etag: 95ad902d4f7993ec
Content-Length: 0

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 58F9
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent=

35 B
476 B

20ms
20ms

Document
image/gif

37.157.4.28
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.28 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame BA27
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0c26385-d82c-4500-b987-c9e88ac67507&gdpr=0&gdpr_consent=

42 B
325 B

33ms
30ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0c26385-d82c-4500-b987-c9e88ac67507&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 29 Nov 2022 10:00:14 GMT
Expires: Tue, 29 Nov 2022 10:00:13 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 169 32252b7 master nrt-pixel-x24 config:1.0.0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a0c26385-d82c-4500-b987-c9e88ac67507&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame E2FA
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7481387539608134079

42 B
424 B

24ms
17ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7481387539608134079
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=7481387539608134079
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 600F
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
95 B

14ms
14ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: Tue, 29 Nov 2022 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 983326
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H/1.1

200
OK

dcm Show response
aax-eu.amazon-adsystem.com/s/ Frame 34E4
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=AD20356F-25D4-4171-8E2E-4321613BD39D&redir=true&gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=AD20356F-25D4-4171-8E2E-4321613BD39D&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

241ms
193ms

Document
image/gif

52.94.223.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=AD20356F-25D4-4171-8E2E-4321613BD39D&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Tue, 29 Nov 2022 10:00:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: DB8JZ1C1FTB69GZTYE3F

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Tue, 29 Nov 2022 10:00:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=AD20356F-25D4-4171-8E2E-4321613BD39D&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: BKMZWKEMD43FE650ECKC

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D8E6
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7999702989176737213&gdpr=0&gdpr_consent=

42 B
447 B

57ms
14ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7999702989176737213&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

AN-X-Request-Uuid: a57b3ff9-b17a-46d4-8071-87f8452d7b79
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Tue, 29 Nov 2022 10:00:14 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7999702989176737213&gdpr=0&gdpr_consent=
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2 200 setuid Show response
sync.quantumdex.io/ Frame BDED 43 B
94 B 112ms
109ms Document
image/gif 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/setuid?bidder=pubmatic&uid=AD20356F-25D4-4171-8E2E-4321613BD39D
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 771a7ec139b99158-FRA
content-length: 43
content-type: image/gif
date: Tue, 29 Nov 2022 10:00:14 GMT
server: cloudflare

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 0586
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=rSA1byXUQXGOLkMhYTvTnQ%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

7ms
7ms

Image
text/html

88.221.168.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Server: 88.221.168.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=104882
accept-ranges: bytes
content-length: 5549
expires: Wed, 30 Nov 2022 15:08:16 GMT

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 0586
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a0c26385-d82c-4500-b987-c9e88ac67507

0
260 B

190ms
15ms

Image
text/plain

198.47.127.20
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a0c26385-d82c-4500-b987-c9e88ac67507
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Server: 198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: MT3 169 32252b7 master nrt-pixel-x22 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=a0c26385-d82c-4500-b987-c9e88ac67507
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 29 Nov 2022 10:00:13 GMT

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 0586
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=AD20356F-25D4-4171-8E2E-4321613BD39D&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0

70 B
264 B

35ms
35ms

Image
image/gif

35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
content-length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 0586
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QUQyMDM1NkYtMjVENC00MTcxLThFMkUtNDMyMTYxM0JEMzlE&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

69ms
18ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 0586
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIaZfK6zhE10pK2AR9ssIGE&google_cver=1

42 B
297 B

71ms
19ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIaZfK6zhE10pK2AR9ssIGE&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIaZfK6zhE10pK2AR9ssIGE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 0586 43 B
611 B 63ms
15ms Image
image/gif 35.204.74.118
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.74.118 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

118.74.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Mon, 28 Nov 2022 10:00:14 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 0586
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5215114327849427938

42 B
297 B

16ms
16ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5215114327849427938
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5215114327849427938
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 0586 70 B
264 B 35ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame 8835 0
0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 8835
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=a0c26385-d82c-4500-b987-c9e88ac67507

43 B
766 B

13ms
12ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=a0c26385-d82c-4500-b987-c9e88ac67507
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: MT3 169 32252b7 master nrt-pixel-x19 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=a0c26385-d82c-4500-b987-c9e88ac67507
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 29 Nov 2022 10:00:13 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 8835
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABBQE7HC7AAACB8T97bhA&expiration=1670925614

43 B
766 B

9ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABBQE7HC7AAACB8T97bhA&expiration=1670925614
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABBQE7HC7AAACB8T97bhA&expiration=1670925614
Date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

200

Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 8835
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB

43 B
601 B

34ms
32ms

Image
image/gif

2a05:d018:d29:3601:6e4b:8d25:66f8:d8e3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

Server

2a05:d018:d29:3601:6e4b:8d25:66f8:d8e3 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8835
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ef3ad599-7afb-456a-acd1-dd01053ed131&us_privacy=null&gdpr_consent=null&gdpr=null

43 B
766 B

22ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ef3ad599-7afb-456a-acd1-dd01053ed131&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ef3ad599-7afb-456a-acd1-dd01053ed131&us_privacy=null&gdpr_consent=null&gdpr=null
date: Tue, 29 Nov 2022 10:00:14 GMT
server: _
content-length: 0

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 8835
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=Y4XYKpVfU9au-VZsFZ28PwAA%265136?gdpr_consent=&us_privacy=&gdpr=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y4XYKpVfU9au-VZsFZ28PwAA%265136

42 B
942 B

31ms
30ms

Image
image/gif

3.248.125.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y4XYKpVfU9au-VZsFZ28PwAA%265136

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

HTTP/1.1

Server

3.248.125.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-125-109.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v045-037643fd0.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: e5lkELx9TqI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v045-0305a06ee.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: TRdOMJusTsA=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=Y4XYKpVfU9au-VZsFZ28PwAA%265136
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8835
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=Qu20XxDmvg9Z5-gLEeqhUxG67ghZvbtSFe4ZXcQL

43 B
766 B

10ms
10ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=Qu20XxDmvg9Z5-gLEeqhUxG67ghZvbtSFe4ZXcQL
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=Qu20XxDmvg9Z5-gLEeqhUxG67ghZvbtSFe4ZXcQL
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

crum
dsum.casalemedia.com/ Frame 8835
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd9302ba-e1e0-33b3-365d89b6

43 B
874 B

148ms
67ms

Image
image/gif

172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd9302ba-e1e0-33b3-365d89b6
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QyeAnOlvyoTBE%2FWuWd93TYQ39l1G7MgnTsjZAKoPlpjgMtOtdMQ6na%2BayMFG%2Fji4JshpAYMaIY5jMK27WwDFRCFBqZyqW%2BHaZb1UFzpa9pbKo25em%2FpSBmxvoQwnY7xwcf3xFIRX"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 771a7ec38e00bb62-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
server: nginx/1.22.1
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=dd9302ba-e1e0-33b3-365d89b6
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119

GET
H2 200 setuid
sync.quantumdex.io/ Frame 8835 43 B
94 B 115ms
114ms Image
image/gif 2606:4700:10::ac43:2ac9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=ix&uid=Y4XYKpVfU9au_VZsFZ28PwAAFBAAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:2ac9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 771a7ec16a0e9158-FRA
content-length: 43
content-type: image/gif

GET
H3 200 /
googleads.g.doubleclick.net/pagead/live/interaction/ Frame A3E3 42 B
65 B 82ms
81ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: ltt
x-frame-options: SAMEORIGIN
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1289 6 KB
3 KB 39ms
38ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: Wed, 29 Nov 2023 10:00:14 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Oy6hyfNY.js Show response
tpc.googlesyndication.com/sodar/ Frame A3E3 41 KB
15 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.546.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b2ea1c9f3587781b58285cf64279e67f6329a3924fb93f81529f1826e2f4d16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 19:01:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 572351
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15406
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Nov 2023 19:01:03 GMT

GET
H2 200 magic.png
bgstats.mox.tv/ Frame A3E3 0
66 B 90ms
21ms Image
image/png 167.71.9.19
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bgstats.mox.tv/magic.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.71.9.19 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
server: nginx/1.14.0 (Ubuntu)
content-length: 0
content-type: image/png

