www.heatbud.com Open in urlscan Pro
44.224.156.148 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.heatbud.com/valag76785
Submission: On September 23 via manual (September 23rd 2022, 11:07:12 am UTC) from IN — Scanned from DE

Summary HTTP 94 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 24 IPs in 3 countries across 16 domains to perform 94 HTTP transactions. The main IP is 44.224.156.148, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is www.heatbud.com.
TLS certificate: Issued by SSL.com RSA SSL subCA on January 15th 2022. Valid for: a year.

This is the only time www.heatbud.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	44.224.156.148 44.224.156.148	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	13.32.99.78 13.32.99.78	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206e:9800:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.196.212.55 18.196.212.55	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	13.32.121.95 13.32.121.95	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:2156:3c00:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
17	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	209.140.129.66 209.140.129.66	11643 (EBAY) (EBAY)
7	2606:4700:10:... 2606:4700:10::6816:6ac	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	92.123.38.91 92.123.38.91	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:26f0:350... 2a02:26f0:3500:590::1ec4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
94	24

10 44.224.156.148 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-224-156-148.us-west-2.compute.amazonaws.com

www.heatbud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.78 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-78.fra60.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:9800:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.196.212.55 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-212-55.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.121.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-95.fra60.r.cloudfront.net

count-server.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:3c00:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.140.129.66 (United States)

ASN11643 (EBAY, US)
PTR: rover-public-slcaz01-1-1.ebay.com

www.ebayadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:10::6816:6ac (United States)

ASN13335 (CLOUDFLARENET, US)

metrics.nt.vc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 92.123.38.91 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-38-91.deploy.static.akamaitechnologies.com

secureir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:590::1ec4 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

secure.insightexpressai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 105 tpc.googlesyndication.com — Cisco Umbrella Rank: 142	423 KB
10	heatbud.com www.heatbud.com	254 KB
9	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 41	94 KB
9	gstatic.com fonts.gstatic.com www.gstatic.com	116 KB
7	nt.vc metrics.nt.vc — Cisco Umbrella Rank: 50505	24 KB
6	ebaystatic.com secureir.ebaystatic.com — Cisco Umbrella Rank: 4889	118 KB
5	sharethis.com platform-api.sharethis.com — Cisco Umbrella Rank: 4671 buttons-config.sharethis.com — Cisco Umbrella Rank: 5622 l.sharethis.com — Cisco Umbrella Rank: 4493 count-server.sharethis.com — Cisco Umbrella Rank: 12247 platform-cdn.sharethis.com — Cisco Umbrella Rank: 10758	46 KB
5	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 293 fonts.googleapis.com — Cisco Umbrella Rank: 40	37 KB
4	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 75 www.google.com — Cisco Umbrella Rank: 2	1 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 190	131 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	20 KB
2	google.de adservice.google.de — Cisco Umbrella Rank: 9081	914 B
1	insightexpressai.com secure.insightexpressai.com — Cisco Umbrella Rank: 1118
1	ebayadservices.com www.ebayadservices.com — Cisco Umbrella Rank: 4640	14 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 857	644 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	45 KB
94	16

	Domain	Requested by
17	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
11	pagead2.googlesyndication.com	www.heatbud.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
10	www.heatbud.com	www.heatbud.com
9	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net www.heatbud.com
7	metrics.nt.vc	www.ebayadservices.com metrics.nt.vc
6	secureir.ebaystatic.com	www.ebayadservices.com secureir.ebaystatic.com googleads.g.doubleclick.net
6	fonts.gstatic.com	fonts.googleapis.com
4	fonts.googleapis.com	www.heatbud.com googleads.g.doubleclick.net
3	www.gstatic.com	googleads.g.doubleclick.net
3	www.googletagservices.com	googleads.g.doubleclick.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.heatbud.com
2	www.google.com	1 redirects tpc.googlesyndication.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
1	secure.insightexpressai.com	www.ebayadservices.com
1	www.ebayadservices.com	googleads.g.doubleclick.net
1	platform-cdn.sharethis.com	www.heatbud.com
1	count-server.sharethis.com	platform-api.sharethis.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	www.googletagmanager.com	www.heatbud.com
1	platform-api.sharethis.com	www.heatbud.com
1	ajax.googleapis.com	www.heatbud.com
94	24

This site contains links to these domains. Also see Links.

Domain
paper-crafting-tools.weebly.com

Subject Issuer	Validity	Valid
heatbud.com SSL.com RSA SSL subCA	`2022-01-15` - `2023-02-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
sharethis.com Amazon	`2022-06-19` - `2023-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
rover.intl.ebay.com Sectigo RSA Organization Validation Secure Server CA	`2022-05-17` - `2023-05-17`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
www.ebay.com Sectigo RSA Organization Validation Secure Server CA	`2022-08-16` - `2023-08-16`	a year	crt.sh
*.insightexpressai.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-14` - `2023-03-15`	a year	crt.sh

This page contains 14 frames:

Primary Page: https://www.heatbud.com/valag76785
Frame ID: 8A96DDD18E3D320006C8DE20FEA0E712
Requests: 36 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20190131/zrt_lookup.html
Frame ID: DE4C8FCA6AF10F7A170856D494A12862
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&h=401&slotname=3518195841&adk=2667455899&adf=1624552877&pi=t.ma~as.3518195841&w=545&lmt=1663931227&rafmt=11&psa=0&format=545x401&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227564&bpp=4&bdt=475&idt=100&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&correlator=2625237342588&frm=20&pv=2&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1005&ady=1447&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cp&abl=XS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6HEeQtHYP1&p=https%3A//www.heatbud.com&dtd=117
Frame ID: 3F8018C00986010FDFF9DD519C9E0522
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&adk=1812271804&adf=3025194257&lmt=1663931227&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&ea=0&pra=7&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227578&bpp=1&bdt=489&idt=109&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=545x401&nras=1&correlator=2625237342588&frm=20&pv=1&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=2&uci=a!2&fsb=1&dtd=115
Frame ID: 3843A8F6948802DA9FE07FEACE09A969
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 6B2C6B736F09726C8006A2D30CE3CF60
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js
Frame ID: 796C89635A6CAFB0F2675EC4CFF7CCD7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1
Frame ID: DE461A3F862A6AD4D716F25727C8316E
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1
Frame ID: 81B9590AF7DCFDD1D11DA6A1A8DAE8B0
Requests: 9 HTTP requests in this frame

Frame: https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-166314-871238-2&mkcid=4&mkevt=2&mpt=522720348&gdpr=&gdpr_consent=&campaignid={campaignid}&gclid={gclid}&siteid=77&icep_siteid=77&ipn=admain2&adtype=2&size=728x90&pgroup=560283&mpvc=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%26num%3D1%26cid%3DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%26sig%3DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%26client%3Dca-pub-3344897177583439%26adurl%3D
Frame ID: 893612A7B6534AD08328F35AE09E65B8
Requests: 10 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C500
Frame ID: 61B3ED256AD40C0B5C63CB2AD3FED647
Requests: 7 HTTP requests in this frame

Frame: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0
Frame ID: 1E86286F3CFF8F355760C06F62BA1D0D
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js
Frame ID: FE193E5396D308CC605B496215F8529E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 69EEFEB3DB800A1E7C79499D3053DF07
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: B8ACE6036CE680530D68C97B0CAD4BF6
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Heatbud | Paper Phase

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

94
Requests

100 %
HTTPS

74 %
IPv6

16
Domains

24
Subdomains

24
IPs

3
Countries

1326 kB
Transfer

3081 kB
Size

11
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://paper-crafting-tools.weebly.com/
Title: https://paper-crafting-tools.weebly.com/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

94 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request valag76785 Show response
www.heatbud.com/ 30 KB
30 KB 844ms
228ms Document
text/html 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-224-156-148.us-west-2.compute.amazonaws.com

Software

Apache/2.4.54 () OpenSSL/1.0.2k-fips /

Resource Hash

24d4e0f8cafec6ed8ec300da07a616dfc212854c1739678979c55021d04b5b5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-language: de-DE
content-type: text/html;charset=UTF-8
date: Fri, 23 Sep 2022 11:07:06 GMT
expires: 0
pragma: no-cache
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.10.2/ 91 KB
33 KB 58ms
17ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Thu, 22 Sep 2022 15:58:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68897
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32954
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Sep 2023 15:58:50 GMT

GET
H2 200 heatbud-profile-min.js Show response
www.heatbud.com/resources/js/ 24 KB
24 KB 276ms
275ms Script
application/javascript 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.heatbud.com/resources/js/heatbud-profile-min.js?20190402
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: 4304c5b4d05266100cb5b3671a5caa41a9d0eec02af52fa14e3e01136b0cf91e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Wed, 05 Aug 2020 21:29:28 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 24099
content-type: application/javascript

GET
H2 200 heatbud-images-min.js Show response
www.heatbud.com/resources/js/ 8 KB
8 KB 332ms
331ms Script
application/javascript 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.heatbud.com/resources/js/heatbud-images-min.js?20190402
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: 12942e23b47319bc5eb290ab03aa490d10166cf91f01c70e66f2ecede33e0b56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Wed, 25 Apr 2018 09:08:48 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 8209
content-type: application/javascript

GET
H2 200 heatbud-pagebox-min.js Show response
www.heatbud.com/resources/js/ 2 KB
2 KB 173ms
173ms Script
application/javascript 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.heatbud.com/resources/js/heatbud-pagebox-min.js?20190402
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: 34586a8b3f0d9723be13ff897264acaa4a59c45912cd33313d273687af2c4f24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Sun, 13 Jan 2019 07:57:46 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 1725
content-type: application/javascript

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 192 KB
43 KB 72ms
20ms Script
text/javascript 13.32.99.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.78 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-78.fra60.r.cloudfront.net

Software

Resource Hash

700ad5e597681fb45dfc74f05206ad9c2229a6c710c45b413842ddfe03ce4d50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:05:37 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 90
etag: W/"3011a-1tH8M8TNdKB39qADlCdHeiBv0FM"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 d63ea68c8b7458d49fe25f66ef7f0a5e.cloudfront.net (CloudFront)
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-amz-cf-pop: FRA60-P3
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: nvoC85jiRqK0a4UOobpo0juzaPgEgrTDq7wsfh6S6KVKAKb_L2Ph2w==

GET
H2 200 css
fonts.googleapis.com/ 14 KB
2 KB 68ms
28ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Arvo%7CDroid+Sans+Mono%7CFauna+One%7CImprima%7CLato%7CMarvel%7COffside%7COpen+Sans%7COxygen+Mono%7CPermanent+Marker%7CRaleway%7CRoboto+Mono%7CScope+One%7CText+Me+One%7CUbuntu