GET
H2 200 tracking
ad.vidverto.io/delivery/video/ Frame A3E3 51 B
51 B 31ms
22ms Image
text/html 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.vidverto.io/delivery/video/tracking?vast=tracker&vsp=aWl2bVdTUG1OVUJ1UXN2VWFScVJBL3hjbzFqeWtWQVdQa1JGVGNNd0FLRG5XSGRZd3Bac2tJQ1FGRVhuaW5lbXIrL1ZjbjdEQzlYb1h1UUFleVBEY01IZEM5UzRZYjM3eFU0dFI5QkNTVUNCUGk0WFpCMDdZZVBLM3lwczlFaXM2aXFwd2ppLy9jczFSS01qVDUyeEFkQlRlUVdsL3d5T0F3K3ZNRjA5TWpycGE4S3FsejBWSmhWUVJEait3V1VMY2FYckpyZWRtb0QrWllENm0wenNSYVFFNFdlNTZNOS9oWmdPamgwc3VYZGVMYlBWd1B1S2hqeVQrbFd3MFIxdg%3D%3D&cb=1669716012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H3 200 adview
pubads.g.doubleclick.net/gampad/live/ Frame A3E3 0
0 90ms
86ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/gampad/live/adview?ai=CHGMALdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBLIET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pufc6KxQbt2SZNas8TgF4KULNJzpp_3HilQ1Qbs9RcCbSqsixxSttW5aVpIDF1jq8Qy464wjgKLniyFFlO-vJfjCPNJMDOgl31pxyymIaPDVX6Dz1j01ukYzgfpHuqTsoCMY9o_HjX6sJD2udyFBu_5xMPSacNrp3jRDZpw-4malhfOK58W4asQTz4wI5WpBNPKpKpGjPiVmIQmCIgEsRNMYUGNEyKwcr0I7OWwRbka5lslAgoSnONiqAPkoLzEYRRZN91Z0CzYef_IlNFX2bGbo-YSX_yf1ujJ4gK-R8axlr5xahKzxnw4OpAEyemyE7Iky96SbzGMAEkv_2hpUE4AQBkgUNCCIQAxgBSPuy2gFQAaAGVIAHqvjOlQGoB47OG6gHk9gbqAec3BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEENPTU6gIAdIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsBsBPwr5kRwhMGGL6HseoC2BMC2BQB0BUBqBYBgBcBshceChwIABIUcHViLTMxOTEyODk4ODIwNDUxNTUYzZ5r&sigh=A0OFKcpMVco&cmd=Ch1jYS12aWRlby1wdWItMzE5MTI4OTg4MjA0NTE1NRAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&cid=CAQSPADq26N9-41vcDaIs6sCU-d8qgU5arTJ9DLssnwORhaAA5uUtMrvY9lEwQY2i9LxjElXB1GSG9b-4H9xkhgBIBM
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 200 B28818304.351154414;dc_trk_aid=542927304;dc_trk_cid=181567261;dc_dbm_token=AD1EzRQAAAA5CjMKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMIhPL2wUaoAt_j9gGwApvrteEDQDsQj8cV14BlVt5QhkM-drR-TBErgA==;ord=27802...
ad.doubleclick.net/ddm/trackimp/N3503.4310581MATTERKIND_DE_IPG/ Frame A3E3 42 B
533 B 144ms
58ms Image
image/gif 142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N3503.4310581MATTERKIND_DE_IPG/B28818304.351154414;dc_trk_aid=542927304;dc_trk_cid=181567261;dc_dbm_token=AD1EzRQAAAA5CjMKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMIhPL2wUaoAt_j9gGwApvrteEDQDsQj8cV14BlVt5QhkM-drR-TBErgA==;ord=2780244189;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;ltd=;dc_exteid=6788877285375218950;dc_av=520;dc_sk=1;dc_ctype=84;dc_ref=;dc_pubid=3;dc_btype=23?gclid=EAIaIQobChMIkqbh7pDT-wIV44L9Bx29Dg5GEAEYASAAEgISSfD_BwE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/live/interaction/ Frame A3E3 42 B
65 B 87ms
81ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/live/interaction/?ai=CAkSJLdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBK4ET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pmfek5a4fc6Zq7YfKvjWe13YREwhk_3Hvnwj2WHFkeCb6r-Cxgqkt0nT8V47s1jrJbS46ng3gKCUJI-t8Jutwd8fMwZAZuPl2O113yO6fyTa44c737ME5mHnj25ruqc4q_cU9oATiqqoJDZ6ePVNq_2lPzCWcNk90eBPZp_q7bKphfBe6BG0asfHwFgE5WmVOyalKxJ3MQT2JkK2OkZnmM91W49w5eQ0LUIeNcmREV2RoIdcmRLzPOx0ANxJB1kW6OKDSdmO6YN2sZA-m2GOCqyuI1jpnwtXqjqTi5m7igPbqYTObtKPwSjUUm925oYCWtKoFwASS__aGlQTgBAGgBlSAB6r4zpUBqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwGwE_CvmRHYEwLYFAHQFQGoFgH4FgGAFwE&sigh=u7KHNrFiLvI&cmd=Ch1jYS12aWRlby1wdWItMzE5MTI4OTg4MjA0NTE1NRAAGAI&label=vast_creativeview&ad_mt=0&acvw=sv%3D941%26cb%3Dima%26e%3D19%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26is%3D0%26cs%3D0%26c%3D0%26mc%3D-1%26nc%3D-1%26mv%3D-1%26nv%3D-1%26lte%3D-2%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D0%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014330%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1669716013836

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: ltt
x-frame-options: SAMEORIGIN
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tracking
ad.vidverto.io/delivery/video/ Frame A3E3 51 B
51 B 31ms
23ms Image
text/html 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.vidverto.io/delivery/video/tracking?vast=events&token=SGYrYjhETHlyR0I0djhIbTlZZjZBemkvbENqbW4zRDhCU3c4bzIyaXNFTm1Ca2RUVUQzMXNIU1duMXBJbkI0U1htNTNSTVlMbEhLWktXeVNNSFFKTXFQSHhqbnRDamlkdW1yVmUrTlAyVlZJbnNzZlY4QnF5QU9UL0RKSjdHaWJHMTBiM2hLRzFJTm0zSUgrT2RIM1dWaUJlRGkxcDdMUlQ4Q2ovK3Z6QnZzRk9NUXhDSVVvNFo5UWNRTyszUGdSMUdWRjFJS0JVRnNxUUNpcGFsQzhqUT09&cb=1669716012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame A3E3 42 B
64 B 84ms
79ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsviUbu12JI5wAxnk7qO8se8QepX0Ss014liCD677nAfGKbttAb-AKHiKIlYUgzQy1XYmhwjvZSw5TCLcl9LTJY2FUTTBUEL23xFp3DapBNy6ML9WhaoDXzwL4VXs0SjG_NDaRTG5g&sai=AMfl-YR2LlKW2IPTQ8EY__-DQeeDWRShVOsPg6mAEnmmy8sN5Xf-BxPbbi209XzTqC3xrmf46umk8Du9tObF3M8TvMg3kkcmx8x742sNjgY7ZNgyvuptC6zQeTFHsy31RLU&sig=Cg0ArKJSzL8xw6EW1XeWEAE&cid=CAQSPADq26N9-41vcDaIs6sCU-d8qgU5arTJ9DLssnwORhaAA5uUtMrvY9lEwQY2i9LxjElXB1GSG9b-4H9xkhgBIBM&id=lidarv&acvw=sv%3D941%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014333%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836&avm=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview_ext
pagead2.googlesyndication.com/ Frame A3E3 42 B
64 B 55ms
51ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/activeview_ext?id=lidarv&avm=1&dc_pubid=3&dc_exteid=6788877285375218950&acvw=sv%3D941%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014333%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=200101;acvw=sv%3D941%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%...
ade.googlesyndication.com/ddm/activity_ext/ Frame A3E3 42 B
494 B 367ms
73ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=200101;acvw=sv%3D941%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014333%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/live/interaction/ Frame A3E3 42 B
65 B 119ms
114ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/live/interaction/?ai=CAkSJLdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBK4ET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pmfek5a4fc6Zq7YfKvjWe13YREwhk_3Hvnwj2WHFkeCb6r-Cxgqkt0nT8V47s1jrJbS46ng3gKCUJI-t8Jutwd8fMwZAZuPl2O113yO6fyTa44c737ME5mHnj25ruqc4q_cU9oATiqqoJDZ6ePVNq_2lPzCWcNk90eBPZp_q7bKphfBe6BG0asfHwFgE5WmVOyalKxJ3MQT2JkK2OkZnmM91W49w5eQ0LUIeNcmREV2RoIdcmRLzPOx0ANxJB1kW6OKDSdmO6YN2sZA-m2GOCqyuI1jpnwtXqjqTi5m7igPbqYTObtKPwSjUUm925oYCWtKoFwASS__aGlQTgBAGgBlSAB6r4zpUBqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwGwE_CvmRHYEwLYFAHQFQGoFgH4FgGAFwE&sigh=u7KHNrFiLvI&cmd=Ch1jYS12aWRlby1wdWItMzE5MTI4OTg4MjA0NTE1NRAAGAI&label=part2viewed&ad_mt=0&acvw=sv%3D941%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014334%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: ltt
x-frame-options: SAMEORIGIN
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=11;acvw=sv%3D941%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0...
ade.googlesyndication.com/ddm/activity_ext/ Frame A3E3 42 B
107 B 368ms
75ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=11;acvw=sv%3D941%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014334%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tracking
ad.vidverto.io/delivery/video/ Frame A3E3 51 B
51 B 30ms
24ms Image
text/html 212.8.250.228
WORLDSTREAM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.vidverto.io/delivery/video/tracking?vast=events&token=YVVUMG9sUDNva0E1YVV2K2sxK2hZZmw1STlMcTRHNnpldlJSc0pyaVpRbFlrYzJzYWNCVklLK2pxNDluWW04aWsyMkxseUx2UHdia0dCbElKUlh3VjFBODkzSzhqTHZWbElxalN2QnNHQWRJR1JwQjNQNFN2Zzk5OUVmOUJ5c2RNS3VQZjk5ckdtSFc0N3V2WCs5cXo3MzVEM2U1Z2lGaDRacDAyVlIrWFFGSmc2NmJhM1FEcjF1emR1TVRJV3ROZWlEZHYzVW5XK0xrTDdXWFNmL0RqQT09&cb=1669716012
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.228 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: 212-8-250-228.hosted-by-worldstream.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
server: nginx/1.14.0 (Ubuntu)
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H3 200 /
googleads.g.doubleclick.net/pagead/live/interaction/ Frame A3E3 42 B
65 B 121ms
117ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/live/interaction/?ai=CAkSJLdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBK4ET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pmfek5a4fc6Zq7YfKvjWe13YREwhk_3Hvnwj2WHFkeCb6r-Cxgqkt0nT8V47s1jrJbS46ng3gKCUJI-t8Jutwd8fMwZAZuPl2O113yO6fyTa44c737ME5mHnj25ruqc4q_cU9oATiqqoJDZ6ePVNq_2lPzCWcNk90eBPZp_q7bKphfBe6BG0asfHwFgE5WmVOyalKxJ3MQT2JkK2OkZnmM91W49w5eQ0LUIeNcmREV2RoIdcmRLzPOx0ANxJB1kW6OKDSdmO6YN2sZA-m2GOCqyuI1jpnwtXqjqTi5m7igPbqYTObtKPwSjUUm925oYCWtKoFwASS__aGlQTgBAGgBlSAB6r4zpUBqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwGwE_CvmRHYEwLYFAHQFQGoFgH4FgGAFwE&sigh=u7KHNrFiLvI&cmd=Ch1jYS12aWRlby1wdWItMzE5MTI4OTg4MjA0NTE1NRAAGAI&label=admute&ad_mt=0&acvw=sv%3D941%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D8%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D8%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D8%26is%3D18%26i0%3D18%26ic%3D4096%26cs%3D4114%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014339%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: ltt
x-frame-options: SAMEORIGIN
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=16;acvw=sv%3D941%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,...
ade.googlesyndication.com/ddm/activity_ext/ Frame A3E3 42 B
107 B 367ms
74ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=16;acvw=sv%3D941%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D1632,460,2014,1140%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D8%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D8%26pst%3D-1%26dur%3D15000%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D8%26is%3D18%26i0%3D18%26ic%3D4096%26cs%3D4114%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D0,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483648%26psv%3D0%26psfv%3D0%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716014339%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669716013836?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8E9E 13 KB
5 KB 48ms
46ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1369
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 09:37:25 GMT
expires: Wed, 29 Nov 2023 09:37:25 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 04AA 783 B
535 B 53ms
51ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

dd50f0682aab5ac6fae86bf32513d751b0cd31d78a2411bc652e8f74cf2c2140

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uhGR5MyFePtmyxSN2Wa14w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.lebanonfiles.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-uhGR5MyFePtmyxSN2Wa14w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: Tue, 29 Nov 2022 10:00:14 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 204 cmp
spl.zeotap.com/ Frame 223E 0
0 90ms
88ms Document
text/plain 2606:4700:10::6816:1857
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/cmp?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361&cmp=0
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/cmp.min.js?env=mWeb&eventType=map&gdpr=1&gdpr_consent=&id_mid_4=000cce0c-25f4-479f-6dd5-4755453376aa&reqId=835b1cc0-6534-4074-4d30-afd2a5feee4b&zdid=1361
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1857 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://spl.zeotap.com/?zdid=1361&env=mWeb&gdpr=1&gdpr_consent=&eventType=map
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://spl.zeotap.com
cf-cache-status: DYNAMIC
cf-ray: 771a7ec1bae56961-FRA
date: Tue, 29 Nov 2022 10:00:14 GMT
server: cloudflare
vary: Origin
via: 1.1 google

GET
DATA 200
OK truncated
/ 427 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b7d818c698d26d9d34c00c94853c93b34abb2fd53e97c415fafb9e84df993f31

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 415 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9c51b3bb0c5188de2571ed94d9432b85693241de3e05e5e82247dd8a45d4d03f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 414 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d5d4d2769bdb28802f4309747ef6a358007eeb37daadc66a78ba0ca81cd4bce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8498a175d0101f4a0d9d5ac8956bfe56c9b3c78d417e786bef66301a5a5483cd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 6E77
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=XPkKkSz1QzuJSDFcB6279Q&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XPkKkSz1QzuJSDFcB6279Q

43 B
479 B

115ms
115ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XPkKkSz1QzuJSDFcB6279Q

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:15 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: GFAKEC1AX8A5BMW5NYWQ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XPkKkSz1QzuJSDFcB6279Q
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E77
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIyMVNYOUItVC1DVEla

170 B
188 B

50ms
48ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIyMVNYOUItVC1DVEla

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIyMVNYOUItVC1DVEla
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 6E77 70 B
264 B 50ms
30ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 6E77
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEClEyr1kc1Y-FrGoyXwdMo0&google_cver=1

0
239 B

10ms
9ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEClEyr1kc1Y-FrGoyXwdMo0&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEClEyr1kc1Y-FrGoyXwdMo0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E77
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTZlOGEzMjEwNjNkOTQyZDY1MWRjYzVkZjRmMDljMzJlOGVlY2NmOA

170 B
188 B

50ms
48ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTZlOGEzMjEwNjNkOTQyZDY1MWRjYzVkZjRmMDljMzJlOGVlY2NmOA

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-11-196-201.eu-west-2.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTZlOGEzMjEwNjNkOTQyZDY1MWRjYzVkZjRmMDljMzJlOGVlY2NmOA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 611afce88997db6fdd35eb213e662871
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 6E77
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=M0kyiTDjRNugg2d4y7lLgA&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=M0kyiTDjRNugg2d4y7lLgA

43 B
479 B

37ms
33ms

Image
image/gif

52.94.223.167
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=M0kyiTDjRNugg2d4y7lLgA

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu

Protocol

HTTP/1.1

Server

52.94.223.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: KSCA9172T10WTDH6BSG4
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=M0kyiTDjRNugg2d4y7lLgA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 6E77
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LB21SX9B-T-CTIZ

0
921 B

316ms
199ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LB21SX9B-T-CTIZ
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 281BB896AC2F4FFE92254633DE6BFCE9 Ref B: FRAEDGE1815 Ref C: 2022-11-29T10:00:14Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXumQ3vABTaMeNlSyzkZA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LB21SX9B-T-CTIZ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 6E77
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/v4KRMZ3QFb_mwa3bqZGH7Q?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8071136893386460582

0
239 B

11ms
9ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8071136893386460582
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&p=eplanning_eu&endpoint=eu
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=8071136893386460582
content-length: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 47D9 0
0 108ms
108ms Fetch
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CqSJ9LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSjAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtciGUq3fN2YxfCpb1ZQcspytsFwbNL0BurLmnlEkC4XjJF2v8FQcyOAEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshccChoSFHB1Yi04NzQ1NTkzOTQ1NjA4MjAyGIT_dA&sigh=PIiUIXs6iXk&uach_m=[UACH]&cid=CAQSPADq26N9Yk8Q-fZOmYrefQSvuHX6IhcNYxv9f44LTgHAxmnqbi3MIjNpTJYVal_ajVbzG5B6YKutGRq3WRgBIBM
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame 47D9 0
0 154ms
48ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1jqgacyrvbbjjkqx12na5p7a9h5bdk4t3bsa3kjrtmb21jq4j398d21cwdmzywyhfsxkb55tppdq8cpvwg495rd58j11wk51ta9qtk3j9j5y5p6qcs5h7qskkt4p600933q0yhd5vnfq6dxzhw8m2gnhwfzhdnrb12tc5nxsaq7g7epr33y7y6mh7bf9wnztgqh81dv84fxfwednm9afa0a404jz7z32r65jcynbn32bwa58p4kt5w32b3r7e63a3dya9esc5dv84hz3kj2ravjtxfrvptng3g2ws224sexvqttf243zj334mrx1h75pam99agbseppcf32wh2z29a3b58g91sndz90mq7wez8kq1xc2ge6r0t5mk0t2f29wskttskrepm&b=Y4XYLgABmkUK01ABAAVuHo5WwJNaIHys1lD-Pw
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: image/gif

GET
H2 200 dr Show response
as.ad4m.at/ad/ Frame D8EE 2 KB
2 KB 80ms
52ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/dr?ed=1krrngwd82zq4bmkthxeas7d99beq94sbm232t340p00b73wxyvf4e71cx5ph8xmgx605pq4bsrcs4ygzs2y4h81p6d39k0fmrchzqpk4391snax2wqxm8vehg30kwjrxq47hay13p2zf8zrhshxzw0sbwhknw3mskn58f5m3vdgdcsmfncn77kt6rxvq0vbka3vt11g6f90d3qz1ssqq8tv0eza7xnhkb632wpnwz7x1sbcmevh43bzdcd221qmmrpve50020mcc1y9dz1jgbhtd1bd5fswnrk8spa2b5mpbatgdjq6h2k18m1nqd6d866k8ked9vc66p0xk0bt5kznsrh22e56rrk8b7nwk7zaqkz6p5z1xr3vz7h2fdcx8sdhcw93df29xvc6013dkajwvnwvx4w8fs2jm4zjw0aq4wwk4d1wa&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%26client%3Dca-pub-8745593945608202%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18253287097454df036bd4593a6d81eacec07edce2133bfb85d5a6adfb4274ca

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 771a7ec38a689a09-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:14 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 47D9 3 KB
1 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 09:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2388
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Dec 2022 09:20:26 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F135 1 KB
643 B 69ms
46ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 83768
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 28 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Tue, 29 Nov 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 47D9 18 KB
7 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77881
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 12 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 47D9 0
0 49ms
47ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTCENJCeCZHpEsFVxY90-3CDYD40dftPj2k9B2aNYKwa16XzVsW84FNaXPLuL9HnM_NrfkjW-GeXn_vv2avTq8JduNsWQ
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 47D9 24 KB
6 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 20:58:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46898
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 28 Nov 2023 20:58:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 47D9 154 KB
47 KB 60ms
58ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 10:00:14 GMT

GET
H3 200 hhrtBw21.html Show response
tpc.googlesyndication.com/sodar/ Frame 6535 23 KB
9 KB 64ms
44ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

861aed070db50ce0da9928455deff784c115b44540b09450f225ff7cff0c7429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 498224
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Nov 2022 15:36:30 GMT
expires: Thu, 23 Nov 2023 15:36:30 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 206
Partial Content 480_650.mp4
cdn.mox.tv/data/X1XrxbFfg33fxBZ/1399/video/1921/ 368 KB
0 18ms
17ms Media
video/mp4 212.8.250.43
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mox.tv/data/X1XrxbFfg33fxBZ/1399/video/1921/480_650.mp4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 212.8.250.43 Rotterdam, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: customer.worldstream.nl
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash

Request headers

Referer: https://www.lebanonfiles.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Range: bytes=32768-

Response headers

Date: Tue, 29 Nov 2022 10:00:14 GMT
Last-Modified: Thu, 02 Sep 2021 16:36:15 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6130fd7f-24e1341"
Content-Type: video/mp4
Access-Control-Allow-Origin: *
Content-Range: bytes 32768-38671168/38671169
Connection: keep-alive
Content-Length: 38638401