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0eef53bf9432ab73a90915259db28009669de54a461723720876b777f8051f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 23 Sep 2022 11:07:07 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 23 Sep 2022 11:07:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Sep 2022 11:07:07 GMT

GET
H2 200 main-min.css
www.heatbud.com/resources/css/ 7 KB
7 KB 332ms
331ms Stylesheet
text/css 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.heatbud.com/resources/css/main-min.css?20190402
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: 357b43b23a327e02e7e5a8987441641f43e57caec9516a77c0516e4c7d3e6030

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Sun, 31 May 2020 16:42:20 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 7434
content-type: text/css

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 115 KB
45 KB 71ms
31ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RMV88N

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0b33a4f5d5ffde5c10183148afa22dc1e11a36286ae2eefec04fb646be388dda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45504
x-xss-protection: 0
last-modified: Fri, 23 Sep 2022 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 23 Sep 2022 11:07:07 GMT

GET
H2 200 heatbud-logo.png
www.heatbud.com/resources/images/ 9 KB
9 KB 175ms
174ms Image
image/png 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.heatbud.com/resources/images/heatbud-logo.png
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: a046289a29195690b7aec507f3bc7ce55bf243c578c018165aee5999fe19188b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Wed, 28 Mar 2018 15:00:00 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 9174
content-type: image/png

GET
H2 200 favicon.ico
www.heatbud.com/resources/images/ 31 KB
32 KB 174ms
173ms Image
image/x-icon 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.heatbud.com/resources/images/favicon.ico
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: f84baffc2306cfe2673a1193c83ab6fa13e55a181c8f2a0353d064ab1de30f48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Sat, 26 Apr 2014 11:38:12 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 32038
content-type: image/x-icon

GET
H2 200 trending-up.png
www.heatbud.com/resources/images/ 286 B
347 B 174ms
173ms Image
image/png 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.heatbud.com/resources/images/trending-up.png
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: bc8e5789225325fd3ea6b4f4e05c0f8fb8430a98b4b6cb47e9bf026736551491

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Tue, 10 Dec 2013 15:53:50 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 286
content-type: image/png

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 167 KB
57 KB 95ms
55ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdfe50cf48f3ea22cf9cb7b8d6089a205f99ab66071c751a367f697cbcd1e8a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 58076
x-xss-protection: 0
server: cafe
etag: 10155306521231517962
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 23 Sep 2022 11:07:07 GMT

GET
H2 200 def-blogger-bg.jpg
www.heatbud.com/resources/images/ 118 KB
119 KB 174ms
174ms Image
image/jpeg 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.heatbud.com/resources/images/def-blogger-bg.jpg
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: 3a0df9a49ee15729b2eb0c887c490a23b7e54b3cd41b3bb516d607f43e14001e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Sun, 19 Feb 2017 12:53:02 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 120626
content-type: image/jpeg

GET
H2 200 def-blogger-photo.jpg
www.heatbud.com/resources/images/ 23 KB
23 KB 174ms
174ms Image
image/jpeg 44.224.156.148
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.heatbud.com/resources/images/def-blogger-photo.jpg
Requested by: Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.224.156.148 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-224-156-148.us-west-2.compute.amazonaws.com
Software: Apache/2.4.54 () OpenSSL/1.0.2k-fips /
Resource Hash: 19deef89d86a2e8ea114da378250890253a6a3be22dc53f4d5e16f96d98e583e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/valag76785
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:06 GMT
last-modified: Sun, 19 Feb 2017 12:57:10 GMT
server: Apache/2.4.54 () OpenSSL/1.0.2k-fips
accept-ranges: bytes
content-length: 23656
content-type: image/jpeg

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v34/ 16 KB
16 KB 78ms
32ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v34/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Arvo%7CDroid+Sans+Mono%7CFauna+One%7CImprima%7CLato%7CMarvel%7COffside%7COpen+Sans%7COxygen+Mono%7CPermanent+Marker%7CRaleway%7CRoboto+Mono%7CScope+One%7CText+Me+One%7CUbuntu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.heatbud.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 18:52:55 GMT
x-content-type-options: nosniff
age: 317652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16740
x-xss-protection: 0
last-modified: Mon, 15 Aug 2022 18:14:44 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Sep 2023 18:52:55 GMT

GET
H2 200 Fh4uPib9Iyv2ucM6pGQMWimMp004La2Cfw.woff2
fonts.gstatic.com/s/permanentmarker/v16/ 29 KB
29 KB 62ms
17ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/permanentmarker/v16/Fh4uPib9Iyv2ucM6pGQMWimMp004La2Cfw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4884fec2c73aa52a2461073c1b87d1ceb80f400520391b43f97ca7d3c39eeb24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.heatbud.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 00:21:35 GMT
x-content-type-options: nosniff
age: 211532
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29564
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 17:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Sep 2023 00:21:35 GMT

GET
H2 200 HI_KiYMWKa9QrAykc5boRw.woff2
fonts.gstatic.com/s/offside/v20/ 9 KB
9 KB 82ms
37ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/offside/v20/HI_KiYMWKa9QrAykc5boRw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db4dfa1f2cbb7c5879dcdc583ef8ad451bb44552f28f2454659d714fabb9d2bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.heatbud.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 12:13:32 GMT
x-content-type-options: nosniff
age: 341615
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8852
x-xss-protection: 0
last-modified: Mon, 09 May 2022 20:15:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Sep 2023 12:13:32 GMT