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 04AA 0
0 74ms
73ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022111501&jk=560991975837033&rc=
Requested by: Host: www.lebanonfiles.com
URL: https://www.lebanonfiles.com/articles/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1-%D8%A7%D9%84%D8%B3%D8%A7%D8%B9%D8%A9/%D9%86%D9%88%D9%81%D9%88%D8%B3%D8%AA%D9%8A-%D9%82%D8%B5%D9%81-%D8%A3%D9%88%D9%83%D8%B1%D8%A7%D9%86%D9%8A-%D8%A8%D8%B5%D9%88%D8%A7%D8%B1%D9%8A%D8%AE-%D9%83%D8%A7%D9%84%D9%8A%D8%A8%D8%B1-%D8%B9%D9%84/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H2 204 playback
www.youtube.com/api/stats/ Frame A3E3 0
0 139ms
49ms Image
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/api/stats/playback?ns=yt&fexp=44731965%2C44748969%2C44750822%2C44765701&el=adunit&cpn=OWHxr0SurlpKtJh9&docid=NDOTfEQZvwI&visitordata=CgtFZGtJMm1YbEVqbw%253D%253D&ver=2&cmt=0.280&fmt=18&rt=0.000&adformat=2_2_1&euri=https%3A%2F%2Fwww.lebanonfiles.com%2F&len=15.000&vtype=gvp&c=web_gvp_ads&cver=h.0.0.0&cbr=Chrome&cbrver=107.0.5304.121&cos=Win32&cosver=537.36&cplatform=desktop&mos=1&volume=0&delay=13&rtn=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 8E9E 36 KB
16 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 056F 16 B
232 B 77ms
77ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 246ms
18ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://9e1c575cf28a35e06071cf3b2c8c2fc9.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 29 Nov 2022 10:00:14 GMT
server: nginx

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.25/one-ad/ Frame D8EE 89 KB
12 KB 70ms
45ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.25/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1krrngwd82zq4bmkthxeas7d99beq94sbm232t340p00b73wxyvf4e71cx5ph8xmgx605pq4bsrcs4ygzs2y4h81p6d39k0fmrchzqpk4391snax2wqxm8vehg30kwjrxq47hay13p2zf8zrhshxzw0sbwhknw3mskn58f5m3vdgdcsmfncn77kt6rxvq0vbka3vt11g6f90d3qz1ssqq8tv0eza7xnhkb632wpnwz7x1sbcmevh43bzdcd221qmmrpve50020mcc1y9dz1jgbhtd1bd5fswnrk8spa2b5mpbatgdjq6h2k18m1nqd6d866k8ked9vc66p0xk0bt5kznsrh22e56rrk8b7nwk7zaqkz6p5z1xr3vz7h2fdcx8sdhcw93df29xvc6013dkajwvnwvx4w8fs2jm4zjw0aq4wwk4d1wa&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%26client%3Dca-pub-8745593945608202%26adurl%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ab995345cf38f3951bc840ab2c0d043269e700e59f1c6d6cb7fb8946268b358

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/dr?ed=1krrngwd82zq4bmkthxeas7d99beq94sbm232t340p00b73wxyvf4e71cx5ph8xmgx605pq4bsrcs4ygzs2y4h81p6d39k0fmrchzqpk4391snax2wqxm8vehg30kwjrxq47hay13p2zf8zrhshxzw0sbwhknw3mskn58f5m3vdgdcsmfncn77kt6rxvq0vbka3vt11g6f90d3qz1ssqq8tv0eza7xnhkb632wpnwz7x1sbcmevh43bzdcd221qmmrpve50020mcc1y9dz1jgbhtd1bd5fswnrk8spa2b5mpbatgdjq6h2k18m1nqd6d866k8ked9vc66p0xk0bt5kznsrh22e56rrk8b7nwk7zaqkz6p5z1xr3vz7h2fdcx8sdhcw93df29xvc6013dkajwvnwvx4w8fs2jm4zjw0aq4wwk4d1wa&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%26client%3Dca-pub-8745593945608202%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1669235721
age: 478915
cf-polished: origSize=91628
x-guploader-uploadid: ADPycdtnqpkBC2eNpIttCC4X9D-yrOoXK0HfmyiASnHmc5dpKNlZrWHuml5v2FihfATK0UIibbwmZ2MH5YrFqJYKDzRy-A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 23 Nov 2022 20:35:56 GMT
server: cloudflare
etag: W/"575def06e70febb0cbd25403e37880bf"
vary: Accept-Encoding
x-goog-generation: 1669235756372606
content-type: text/css
x-goog-hash: crc32c=ttlcew==, md5=V13vBucP67DL0lQD43iAvw==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8FUFyTw2m2ILB0Mt5qDKkxYyHRH05BzYh0N1%2BabXQAN5ypAaHBZh1uVFEjif8Ldaa6Asa5EJ97P2Q1G9WEqBBtV1cMOSynjAOrLrLbHCgOCHkaSVqY4ROOw4rGtzdrHplon9xXldWtA%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 91628
cf-ray: 771a7ec47ae39085-FRA
expires: Tue, 29 Nov 2022 11:00:14 GMT

GET
H3 200 r62eglto.js Show response
ad4m.at/ Frame D8EE 35 KB
12 KB 79ms
57ms Script
application/javascript 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1krrngwd82zq4bmkthxeas7d99beq94sbm232t340p00b73wxyvf4e71cx5ph8xmgx605pq4bsrcs4ygzs2y4h81p6d39k0fmrchzqpk4391snax2wqxm8vehg30kwjrxq47hay13p2zf8zrhshxzw0sbwhknw3mskn58f5m3vdgdcsmfncn77kt6rxvq0vbka3vt11g6f90d3qz1ssqq8tv0eza7xnhkb632wpnwz7x1sbcmevh43bzdcd221qmmrpve50020mcc1y9dz1jgbhtd1bd5fswnrk8spa2b5mpbatgdjq6h2k18m1nqd6d866k8ked9vc66p0xk0bt5kznsrh22e56rrk8b7nwk7zaqkz6p5z1xr3vz7h2fdcx8sdhcw93df29xvc6013dkajwvnwvx4w8fs2jm4zjw0aq4wwk4d1wa&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%26client%3Dca-pub-8745593945608202%26adurl%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9624c9f30634be84a224d007e5df178a51107bff3e456e2a90b504cbf350d190

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 22 Nov 2022 06:17:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 13317
etag: W/"49e3b0ffd5e74f27b691e89cf271d672"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jL0l%2Fa8x1f3vOojMv%2BQlOfMoWv2I21%2Fqx6AV8MxfrZ2x61G1W6GFCZf%2BCHwJGx9RREel7ld%2FVuSgP18vGyHLOEcu%2FjGo6VUBas5hERz%2FHZBDC08VY5vRkN%2FgLxyu2bUnme47%2Bqk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
cf-ray: 771a7ec47ae19085-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Tue, 29 Nov 2022 06:18:07 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F135
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEO32l2EatB6ehw_eKQ6pWYA&google_cver=1&google_push=ASkJ3FarktD9zXROS3fhMTURi3QRqTzE-E3Ufljpse5zTS2cJuWLwaruzb...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FarktD9zXROS3fhMTURi3QRqTzE-E3Ufljpse5zTS2cJuWLwaruzbCQ_HWIDFz4NtICZMEY5nEl4lC-PRVLd7E9jpLOzCKciA&google_hm=18NBBXgh-B...

170 B
188 B

48ms
48ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FarktD9zXROS3fhMTURi3QRqTzE-E3Ufljpse5zTS2cJuWLwaruzbCQ_HWIDFz4NtICZMEY5nEl4lC-PRVLd7E9jpLOzCKciA&google_hm=18NBBXgh-BlKR2QnOtRDvA

Requested by

Host: b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com
URL: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FarktD9zXROS3fhMTURi3QRqTzE-E3Ufljpse5zTS2cJuWLwaruzbCQ_HWIDFz4NtICZMEY5nEl4lC-PRVLd7E9jpLOzCKciA&google_hm=18NBBXgh-BlKR2QnOtRDvA
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame F135 43 B
351 B 183ms
40ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEBXkVb7_hcdRPLQWKLRw09A&google_cver=1&google_push=ASkJ3FbGQeCaJIdB9mzKTQfI8_RMTnzMlfFajZUOICRsrC8TVASkCl2fCepNFCjr7nQWhXItrPatqp3G_Ux6IfzSx4RPThiRwNsvnA
Requested by: Host: b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com
URL: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:14 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: r6qkod7doq8rtr6r2gkd597cgarqlphr

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F135 0
12 B 49ms
45ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I5c5g_rDtw3_op4c55BcVsH28g2cGHWMMnwoc

Requested by

Host: b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com
URL: https://b79f592acfb1aa1c127e386110bd912e.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:14 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6535 36 KB
16 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/api979c0EJY6QQNrS8TSWwgKrshdt-vRMqEtOqF-hYY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a98bdefd73410963a41036b4bc4d25b080aaec85db7ebd132a12d3aa17e8586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 21:51:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 21:51:48 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B4F3 0
747 B 18ms
17ms Script
text/html 185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:14 GMT
AN-X-Request-Uuid: 8af494c6-be80-4efa-83b6-0db44b54b555
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.166; 185.213.155.166; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 frame.html Show response
ad4m.at/ Frame 86EA 2 KB
1 KB 39ms
38ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d485f783c7cc440cba21bb750ce67e191bce0783bfc6cff5f98e236e401b7ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 222900
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 771a7ec59cbf9085-FRA
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Tue, 29 Nov 2022 10:00:15 GMT
expires: Wed, 26 Oct 2022 23:22:52 GMT
last-modified: Thu, 25 Aug 2022 14:12:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1YvsLniHypYfJ6otZzFPfgSa8A4RUuYFRYR7H349BV6g4D%2FeaStrk3G2%2B38emU0untHgC2SrYsfrLTKacwvimRKmzBh5JZhtyIUTcyvqFAr7v7GxOSsRBaFzkk16Em7moscZcSY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8E9E 0
12 B 40ms
39ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?aqcAJg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3 200 rs Show response
ad4m.at/ Frame D8EE 2 KB
2 KB 40ms
40ms XHR
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25afcc0c9850e4bc8641eb609de49b3a1e6da673a76ff7473db25507ce357936

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Br2WC8MyWo9Ot7aPv889pMDXzQX0bDTfnLi4ZEhxvM65I0RbHeGlBLm1BbEQxNeGHA744JZvcQPzBKW%2B1ynL2REJgY%2F91iMbbwCApMR%2Brb8pSRNLWND1b22tDJVX95qmFef1dAQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://as.ad4m.at
access-control-allow-credentials: true
cf-ray: 771a7ec6ddb7bbf2-FRA
x-backend-server: aa-reachservice-group-europe-west1-v578
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6535 0
20 B 108ms
107ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=36&t=2&li=v_h.3.546.0&bgai=BXq3HLdiFY9LbDuOF9u8PvZ24sAQAAAAAOAG6BRMImeDe7pDT-wIVBce7CB0TbQ2M&bg=!DA-lD0vNAAbvMpMzzzI7ACkAdvg8WpTok5L-cbfQ_m8pps6JF1SZCTN5DEF0jtn4l4BArLushfm1hgIAAAC1UgAAAANoAQcKABgeyfZ0xcMuIQBUMoxVfaSZGyHb2sUTIXyZAlDMqTXilimrtyopPka_Nq--wyPeQLy0pWPu8y8oDzC4_4FqiEgtItYM4stE6J94wL5uQ-8B3klAFZEX83k_z5qBTsd4ckxbZfmGWFykVKsT0b2LzVWLSKuDBlytV5zXsu3h7beW6WzhRh32IovHnXbUh5XH16y6ur8WI8rHXQS9qJEO_ZhRlwGwobwJPaPzR7o5cIBuz4tKWT3RQbgGOCrktG-M9-SEQnfnI7LGGmxgUoba88g-N2CXfPPhEKfOctMN4jLSlSkyl9OiTEEN9aanXfdDvLCoe7_WpDOGWDw_qF9uvFAOwUlOFxLiFr0VEDj1oKTiziFl1RIk2CN2F9ZOOSVY_W693kKGtKih_b10_OFA6hfc0rrW2oqYyHEv5DW-ruGyWmyZWeX_HzmFqFL9ITxTfbjacMHC0sTAegV54_zQnBerQ3-EAmGZhU9eWBx48uVMixO3gNnk4Y_IVnJGjzzzunwnR2WXujxw0vOHWnvftZdIWgAupsv3Hpr2IxdJz39qURCX0O9ZEv_kNi6dPO2Xl1igRFTVTzM2Y8me8jXSvitJ5aaiRQ_CUdo19qkII8GJqLo9VRsWT9ncDVlNG5ieklUZYR7yAdZkRe2xPbNW9QsRkxj6kuxIV0gnsFJLUy3p8nDMgfbFUm4aatAlkiqyTpJtw4Aw43czKUdV5d9O5eFvoGpoIGXO7bubsu4L-ghuqu28KMjSF6dDstXujBg-lq7JOgQcE10cB6QBurJ_Ko_40fLyZNt7TZ8P1ZHv9EP6hx59NJy6bUVIeZrq

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:15 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 51ms
41ms Preflight
text/plain 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://as.ad4m.at
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 771a7ec69d1ebbf2-FRA
content-length: 24
content-type: text/plain
date: Tue, 29 Nov 2022 10:00:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hfj9piT9VgsPsjJ%2F5mV0i7znBP9%2BmpeAasFa50vxXMi5EZi1YQUgmwhv1QwIjNDeomRwGRmIBCg3sPv1sQirjvfTnGFe7fEH%2FwAd36hu5rDHEIuglB7fWEoK3rAMf5Xv%2Bf319M0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-ktgt

GET
H3 200 rar Show response
as.ad4m.at/ad/ Frame 4B79 9 KB
4 KB 83ms
82ms Document
text/html 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a2059d3ac5885aa5818f9db4f6a7028faf9f1b5c27044bd6f0570756e280ae4

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/dr?ed=1krrngwd82zq4bmkthxeas7d99beq94sbm232t340p00b73wxyvf4e71cx5ph8xmgx605pq4bsrcs4ygzs2y4h81p6d39k0fmrchzqpk4391snax2wqxm8vehg30kwjrxq47hay13p2zf8zrhshxzw0sbwhknw3mskn58f5m3vdgdcsmfncn77kt6rxvq0vbka3vt11g6f90d3qz1ssqq8tv0eza7xnhkb632wpnwz7x1sbcmevh43bzdcd221qmmrpve50020mcc1y9dz1jgbhtd1bd5fswnrk8spa2b5mpbatgdjq6h2k18m1nqd6d866k8ked9vc66p0xk0bt5kznsrh22e56rrk8b7nwk7zaqkz6p5z1xr3vz7h2fdcx8sdhcw93df29xvc6013dkajwvnwvx4w8fs2jm4zjw0aq4wwk4d1wa&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%26client%3Dca-pub-8745593945608202%26adurl%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 771a7ec72f549085-FRA
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 10:00:15 GMT
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.25/one-ad/ Frame 4B79 89 KB
11 KB 35ms
34ms Stylesheet
text/css 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as.ad4m.at/ad/style/0.1.25/one-ad/default.css
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ab995345cf38f3951bc840ab2c0d043269e700e59f1c6d6cb7fb8946268b358

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1669235721
age: 478916
cf-polished: origSize=91628
x-guploader-uploadid: ADPycdtnqpkBC2eNpIttCC4X9D-yrOoXK0HfmyiASnHmc5dpKNlZrWHuml5v2FihfATK0UIibbwmZ2MH5YrFqJYKDzRy-A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 23 Nov 2022 20:35:56 GMT
server: cloudflare
etag: W/"575def06e70febb0cbd25403e37880bf"
vary: Accept-Encoding
x-goog-generation: 1669235756372606
content-type: text/css
x-goog-hash: crc32c=ttlcew==, md5=V13vBucP67DL0lQD43iAvw==
cache-control: public, max-age=3600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gwCz35z%2B71wLc2EQCwm6ACSfkxZbX5dpCB3C9BVu0cQmrWlitX0dWxbz7KXxieHgCeMw6DXQhND7cVLq02fKzpRWLUDfLrbGDjOuTBSk5eNZa1CGEjlixUAJsoYQDEBCfxtZyKK2UTE%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 91628
cf-ray: 771a7ec7b8399085-FRA
expires: Tue, 29 Nov 2022 11:00:15 GMT

GET
H2 200 D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame 4B79 53 KB
54 KB 91ms
80ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1370260
cf-polished: origFmt=png, origSize=115129
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54564
cf-bgj: imgq:85,h2pri
last-modified: Tue, 09 Feb 2021 15:11:24 GMT
server: cloudflare
etag: "0a277d59efca0369a6983645e273659e"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1ER955RUCJ%2BK5kGaFr1%2FCqkvpmj2zFzke6Fjdh123qCo%2B4dSVGQNYi0RdYvwvrKpQIGNoHLYkMHMvjUC%2FfgPsNnN%2FNt81pofAyah%2F8pG9LOhtHUgq6y0p%2BjiHCKrSsHIIloVRMlBJ7SU5hp"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 771a7ec7cb299a09-FRA
expires: Wed, 30 Nov 2022 10:00:15 GMT

GET
H2 200 3778CF797E3A529087D97C23A5BCA9FADE012AB01E21FB1929557E8BD70A789A1F44E5D867099979B17313F69D44515CF12B8C937634907539AB1C54C4F5334B
assets.ad4m.at/product_image/ Frame 4B79 11 KB
11 KB 47ms
38ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/3778CF797E3A529087D97C23A5BCA9FADE012AB01E21FB1929557E8BD70A789A1F44E5D867099979B17313F69D44515CF12B8C937634907539AB1C54C4F5334B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fc6327e965679b41a818cf88fdaf0b16e586c0ac03bc72d49c4f47e2ed02336

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1095851
cf-polished: qual=85, origFmt=jpeg, origSize=46259
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10888
cf-bgj: imgq:85,h2pri
last-modified: Wed, 16 Nov 2022 16:09:44 GMT
server: cloudflare
etag: "b2cf554576629d98986c459034c76d1a"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FIwmQmcimc6ggjAEq9b%2BdsJh9ftBiUlQfaxji8w1HQ7hi9Of9d45hwiRlUDS8CdRd4uwZKtdIRfYaXOccIJ4SV3tWHfJ6zk9gXBpsh0TDME%2FS2runkY%2Fb8rJfsS1L7Hcr0KH4zH638AY7TdF"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 771a7ec7cb0f9a09-FRA
expires: Wed, 30 Nov 2022 10:00:15 GMT

GET
H/1.1

200
OK

/
partner.o2online.de/a/ Frame 4B79
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N773418.3417549O2_AFFILIATE/B25220131.345081615;dc_trk_aid=536683351;dc_trk_cid=176936761;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed_t...
https://ad.doubleclick.net/ddm/trackimp/N773418.3417549O2_AFFILIATE/B25220131.345081615;dc_pre=CKyw5O-Q0_sCFUfQuwgdD6wCiw;dc_trk_aid=536683351;dc_trk_cid=176936761;ord=%7B%7Btimestamp%7D%7D;dc_lat=...
https://www.telefonica-partner.de/tpv.php?t=117703V1226132702M&subid=reach_SUBIDTEST_view
https://www.lead-alliance.net/tpv.php?t=117703V1226132702M&subid=reach_SUBIDTEST_view
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117703&s_id=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&gdpr_consent=&gdpr=0&cons=0&spid=202...