GET
H2 200 5a9e07be57f7f1001382393f.js Show response
buttons-config.sharethis.com/js/ 443 B
858 B 247ms
147ms Script
text/javascript 2600:9000:206e:9800:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5a9e07be57f7f1001382393f.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206e:9800:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

852942cd647c48a81ed1918477cae3dc3d5a8a64ddb5fb791cee2d2ef8f46722

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:08 GMT
via: 1.1 fd2756277dcf50743fb09f4526b54aca.cloudfront.net (CloudFront)
last-modified: Sat, 10 Mar 2018 03:25:47 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-C1
etag: "c12b36559f9673022a2b11992c01f2bd"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: max-age=60,public
strict-transport-security: max-age=31536000; includeSubDomains
accept-ranges: bytes
content-length: 443
x-amz-cf-id: j-qGWzv3to9e7nIQX9zvJeIZuEarlU4ESo75vqdApSEf5aIW4A1Efg==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
402 B 93ms
16ms XHR
text/plain 18.196.212.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=www.heatbud.com&location=%2Fvalag76785&product=inline-share-buttons&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Heatbud%20%7C%20Paper%20Phase&cms=unknown&publisher=5a9e07be57f7f1001382393f&sop=true&version=st_sop.js&lang=en&description=%20Paper%20cutting%20is%20an%20art%20form%20that%20involves%20cutting%20beautiful%20designs%20and%20patterns%20from%20a%20single%20sheet%20of%20paper%20with%20only%20scissors%20or%20a%20blade.%20Paper%20cutting%20has%20a%20lengthy%20history%20%E2%80%93%20almost%202000%20years%2C%20to%20be%20exact!%20Paper-cut%20art%20was%20said%20to%20have%20started%20in%20China%20with%20the%20discovery%20of%20paper%20in%20the%202nd%20century%20and%20extended%20to%20the%20rest%20of%20the%20globe%20during%20the%2014th%20century%2C%20when%20its%20popularity%20in%20China%20was%20at%20its%20peak.%0A%20

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.196.212.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-196-212-55.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date: Fri, 23 Sep 2022 11:07:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin: https://www.heatbud.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 59ms
15ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RMV88N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 11 Sep 2022 13:50:09 GMT
server: Golfe2
age: 307
date: Fri, 23 Sep 2022 11:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19826
expires: Fri, 23 Sep 2022 13:02:00 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/ 346 KB
122 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3344897177583439&plah=www.heatbud.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d45b3eb68f70907d3780983cc56becd3c3101deea78943f0191e1031d8ae514

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124743
x-xss-protection: 0
server: cafe
etag: 13212211095767694579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 23 Sep 2022 11:07:07 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220921/r20190131/ Frame DE4C 10 KB
5 KB 57ms
15ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220921/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 44253
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Sep 2022 22:49:34 GMT
etag: 9671129459699598864
expires: Thu, 06 Oct 2022 22:49:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 53ms
22ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j97&a=1130406352&t=pageview&_s=1&dl=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&ul=en-us&de=UTF-8&dt=Heatbud%20%7C%20Paper%20Phase&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=819265198&gjid=888327822&cid=186807094.1663931228&tid=UA-48436913-1&_gid=545047468.1663931228&_r=1&gtm=2wg9l05RMV88N&cd2=1663931227538&cd3=%2Fvalag76785&cd4=NULL&cd5=0&cd6=(not%20set)&z=2074145518

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.heatbud.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 23 Sep 2022 11:07:07 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.heatbud.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 215 B
644 B 66ms
25ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.heatbud.com&callback=_gfp_s_&client=ca-pub-3344897177583439

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3344897177583439&plah=www.heatbud.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c93293804abb59b6c4bb2686399126752ed627283ba13a30d8a0d74d6762f5f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 200
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 66ms
25ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.heatbud.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 66ms
24ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.heatbud.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3F80 93 KB
32 KB 370ms
337ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&h=401&slotname=3518195841&adk=2667455899&adf=1624552877&pi=t.ma~as.3518195841&w=545&lmt=1663931227&rafmt=11&psa=0&format=545x401&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227564&bpp=4&bdt=475&idt=100&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&correlator=2625237342588&frm=20&pv=2&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1005&ady=1447&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cp&abl=XS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6HEeQtHYP1&p=https%3A//www.heatbud.com&dtd=117

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74541c7ce0756e2bb064899630af95b77f90fce37c4a70a13b5df509b8988859

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 32795
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 11:07:08 GMT
expires: Fri, 23 Sep 2022 11:07:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 49ms
49ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&tn=TABLE&cls=header&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Sep 2022 11:07:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 3843 194 KB
49 KB 588ms
566ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&adk=1812271804&adf=3025194257&lmt=1663931227&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&ea=0&pra=7&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227578&bpp=1&bdt=489&idt=109&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&prev_fmts=545x401&nras=1&correlator=2625237342588&frm=20&pv=1&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=2&uci=a!2&fsb=1&dtd=115

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c795d45bb067d9aaebb392cfca2f10a84680b6cccfadf9b6f44ab25c248f06fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 49717
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 11:07:08 GMT
expires: Fri, 23 Sep 2022 11:07:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 15ms
15ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j97&a=1130406352&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&ul=en-us&de=UTF-8&dt=Heatbud%20%7C%20Paper%20Phase&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Client%20Id&ea=trackClientId&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=186807094.1663931228&tid=UA-48436913-1&_gid=545047468.1663931228&gtm=2wg9l05RMV88N&cd1=186807094.1663931228&z=758072015