49 B
1 KB

98ms
16ms

Image
image/gif

88.99.63.132
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117703&s_id=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&gdpr_consent=&gdpr=0&cons=0&spid=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&wfid=117703&partnerid=12218
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: HTTP/1.1
Server: 88.99.63.132 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads3.sunbonet.de
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:15 GMT
X-NODEIP: 88.99.63.132
Server: nginx/1.18.0 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
Content-Type: image/gif
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

location: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117703&s_id=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&gdpr_consent=&gdpr=0&cons=0&spid=2022112911001578991501653X117703V1226132702MSreach_SUBIDTEST_view&wfid=117703&partnerid=12218
date: Tue, 29 Nov 2022 10:00:15 GMT
x-content-type-options: nosniff
server: nginx
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8

GET
H2 200 DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
assets.ad4m.at/logo/ Frame 4B79 9 KB
9 KB 35ms
26ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/DF9A32151D42BCC835EC0C9BE62CF0094313EE46FD4E5D3DC0F1217B7F8F1AD49F0F4DDF5D50AE1511A12D11F97A6BCA3DF8CE9D056CE7A3DC11AF6ED1255D71
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5eeedf9055f9efab9127642b4c44135be9f404caa7ce08e51a5ea734dfd28828

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1166781
cf-polished: origFmt=png, origSize=24833
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9258
cf-bgj: imgq:85,h2pri
last-modified: Tue, 09 Feb 2021 15:11:57 GMT
server: cloudflare
etag: "174bb0dc35647e204b09aa120965604a"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OYO0ZteRC4FfWFAnruzs0hw3Ce4gdFuiOT7NV61MEA34OeAGNrLrhhXiKsmk9%2BYe%2F1RI6i0w8N0PGHajdmehXTUPo5aaQyKi9hnXdaYxjFwHpMpN0lf00Ible5sihtx7HCr4iUPSZUONnC%2Bx"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 771a7ec7cb129a09-FRA
expires: Wed, 30 Nov 2022 10:00:15 GMT

GET
H2 200 FDA524315CF1A84E9D46619FD10F0264DD2260394DD71198EE8FEC75572B31C1B960B5E4A647F88B6C04B0DBC247510EFFF5F03328E33405460FFEDC3D0CE020
assets.ad4m.at/product_image/ Frame 4B79 20 KB
20 KB 45ms
37ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/FDA524315CF1A84E9D46619FD10F0264DD2260394DD71198EE8FEC75572B31C1B960B5E4A647F88B6C04B0DBC247510EFFF5F03328E33405460FFEDC3D0CE020
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b094a140ea1c9e6edece62a54ab0d4fb5a600ba71495dc8835a12621e49204e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1097544
cf-polished: qual=85, origFmt=jpeg, origSize=85977
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 20094
cf-bgj: imgq:85,h2pri
last-modified: Wed, 16 Nov 2022 16:32:10 GMT
server: cloudflare
etag: "115bea0885590f780802fd14548a1cde"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2BKbtg7wESyGzQpCq2Wj%2FFIEd9X1Oz%2BXkvI41grXbUqXj2ziKMOO2kFGK8gqIMYqXePc7leFYpOPSiE38ltmeK3%2BrVarm9S0zF%2FpJU4V3nQyMZmoHq407h6BF1Rcgk%2FyQefAo1zrJ7DDqZtx"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 771a7ec7cb199a09-FRA
expires: Wed, 30 Nov 2022 10:00:15 GMT

GET
H/1.1

200
OK

/
partner.blau.de/a/ Frame 4B79
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N773418.3163536BLAU_AFFILIATE/B25532621.345088000;dc_trk_aid=536454876;dc_trk_cid=177082088;ord=%7B%7Btimestamp%7D%7D;dc_lat=;dc_rdid=;tag_for_child_directed...
https://ad.doubleclick.net/ddm/trackimp/N773418.3163536BLAU_AFFILIATE/B25532621.345088000;dc_pre=CJ6v5O-Q0_sCFVGK_QcdlnMJjw;dc_trk_aid=536454876;dc_trk_cid=177082088;ord=%7B%7Btimestamp%7D%7D;dc_la...
https://www.telefonica-partner.de/tpv.php?t=113752V1225131106M&subid=viewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
https://www.lead-alliance.net/tpv.php?t=113752V1225131106M&subid=viewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022112911001578991501655X113752V1225131106MSviewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netm...

49 B
1 KB

63ms
16ms

Image
image/gif

78.46.85.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022112911001578991501655X113752V1225131106MSviewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&cons=0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: HTTP/1.1
Server: 78.46.85.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads1.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Date: Tue, 29 Nov 2022 10:00:15 GMT
X-NODEIP: 78.46.85.162
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
Content-Type: image/gif
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

location: https://partner.blau.de/a/?i=pview&client=blau&camp=pview&l=de&nw=lea1&affiliate=113752&s_id=2022112911001578991501655X113752V1225131106MSviewoneidR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7oneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&cons=0
date: Tue, 29 Nov 2022 10:00:15 GMT
x-content-type-options: nosniff
server: nginx
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8

GET
H2 200 CE11F4A269236C0AF074ADB7F1ADA1F8C472CD7AC3290EFBF4A7DADA0100B8792254D4F2CF871D3311E6317269487774B650CDD0B207BED389DBEA35CD2DBC8F
assets.ad4m.at/logo/ Frame 4B79 16 KB
16 KB 55ms
47ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/CE11F4A269236C0AF074ADB7F1ADA1F8C472CD7AC3290EFBF4A7DADA0100B8792254D4F2CF871D3311E6317269487774B650CDD0B207BED389DBEA35CD2DBC8F
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e07d58c68b83a3c283f75063f562aadc164ebb7cf068ffaef89bdde5011c3da8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 561036
cf-polished: origFmt=png, origSize=39979
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15996
cf-bgj: imgq:85,h2pri
last-modified: Wed, 22 Jan 2020 13:07:55 GMT
server: cloudflare
etag: "ad9334664514d900a0c3b76d17ca960f"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JTA7ixGXJREfvLK%2BDqrJbrskvg%2FcWNswP%2BfC76cuIWcpmS8C031XA81JmVOkHFVBkdVVNmbXTCZMHsK2StR9BNujiHBumG5hWh37P5R2ebYSHDHZaFQDBYPZlyRivt%2BdmpkbiPiOBNA3FQKW"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 771a7ec7cb169a09-FRA
expires: Wed, 30 Nov 2022 10:00:15 GMT

GET
H2 200 EC9093D4AF3799CF781B1E590A25D192F3BFBB8EF4C33117758FB5ADF524B34A287AF80FDD08D80A46541DEAE1FFA692B6F4CA688E7C199182253AEB01A2863C
assets.ad4m.at/product_image/ Frame 4B79 222 KB
222 KB 56ms
49ms Image
image/webp 2606:4700:20::681a:ad1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/EC9093D4AF3799CF781B1E590A25D192F3BFBB8EF4C33117758FB5ADF524B34A287AF80FDD08D80A46541DEAE1FFA692B6F4CA688E7C199182253AEB01A2863C
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41b9b9d488e3a57902a671111dd089363c2f7d3a41ec3177f196abbb7cbac078

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 562912
cf-polished: origFmt=png, origSize=342797
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 226916
cf-bgj: imgq:85,h2pri
last-modified: Wed, 15 Jun 2022 14:01:11 GMT
server: cloudflare
etag: "82c7de0f42ff55fdd0acc07731664031"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bjp6Fjc80xVOFOLBG%2BxJ74h8qg%2Brd0wCApGHeafXJf78hZVbPHuIruXjZk9VkDh0wKumg3SAi%2Fr9GSaJifsObqmnWem5QGPiitgGAGzyZB7EGm6CngIluh4Bo4c7kDMZaQPdSTvOkE0gDr%2F1"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 771a7ec7cb119a09-FRA
expires: Wed, 30 Nov 2022 10:00:15 GMT

GET
H2

200

ztpv.php
www.conrad.de/ Frame 4B79
Redirect Chain

https://www.awin1.com/cshow.php?s=2470185&v=11354&q=377129&r=412871&pv=1&pref3=oneidD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtVoneid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
https://www.conrad.de/ztpv.php?awc=11354_412871_1669716015_9f355f01-6fcc-11ed-9792-223985e9a9b7&insert=AW&&gdpr=0&gdpr_consent=

0
639 B

107ms
66ms

Image
text/html

2606:4700::6812:7e05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.conrad.de/ztpv.php?awc=11354_412871_1669716015_9f355f01-6fcc-11ed-9792-223985e9a9b7&insert=AW&&gdpr=0&gdpr_consent=

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=197101%2C19491%2C14019&b=qGXsmf1WUJVA2uZHgHDtJtXXxaPTgTq4s3%2CR5Xfgf6QFX27TkHwH3tQtddAFwTzT7gs7%2CD8qh3fWwhbJ6t3HmH9t1tZDAhWTmTgbtV&f=R5Xfgf6QFGd2RfkHwH3tzCddDawTzT7gs7%2CQpKH4fdjUWX7axH5HYt9CZZrTDT4TzPFV%2Cd9DSEfPkH43WhEHjHwtqCbXQf3T4T1rUj&c=120&d=600&e=&g=6f64e4f4e36df6d6f13dd95a7e5ad340%2F7499537384203816563&i=20774%2C20773%2C21596&j=14%2C14%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1669716015177&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1kby8yt0kexgv9wsab6n8kqkgy96fzrrvcbtqz11yehq8wbeskzpsgncm2ch6c7215vjcpr82sj801xtenyxdt3dy67xf42b5ejt62ab4sgxxvn4am8dcrns999hwreawy5avvxcrgkmsdwh7h4tddev63pjb28rgwawj482er2fdp11k0m6fajt5e6q5153n0cf7g30zbn4ta4bar586xwatz4f9nhr9pjjghdyr4fynxcvezhn0404kb06tmfa4m4z10egbagt9b7h6jwg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCwZQ3LtiFY8W0BoGgzQae3JWwD5DhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTg3NDU1OTM5NDU2MDgyMDLIAQmpAi7cCr6bbbE-4AIAqAMBqgSmAk_QPH_9XOs-d_9jZTtAnhh2RrWfNS90vPf8CfnS_8QDfonFD0GQu8n0JprfSriqtWsJbiB-E67UeGSK60DIzd99WcV3gpwTl960oZ5277ODQO1uURwEv6sfbjtRR1BEGratrlopukzq_sL7q6xgWejZxdOdnIG7YPx9Lx-c2QpVh4UP3vRNMmkpkw7KggOxT1q8RM2JaIOuseflclw2Kua43lVto1lSe2vyQ41Sco_HL4rWs2aH-fLWogXl78beZXOWjgo9Q7pTM_-gkZKrXPO7VbMPQgjaAx5DDbYMiXQbzSFa6uLrzpo9T-awGYmXdO7rd4jbhgm7dn5PtcjEUIxN4J-2POLcnQLG-w5fiUgRmbcvom9mXBi28xH9CEV6LMtcAHNCP-AEAYAGzoTKq-u7gbpUoAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_1l2dhiPkIpjQIBQ9nlIsS7ZNlFhQ%2526client%253Dca-pub-8745593945608202%2526adurl%253D&y=1&s=&z=0