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Sep 2022 04:58:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 22117
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 get_counts Show response
count-server.sharethis.com/v2.0/ 134 B
500 B 246ms
172ms Script
text/javascript 13.32.121.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://count-server.sharethis.com/v2.0/get_counts?cb=window.__sharethis__.cb&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.121.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-121-95.fra60.r.cloudfront.net

Software

Resource Hash

970e36889d6a47606de3b219bb778668cbba78c1dd060d5309eccd1512b5f569

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
via: 1.1 0dec5f752f0f332c449471a83f050dd2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
etag: 182ee0db4d0be17114d2317dba235af7
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store, must-revalidate
content-length: 134
apigw-requestid: Y6P2ZjHvIAMESyA=
x-amz-cf-id: KBENSTsWo03JgiJkwbDDTdF67Tpo6JacvpbSd6Bswc5YacBXm3JM0g==

GET
H2 200 sharethis.svg
platform-cdn.sharethis.com/img/ 514 B
956 B 80ms
16ms Image
image/svg+xml 2600:9000:2156:3c00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/sharethis.svg

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:3c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 06:56:38 GMT
via: 1.1 1d87c34bb2f20fda8e0841bc33179768.cloudfront.net (CloudFront)
vary: Accept-Encoding
age: 1247334
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 514
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
etag: "deecdaa377907db5cc1722fc831670a1"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: IOboamsn5mKWd3upuzAmK071X2XCqmgHrSTetN0sDzLS-PbSf74BZw==

GET
H3 200 css
fonts.googleapis.com/ Frame 3F80 6 KB
672 B 57ms
26ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&h=401&slotname=3518195841&adk=2667455899&adf=1624552877&pi=t.ma~as.3518195841&w=545&lmt=1663931227&rafmt=11&psa=0&format=545x401&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227564&bpp=4&bdt=475&idt=100&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&correlator=2625237342588&frm=20&pv=2&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1005&ady=1447&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cp&abl=XS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6HEeQtHYP1&p=https%3A//www.heatbud.com&dtd=117

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 23 Sep 2022 10:26:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 23 Sep 2022 11:07:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Sep 2022 11:07:08 GMT

GET
H2 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 3F80 34 KB
14 KB 54ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/m_js_controller_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b90e13ebc85d7fd3dc0e2665b491ad10fc544cf8bc57f76ed39459c0e02f2b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:02:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14190
x-xss-protection: 0
server: cafe
etag: 337214682915004451
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 11:02:53 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3F80 140 KB
44 KB 102ms
62ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d862ec0d2b72e9f1575615db28f4196cbf0f586adb2208c605c691d6e06ee6ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44525
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1663760195623328"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Sep 2022 11:07:08 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18019995289472015557/ Frame 3F80 30 KB
30 KB 143ms
19ms Image
image/jpeg 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18019995289472015557/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebfce0994985bca52727650d284edcfbf6fa653193f347c2f23cc466be11d6d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 10:38:39 GMT
x-content-type-options: nosniff
age: 174509
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30462
x-xss-protection: 0
last-modified: Fri, 20 May 2022 08:59:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 21 Sep 2023 10:38:39 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/ Frame 3F80 23 KB
9 KB 140ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d485f54c3ae5920cd21c8d180458c50f092554777b97f9c52ac6f76359838a05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 09:50:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9559
x-xss-protection: 0
server: cafe
etag: 12142024561622733046
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 09:50:16 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 3F80 3 KB
1 KB 154ms
31ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 11:01:06 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 3F80 17 KB
7 KB 142ms
18ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c39e9db358e5d8045bebf902ed71b49c17d66f175c8ce0dcaeec96ec7d09090b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 10:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2590
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7553
x-xss-protection: 0
server: cafe
etag: 15375136450269253166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 10:23:58 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3F80 0
0 60ms
60ms Fetch
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-DguW5MtY8njLcOX1fAPjaK5yAS76vKcarm4ju7_D9vZHhABIO_K9iFgleKQgqAHoAHJoIvNKMgBBqkCHOjYh6V7sD6oAwHIA8sEqgTjAU_Q7MXdJkE1dYorn1brnpt9rbXnZ9RHqbmWhnqGDAeeuLhx5E0e5hVcqkV3tAqFUW7rl7MdrHyeOiDPgAsOiWxBkP_0kvx2CdBR5GbkM9myXZ6atQI_vAdObImU2JFoIhH2Iv9KQwsDsHDpoJBjP8I3MyEmxMgLhwtiTgpudmooAC72MEBoABZ0IpKlNoIIsJolb56k2QC7oGXw6NqbXagOnbJaR5LNBgg6VWWAg80y5d8hLjzgJz2k6tDL9Eis7K16iM9wPmlUBjDTb30p6Uf_tPY48nLSNLXeCENLOFQDyeFowATo9fzX_wOSBQQIBBgBkgUECAUYBKAGN4AHydjbrAOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCDggHSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTCogUBdAVAYAXAbIXHAoaCAASFHB1Yi0zMzQ0ODk3MTc3NTgzNDM5GAA&sigh=vQBAFYeRhl8&uach_m=[UACH]&template_id=492

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&h=401&slotname=3518195841&adk=2667455899&adf=1624552877&pi=t.ma~as.3518195841&w=545&lmt=1663931227&rafmt=11&psa=0&format=545x401&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227564&bpp=4&bdt=475&idt=100&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&correlator=2625237342588&frm=20&pv=2&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1005&ady=1447&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cp&abl=XS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6HEeQtHYP1&p=https%3A//www.heatbud.com&dtd=117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 23 Sep 2022 11:07:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 23 Sep 2022 11:07:08 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3F80 16 KB
16 KB 48ms
16ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 12:56:05 GMT
x-content-type-options: nosniff
age: 339063
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Sep 2023 12:56:05 GMT

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3F80 15 KB
15 KB 50ms
19ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 16:39:45 GMT
x-content-type-options: nosniff
age: 325643
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Sep 2023 16:39:45 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3F80 15 KB
15 KB 55ms
23ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500&lang=de

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 16 Sep 2022 13:27:29 GMT
x-content-type-options: nosniff
age: 596379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Sep 2023 13:27:29 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6B2C 143 B
163 B 15ms
15ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3344897177583439&output=html&h=401&slotname=3518195841&adk=2667455899&adf=1624552877&pi=t.ma~as.3518195841&w=545&lmt=1663931227&rafmt=11&psa=0&format=545x401&url=https%3A%2F%2Fwww.heatbud.com%2Fvalag76785&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1663931227564&bpp=4&bdt=475&idt=100&shv=r20220921&mjsv=m202209080101&ptt=9&saldr=aa&abxe=1&correlator=2625237342588&frm=20&pv=2&ga_vid=186807094.1663931228&ga_sid=1663931228&ga_hid=1130406352&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1005&ady=1447&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C42531706&oid=2&pvsid=446441447353290&tmod=734038452&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CEebr%7Cp&abl=XS&pfx=0&fu=1152&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=6HEeQtHYP1&p=https%3A//www.heatbud.com&dtd=117
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3339
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Fri, 23 Sep 2022 10:11:29 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3F80 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6ffea916206a419bd12b20e2e70adebb408430749d39970700052df73bd57e82

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/ 149 KB
53 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209080101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f70a7c1ea2073559d52ecdc93c5e48bbed7ec17f4db14cf9e29d9744f7a534be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54578
x-xss-protection: 0
server: cafe
etag: 7470606696854604115
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 23 Sep 2022 11:07:08 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6B2C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
18 B

32ms
32ms

Document
text/html

2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 11:07:08 GMT
expires: Fri, 23 Sep 2022 11:07:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 23 Sep 2022 11:07:08 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js Show response
pagead2.googlesyndication.com/bg/ Frame 796C 36 KB
16 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

122285db9f84c3c42757d585b75701d549325f150e0d65701389a6a6bfa3a25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15943
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Sep 2023 11:07:07 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 59ms
26ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.heatbud.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 23 Sep 2022 11:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 57ms
25ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.heatbud.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 23 Sep 2022 11:07:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/ Frame DE46 10 KB
4 KB 16ms
15ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 32314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 02:08:34 GMT
etag: 9671129459699598864
expires: Fri, 07 Oct 2022 02:08:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/ Frame 81B9 10 KB
4 KB 17ms
16ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 32314
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 02:08:34 GMT
etag: 9671129459699598864
expires: Fri, 07 Oct 2022 02:08:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame DE46 4 KB
636 B 25ms
24ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 23 Sep 2022 09:59:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 23 Sep 2022 11:07:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Sep 2022 11:07:08 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame DE46 205 B
741 B 54ms
15ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:02:46 GMT
x-content-type-options: nosniff
age: 262
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 23 Sep 2023 11:02:46 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame DE46 604 B
694 B 54ms
16ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 10:36:14 GMT
x-content-type-options: nosniff
age: 1854
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 23 Sep 2023 10:36:14 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/elements/html/ Frame DE46 19 KB
8 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

650b0d89118580fd96419aa8b05d77a9f8bb927f41c848fe784e15134affb9af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 10:54:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 731
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8220
x-xss-protection: 0
server: cafe
etag: 2919620596669342719
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 10:54:57 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 81B9 0
0 67ms
67ms Fetch
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CMPgCW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE7wFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfgSFXwCqf9H0sN0qLyoCqYuYB1KtD00ZiMY8RN_ioikVFKxhJwFdsAEh4u1tIsEkgUECAQYAZIFBAgFGASgBhGAB7f1l3moB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDh4wfSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTCtAVAZgWAYAXAbIXHAoaCAASFHB1Yi0zMzQ0ODk3MTc3NTgzNDM5GAA&sigh=EUrH3IgVxXQ&uach_m=[UACH]&cid=CAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 23 Sep 2022 11:07:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ar Show response
www.ebayadservices.com/marketingtracking/v1/ Frame 8936 14 KB
14 KB 525ms
189ms Document
text/html 209.140.129.66
EBAY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-166314-871238-2&mkcid=4&mkevt=2&mpt=522720348&gdpr=&gdpr_consent=&campaignid={campaignid}&gclid={gclid}&siteid=77&icep_siteid=77&ipn=admain2&adtype=2&size=728x90&pgroup=560283&mpvc=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%26num%3D1%26cid%3DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%26sig%3DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%26client%3Dca-pub-3344897177583439%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

209.140.129.66 , United States, ASN11643 (EBAY, US),

Reverse DNS

rover-public-slcaz01-1-1.ebay.com

Software

ebay-proxy-server /

Resource Hash

d97ebf0edded1557b04fbc43254f59560d01e17285d967ee062ecb9a2094f4cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-ua-full-version
cache-control: private, no-cache
content-length: 14200
content-type: text/html;charset=UTF-8
date: Fri, 23 Sep 2022 11:07:08 GMT
pragma: no-cache
rlogid: t6baubqsodf%3F%3Cumjgcp%60tqjfc*n%7F4%60i%28rbpv6713-1836a07a30c-0x2352
server: ebay-proxy-server
strict-transport-security: max-age=31536000
x-envoy-upstream-service-time: 28

GET
H3 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 81B9 34 KB
14 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/m_js_controller_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b90e13ebc85d7fd3dc0e2665b491ad10fc544cf8bc57f76ed39459c0e02f2b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:02:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14190
x-xss-protection: 0
server: cafe
etag: 337214682915004451
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 11:02:53 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 81B9 3 KB
1 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 11:01:06 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 81B9 17 KB
7 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c39e9db358e5d8045bebf902ed71b49c17d66f175c8ce0dcaeec96ec7d09090b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 10:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2590
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7553
x-xss-protection: 0
server: cafe
etag: 15375136450269253166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 10:23:58 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 81B9 140 KB
44 KB 1120ms
1084ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d862ec0d2b72e9f1575615db28f4196cbf0f586adb2208c605c691d6e06ee6ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44525
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1663760195623328"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Sep 2022 11:07:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/ Frame 81B9 23 KB
9 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d485f54c3ae5920cd21c8d180458c50f092554777b97f9c52ac6f76359838a05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 09:50:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9559
x-xss-protection: 0
server: cafe
etag: 12142024561622733046
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 09:50:16 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 61B3 5 KB
667 B 24ms
24ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f1535199f71b96d423d3f991a5a0a92ca5779e74d2e23a509b5022ef347129a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 23 Sep 2022 09:59:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 23 Sep 2022 11:07:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 23 Sep 2022 11:07:08 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 61B3 2 KB
902 B 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 10:58:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 538
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 10:58:10 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/ Frame 61B3 23 KB
9 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d485f54c3ae5920cd21c8d180458c50f092554777b97f9c52ac6f76359838a05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 09:50:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9559
x-xss-protection: 0
server: cafe
etag: 12142024561622733046
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 09:50:16 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 61B3 3 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:01:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 362
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 11:01:06 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/ Frame 61B3 17 KB
7 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220921/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c39e9db358e5d8045bebf902ed71b49c17d66f175c8ce0dcaeec96ec7d09090b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 10:23:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2590
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7553
x-xss-protection: 0
server: cafe
etag: 15375136450269253166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 07 Oct 2022 10:23:58 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 61B3 140 KB
44 KB 1098ms
1097ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d862ec0d2b72e9f1575615db28f4196cbf0f586adb2208c605c691d6e06ee6ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44525
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1663760195623328"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Sep 2022 11:07:09 GMT

GET
H2 200 b6810b6596f7ed55ed76c68d0358aca1.js Show response
www.gstatic.com/mysidia/ Frame 61B3 33 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b6810b6596f7ed55ed76c68d0358aca1.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6480171803c66741b9d13c44e06e9817bb8f51479574044d5226cb2dc28a897

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13684
x-xss-protection: 0
last-modified: Wed, 21 Sep 2022 21:38:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 22 Dec 2022 11:02:34 GMT

GET
DATA 200
OK truncated
/ Frame 81B9 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4878563f9e1719453a1e8e51080c43f81f19dc1a748620ad6528b99d6fb3c4d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 metrics.js Show response
metrics.nt.vc/ Frame 8936 57 KB
23 KB 117ms
48ms Script
application/javascript 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Requested by: Host: www.ebayadservices.com
URL: https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-166314-871238-2&mkcid=4&mkevt=2&mpt=522720348&gdpr=&gdpr_consent=&campaignid={campaignid}&gclid={gclid}&siteid=77&icep_siteid=77&ipn=admain2&adtype=2&size=728x90&pgroup=560283&mpvc=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%26num%3D1%26cid%3DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%26sig%3DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%26client%3Dca-pub-3344897177583439%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d736a9ab548c380016f6f053e1d06eed64870b3f452ce206f75747f7b5c5be07

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 74f2d0a61e34927f-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-type: application/javascript

GET
H2 200 index.html Show response
secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/ Frame 1E86 4 KB
2 KB 144ms
31ms Document
text/html 92.123.38.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0

Requested by

Host: www.ebayadservices.com
URL: https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-166314-871238-2&mkcid=4&mkevt=2&mpt=522720348&gdpr=&gdpr_consent=&campaignid={campaignid}&gclid={gclid}&siteid=77&icep_siteid=77&ipn=admain2&adtype=2&size=728x90&pgroup=560283&mpvc=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%26num%3D1%26cid%3DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%26sig%3DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%26client%3Dca-pub-3344897177583439%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

92.123.38.91 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-38-91.deploy.static.akamaitechnologies.com

Software

ebay server /

Resource Hash

7d7ab07e3d133e66c4b39c6e78f6f32ed29814963f42f914804b182028355e79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.ebayadservices.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
akamai-grn: 0.47611702.1663931229.47add5b2
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
content-length: 1791
content-type: text/html
date: Fri, 23 Sep 2022 11:07:09 GMT
expires: Sat, 23 Sep 2023 11:07:09 GMT
rlogid: t6q%60uebwh%3D9vjdq%60uebwh*%3A7qws%28rbpv6775-1833b65f1b8-0xde
server: ebay server
strict-transport-security: max-age=31536000
suppress-x-frame-options: true
vary: Accept-Encoding
x-cache-lookup: MISS from include-cache-4:80
x-cdn: AKAMAI
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 8936 0
0 233ms
58ms Image
text/html 2a02:26f0:3500:590::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=10243381&siteID=51242&creativeID=131316&placementID=560283&rnd=6815462313744208&redir=https://secure.insightexpressai.com/adserver/1pixel.gif
Requested by: Host: www.ebayadservices.com
URL: https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-166314-871238-2&mkcid=4&mkevt=2&mpt=522720348&gdpr=&gdpr_consent=&campaignid={campaignid}&gclid={gclid}&siteid=77&icep_siteid=77&ipn=admain2&adtype=2&size=728x90&pgroup=560283&mpvc=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%26num%3D1%26cid%3DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%26sig%3DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%26client%3Dca-pub-3344897177583439%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:590::1ec4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

POST
H3 200 _.7071663148712382.131316;csd=null;cst=0;pd=googleads.g.doubleclick.net;pp=%252F;sz=728x90;if=100;lt=670;al=1;av=C1;nd=500;mv=28;ii=6815462313744208;el=49;
metrics.nt.vc/event/l/77/ Frame 8936 43 B
223 B 100ms
66ms Ping
image/gif 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/event/l/77/_.7071663148712382.131316;csd=null;cst=0;pd=googleads.g.doubleclick.net;pp=%252F;sz=728x90;if=100;lt=670;al=1;av=C1;nd=500;mv=28;ii=6815462313744208;el=49;
Requested by: Host: metrics.nt.vc
URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
access-control-allow-origin: : https://www.ebayadservices.com, https://www.ebayadservices.com
cf-ray: 74f2d0a6fd81bb73-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43

POST
H3 200 _.7071663148712382.131316;dpd=g%25253D410112-0-1%252526n%25253D%252526model_id%25253D1%252526;ii=6815462313744208;el=49;
metrics.nt.vc/event/d/77/ Frame 8936 43 B
257 B 93ms
60ms Ping
image/gif 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/event/d/77/_.7071663148712382.131316;dpd=g%25253D410112-0-1%252526n%25253D%252526model_id%25253D1%252526;ii=6815462313744208;el=49;
Requested by: Host: metrics.nt.vc
URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
access-control-allow-origin: https://www.ebayadservices.com, https://www.ebayadservices.com
cf-ray: 74f2d0a6fd84bb73-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43

GET
DATA 200
OK truncated
/ Frame 8936 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 createjs.min.js Show response
secureir.ebaystatic.com/cr/mscdn/8c75c7aa0444d01db83c924e9cffcee0/ Frame 1E86 236 KB
63 KB 34ms
33ms Script
application/x-javascript 92.123.38.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://secureir.ebaystatic.com/cr/mscdn/8c75c7aa0444d01db83c924e9cffcee0/createjs.min.js

Requested by

Host: secureir.ebaystatic.com
URL: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

92.123.38.91 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-38-91.deploy.static.akamaitechnologies.com

Software

ebay server /

Resource Hash

e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 73, 73, 93, 73
suppress-x-frame-options: true
content-encoding: gzip
x-content-type-options: nosniff
x-cache-lookup: MISS from include-cache-1:80
x-cdn: AKAMAI, AKAMAI
akamai-grn: , 0.0733ca17.1661552320.13b15d37, , 0.47611702.1663931229.47add673
x-edgeconnect-midmile-rtt: 0, 0, 0, 0
vary: Accept-Encoding
content-length: 63926
x-xss-protection: 1; mode=block
last-modified: Thu, 01 Jan 1970 00:00:01 GMT
server: ebay server
date: Fri, 23 Sep 2022 11:07:09 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
access-control-allow-credentials: true
rlogid: t6q%60uebwh%3D9whhq%60uebwh*ih%3Fto%28rbpv6710-182dc3c5ffc-0xcd
access-control-allow-headers: *
expires: Sat, 23 Sep 2023 11:07:09 GMT

GET
H2 200 javascript.js Show response
secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/ Frame 1E86 47 KB
8 KB 76ms
75ms Script
application/x-javascript 92.123.38.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/javascript.js?1663060681506

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

92.123.38.91 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-38-91.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

acb93136314655be58b4d24a30d903721ae25f69c675ba4265d69b8f7c56f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 675, 675
suppress-x-frame-options: true
content-encoding: br
x-content-type-options: nosniff
x-cache-lookup: HIT from include-cache-0:80
x-cdn: AKAMAI, AKAMAI
akamai-grn: 0.af346868.1663154119.48108de1, , , , , , 0.47611702.1663931229.47add693
x-edgeconnect-midmile-rtt: 9, 127
content-length: 7581
x-xss-protection: 1; mode=block
last-modified: Wed, 14 Sep 2022 11:15:20 GMT
server: Akamai Resource Optimizer
date: Fri, 23 Sep 2022 11:07:09 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
access-control-allow-credentials: true
rlogid: t6q%60uebwh%3D9iptq%60uebwh*g1%7C%7Dw%28rbpv670%3D-1833bb5e4c6-0xd0
access-control-allow-headers: *
expires: Sat, 23 Sep 2023 11:07:09 GMT

GET
H2 200 ffm.js Show response
secureir.ebaystatic.com/cr/mscdn/6277d85adc230fe8a17eb6e58859b42b/ Frame 1E86 23 KB
7 KB 76ms
76ms Script
application/x-javascript 92.123.38.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://secureir.ebaystatic.com/cr/mscdn/6277d85adc230fe8a17eb6e58859b42b/ffm.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

92.123.38.91 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-38-91.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

8a792b187d7974