Protocol

Server

2606:4700::6812:7e05 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
via: 1.1 additional-webserver-blue-115j (Varnish/7.2)
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=15552000
age: 0
content-type: text/html; charset=UTF-8
p3p: policyref="http://www.conrad.de/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
x-varnish: 39256902
cache-control: no-cache
cf-ray: 771a7ec84be7bb83-FRA
expires: -1

Redirect headers

Date: Tue, 29 Nov 2022 10:00:15 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://www.conrad.de/ztpv.php?awc=11354_412871_1669716015_9f355f01-6fcc-11ed-9792-223985e9a9b7&insert=AW&&gdpr=0&gdpr_consent=
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0

GET
H3 200 e9d812f78ee6aa9851554eab94db7bc0.jpg
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 4 KB
4 KB 40ms
39ms Image
image/jpeg 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/e9d812f78ee6aa9851554eab94db7bc0.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47027eabd0579c3c523ca62ec9adb313835f5a6493c41aaba88d82508704ba9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 21:11:22 GMT
x-content-type-options: nosniff
age: 391733
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3755
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 24 Nov 2023 21:11:22 GMT

GET
H3 200 6cb3df6e7c3d92a9816e85dedff7a776.png
s0.2mdn.net/sadbundle/10293168272613754819/media/ Frame 6D07 3 KB
4 KB 40ms
40ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10293168272613754819/media/6cb3df6e7c3d92a9816e85dedff7a776.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

611eca343c812654b9ead66929102e4e44fc7c917c35c3c55d926991c4fb6906

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10293168272613754819/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 20:54:22 GMT
x-content-type-options: nosniff
age: 306353
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3580
x-xss-protection: 0
last-modified: Tue, 01 Nov 2022 13:44:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 20:54:22 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 25BE 0
0 76ms
74ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022111501&jk=560991975837033&bg=!rq2lrenNAAbvMpMzzzI7ACkAdvg8WhJRKN_4sdZVF7obqPHDEPdth0c_CrbJMc7SG6SJVMOy2hJoNAIAAADjUgAAAANoAQeZAtxQRIgnx2lg4XjvYUuz7zBOTMvXjdeBy1FfEFT10p64ajoW0BHluaA2pZalOHeFCR1uQhJOaDd_COvvgyyrOmOHtlFWrBKN-2DF06hNQgrSkAZW-rrLdEk-YBzIQz-TMy_wKn1TEKBgyXPNMvbDvgxSR_lJ07Wrg3QEpXCAXVDK32kwBppTRcr25_jgbtOvh1YKfs3VCuUEkRIuVuMxPNLMIRuoGo8YxpgqxMP4HG7NHXZWGXTBPgbtrBzB0EMzFzukb_mgU1drQXTW11WSx1LAbDwxc2TQEvlER0cl87zszqXSumNI-2CHGykjvD3qGVDDq6IpPQJCp4FaNhYaRAzbgIow-rSyzYZ-dkm-47BbjGfg7swLArAppCYFqK1vnUPgPQn4YP9I32XoSYS8nsJIXYHaICdtu2fRJ-XY32hHrSttR2ARPUjUrCJp41JPrTzlyMR-Adxj34GNbFdYRB7_RNrraTJpQ6w_XNsE4uyFJhw7ZNniOL0SYv2ExXElDmdR8sJQ14dzj12o4PEnk_iYLPMJsWFNAy0IoN65BmRkm08266DI41JLlNI8DdidqTqH7zDyEuM_uycTYHhTZgNqPRnVY3MFUB60WAuqOUoDbZ3O2iX553Q-imXnn5a5nNMPHhffeKofWtm9y_unpSmqk4sLVxPxg9RqNB0tpYcqOikM2eF224AdEb56xjkT8dEuGoK98YQKiJK663BgI0NbRfFRc0c9mbKRhFEN3Jsz6ixO9_xozR0sjjjJNNPmiPFWAD5q7WibOkM50HXxSHDobuuaf0IIjcO2RZ5smwNHRHaiaCqJ_SPe6QT4d6uL8dgpuJ4LsvisDMrIsmDh8YK7hFdIPWBImPEUyarkpMaMpKanznmykVedMu9kT45AF1htKDy0Rr37dNVcj4dr5t55BD7v1Xxds2Dy0K6lG7T6oJGn3d84kX-4WTEkb5xCPZEZzkcuLnKOw5HI0vg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

OPTIONS
H2 200 t
t.lkqd.net/ Frame 0
0 101ms
101ms Preflight
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, OPTIONS, POST
access-control-allow-origin: https://www.lebanonfiles.com
access-control-expose-headers: Content-Type, Content-Disposition
access-control-max-age: 300
cache-control: max-age=300
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:16 GMT
server: nginx

POST
H2 200 t Show response
t.lkqd.net/ Frame 4E70 0
168 B 92ms
92ms XHR
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:16 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain; charset=UTF-8

POST
H2 200 t Show response
t.lkqd.net/ Frame 1EB8 0
168 B 92ms
92ms XHR
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Requested by: Host: ad.lkqd.net
URL: https://ad.lkqd.net/vpaid/formats.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.lebanonfiles.com
date: Tue, 29 Nov 2022 10:00:16 GMT
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain; charset=UTF-8

OPTIONS
H2 200 t
t.lkqd.net/ Frame 0
0 102ms
101ms Preflight
text/plain 146.20.128.153
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://t.lkqd.net/t
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.20.128.153 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.lebanonfiles.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, OPTIONS, POST
access-control-allow-origin: https://www.lebanonfiles.com
access-control-expose-headers: Content-Type, Content-Disposition
access-control-max-age: 300
cache-control: max-age=300
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 29 Nov 2022 10:00:16 GMT
server: nginx

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 0586 0
128 B 15ms
14ms Script
text/plain 198.47.127.20
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.20 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:15 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 sync
eb2.3lift.com/ Frame 3F17 37 B
139 B 10ms
9ms Image
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/sync?px=1&src=prebid&
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Tue, 29 Nov 2022 10:00:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H3 200 pd
u.openx.net/w/1.0/ Frame 3F17 43 B
75 B 218ms
40ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.lebanonfiles.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:16 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame A3E3 42 B
64 B 115ms
114ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsviUbu12JI5wAxnk7qO8se8QepX0Ss014liCD677nAfGKbttAb-AKHiKIlYUgzQy1XYmhwjvZSw5TCLcl9LTJY2FUTTBUEL23xFp3DapBNy6ML9WhaoDXzwL4VXs0SjG_NDaRTG5g&sai=AMfl-YR2LlKW2IPTQ8EY__-DQeeDWRShVOsPg6mAEnmmy8sN5Xf-BxPbbi209XzTqC3xrmf46umk8Du9tObF3M8TvMg3kkcmx8x742sNjgY7ZNgyvuptC6zQeTFHsy31RLU&sig=Cg0ArKJSzL8xw6EW1XeWEAE&cid=CAQSPADq26N9-41vcDaIs6sCU-d8qgU5arTJ9DLssnwORhaAA5uUtMrvY9lEwQY2i9LxjElXB1GSG9b-4H9xkhgBIBM&id=lidarv&acvw=sv%3D941%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D2031,0,0,0,0%26mtos%3D2031,2031,2031,2031,2031%26amtos%3D0,0,0,0,0%26mcvt%3D2031%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2522%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D643%26pst%3D491%26dur%3D15000%26vmtime%3D2401%26dtos%3D2031%26dtoss%3D1%26dvs%3D2031%26dfvs%3D2031%26dvpt%3D2514%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D15%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483641%26psv%3D7%26psfv%3D7%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716016853%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2031&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.03%26t%3D1669716013836

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview_ext
pagead2.googlesyndication.com/ Frame A3E3 42 B
64 B 47ms
46ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/activeview_ext?id=lidarv&dc_pubid=3&dc_exteid=6788877285375218950&acvw=sv%3D941%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D2031,0,0,0,0%26mtos%3D2031,2031,2031,2031,2031%26amtos%3D0,0,0,0,0%26mcvt%3D2031%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2522%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D643%26pst%3D491%26dur%3D15000%26vmtime%3D2401%26dtos%3D2031%26dtoss%3D1%26dvs%3D2031%26dfvs%3D2031%26dvpt%3D2514%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D15%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483641%26psv%3D7%26psfv%3D7%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716016853%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2031&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.03%26t%3D1669716013836?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=200000;acvw=sv%3D941%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D2031,0,0,0,0%26mtos%3D2031,2031,2031,2...
ade.googlesyndication.com/ddm/activity_ext/ Frame A3E3 42 B
63 B 133ms
70ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=200000;acvw=sv%3D941%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D2031,0,0,0,0%26mtos%3D2031,2031,2031,2031,2031%26amtos%3D0,0,0,0,0%26mcvt%3D2031%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2522%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D643%26pst%3D491%26dur%3D15000%26vmtime%3D2401%26dtos%3D2031%26dtoss%3D1%26dvs%3D2031%26dfvs%3D2031%26dvpt%3D2514%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D15%26emuc%3D0%26emb%3D11,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483641%26psv%3D7%26psfv%3D7%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716016853%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,2031;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.03%26t%3D1669716013836?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

51-15-145-115.rev.poneytelecom.eu

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lt.min.js Show response
tags.crwdcntrl.net/lt/c/15238/ Frame EF08 52 KB
16 KB 35ms
8ms Script
text/javascript 65.9.66.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/15238/lt.min.js
Requested by: Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/f6ee63a0c2353004/lotame20220615.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-104.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6a3d04874e62000c66bf4ca845fbde04ecb011a85bb4cb54f0cdf5598529709a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.us.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 19:00:26 GMT
content-encoding: gzip
via: 1.1 f358cf5f46d10c349187abd5e20e06ce.cloudfront.net (CloudFront)
last-modified: Mon, 21 Nov 2022 18:31:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 53995
x-amz-server-side-encryption: AES256
etag: W/"b3509b007a9d747642c6a762ce4aed79"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: BCfKVlYWdKKOCJlxJmtSryA_BgkKZa8_mJQjDAqV53qqPVJqp-M3VQ==

GET
H2 200 sirdata_03022021.html Show response
s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/ Frame EA1B 636 B
578 B 56ms
18ms Document
text/html 185.172.90.250
WORLDSTREAM

General

Check archive.org

Show headers Download Go to

Full URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.90.250 Naaldwijk, Netherlands, ASN49981 (WORLDSTREAM, NL),
Reverse DNS: s.e-planning.net
Software: openresty /
Resource Hash: 14d79e2cf47df339b79d25ffc6d0136e5d2e70a96b75e6782198ea6bbda3ca0a

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=157680000
content-encoding: gzip
content-type: text/html
date: Tue, 29 Nov 2022 10:00:16 GMT
etag: W/"601b131c-27c"
expires: Sun, 28 Nov 2027 10:00:16 GMT
last-modified: Wed, 03 Feb 2021 21:18:20 GMT
server: openresty

GET
H2 200 sync Show response
vid.vidoomy.com/ Frame 7E99 49 KB
17 KB 226ms
58ms Document
text/html 2a02:6ea0:c700::19
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.vidoomy.com/sync?gdpr={{.GDPR}}&gdpr_consent={{.GDPRConsent}}&us_privacy={{.USPrivacy}}&redirect=https%3A%2F%2Fu-ams03.e-planning.net%2Fum%3Fdc%3D3ab023ac29ea5990%26fi%3Dfcb616ccaf9c767b%26uid%3D%7B%7BVID%7D%7D
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::19 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: acff2f7ced83945dfb1b2227c926ec6a29d4c9ef436b6cd78a0d0d7447286a09

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
content-encoding: br
content-type: text/html
date: Tue, 29 Nov 2022 10:00:17 GMT
etag: W/"61c991db-c5bc"
last-modified: Mon, 27 Dec 2021 10:13:47 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: AcO1qhEzqGah
x-77-nzt-ray: 4c15622431bcb1aa31d8856357298f22
x-77-pop: frankfurtDE
x-accel-expires: @1670752817
x-cache: MISS

GET
H2 200 sync Show response
eb2.3lift.com/ Frame D4B2 37 B
139 B 11ms
11ms Document
image/gif 13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?redir=https%3A%2F%2Fsync.e-planning.net%2Fum%3Fuid%3D%24UID%26dc%3D4d76b6ce34af74c9%26iss%3D1
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Tue, 29 Nov 2022 10:00:17 GMT

GET
H/1.1 200
OK csync Show response
sync.adtelligent.com/ Frame 83CA 0
384 B 144ms
144ms Document
text/plain 62.149.1.122
COLOCALL Internet...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adtelligent.com/csync?t=a&ep=307971&extuid=ADGfc84jpUZSzG%2fa
Requested by: Host: ads.us.e-planning.net
URL: https://ads.us.e-planning.net/uspd/1/?du=https%3A%2F%2Fsync.adtelligent.com%2Fcsync%3Ft%3Da%26ep%3D307971%26extuid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 62.149.1.122 Vyshhorod, Ukraine, ASN15497 (COLOCALL Internet Data Center ColoCALL, UA),
Reverse DNS
Software: Adtelligent /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.us.e-planning.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 0
Date: Tue, 29 Nov 2022 10:00:17 GMT
Etag: 04172fc93c99c15c
Server: Adtelligent

GET
H/1.1 200
OK GS.d Show response
js.cookieless-data.com/ Frame EA1B 0
535 B 117ms
25ms Script
text/plain 51.15.145.115
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://js.cookieless-data.com/GS.d?pa=24492&cmp=0&si=1&u=https%3A%2F%2Fs.e-planning.net%2Fesb%2F4%2F0%2F1992d%2Fbb6e7a161f794f56%2Fsirdata_03022021.html&r=https%3A%2F%2Fads.us.e-planning.net%2F&s=&rand=1669716017479

Requested by

Host: s.e-planning.net
URL: https://s.e-planning.net/esb/4/0/1992d/bb6e7a161f794f56/sirdata_03022021.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.15.145.115 Paris, France, ASN12876 (Online SAS, FR),

Reverse DNS

Software

nginx/1.20.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains; preload
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.e-planning.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Nov 2022 10:00:17 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains; preload
Server: nginx/1.20.2
P3p: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 0
X-Xss-Protection: 0
Expires: Tue, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/live/interaction/ Frame A3E3 42 B
65 B 81ms
80ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/live/interaction/?ai=CAkSJLdiFY9LbDuOF9u8PvZ24sASP9u3Gbcb32q3DEPLs0uCyARABIJ-X_GJgleKQgqAHoAG-h7HqAsgBBakCVxAhGyVtsT7gAgCoAwGYBACqBK4ET9BRdVJ7x_KpPM87FIG8SFxuwbSAel3kqBaiaLm14qUDH4BO_La7HZKbi9b1MQNG7A1OzuIUL7s97yP3A5faVph62BhK9PKRRxGAIDkKCkIH_FYBb532JzMW0JkBhaZHHF3WP8dH7oLqjDbmaMus7Hr17vH966U1hDG_59JmfcZn_wxOzvp2dnKfV4Nng6d5-eW99oeU1hawyBsw0SkAgzHjg_EcGoSZ7nAs8H_tCWH08tyqUIBe_pen4R_n0pdL5h8t1yED65Y4liyUsmg7Uh_bfrCCguumC1dg_DNaPL-AU9lSGaUzqOaXzzSwmGQLcXC-ECC_Sqyt5nLtC7-dmmZPGOWTtUeefk07-7HKsv5296fZ1JEgiOTHwJeDyqx_scqZV9-hN48YpsrRsYjTWUSY4xnlRKlbpX6Pmfek5a4fc6Zq7YfKvjWe13YREwhk_3Hvnwj2WHFkeCb6r-Cxgqkt0nT8V47s1jrJbS46ng3gKCUJI-t8Jutwd8fMwZAZuPl2O113yO6fyTa44c737ME5mHnj25ruqc4q_cU9oATiqqoJDZ6ePVNq_2lPzCWcNk90eBPZp_q7bKphfBe6BG0asfHwFgE5WmVOyalKxJ3MQT2JkK2OkZnmM91W49w5eQ0LUIeNcmREV2RoIdcmRLzPOx0ANxJB1kW6OKDSdmO6YN2sZA-m2GOCqyuI1jpnwtXqjqTi5m7igPbqYTObtKPwSjUUm925oYCWtKoFwASS__aGlQTgBAGgBlSAB6r4zpUBqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcBqAgB0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwGwE_CvmRHYEwLYFAHQFQGoFgH4FgGAFwE&sigh=u7KHNrFiLvI&cmd=Ch1jYS12aWRlby1wdWItMzE5MTI4OTg4MjA0NTE1NRAAGAI&label=videoplaytime25&ad_mt=3995&acvw=sv%3D941%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D3480,0,0,0,0%26mtos%3D3480,3480,3480,3480,3480%26amtos%3D0,0,0,0,0%26mcvt%3D3480%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D3971%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1043%26pst%3D491%26dur%3D15000%26vmtime%3D3994%26dtos%3D1449%26dtoss%3D2%26dvs%3D1449%26dfvs%3D1449%26dvpt%3D1449%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D3480,3480,3480,3480,3480%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D23%26emuc%3D0%26emb%3D19,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483633%26psv%3D15%26psfv%3D15%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716018302%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,3480&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.03%26t%3D1669716013836

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ltt /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Nov 2022 10:00:18 GMT
x-content-type-options: nosniff
server: ltt
x-frame-options: SAMEORIGIN
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=960584;acvw=sv%3D941%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D3480,0,0,0,0%26mtos%3D3480,3480,3480,3...
ade.googlesyndication.com/ddm/activity_ext/ Frame A3E3 42 B
63 B 70ms
69ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity_ext/dc_pubid=3;dc_exteid=6788877285375218950;met=1;ecn1=1;etm1=0;eid1=960584;acvw=sv%3D941%26cb%3Dima%26e%3D1%26nas%3D1%26sdk%3Dh%26p%3D920,1280,1100,1600%26tos%3D3480,0,0,0,0%26mtos%3D3480,3480,3480,3480,3480%26amtos%3D0,0,0,0,0%26mcvt%3D3480%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D3971%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D1043%26pst%3D491%26dur%3D15000%26vmtime%3D3994%26dtos%3D1449%26dtoss%3D2%26dvs%3D1449%26dfvs%3D1449%26dvpt%3D1449%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D3480,3480,3480,3480,3480%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D0%26ces%26femt%3D1930%26femvt%3D0%26emc%3D23%26emuc%3D0%26emb%3D19,0,0,0,0%26avms%3Dexc%26qi%3D653353702%26psm%3D-2147483633%26psv%3D15%26psfv%3D15%26psa%3D0%26pnmm%3D1669716011411%26ptlt%3D1669716018302%26pngs%3D9s,14,15s%26veid%3Dxdi%3A0,amp%3A0,ssmol%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,3480;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.03%26t%3D1669716013836?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS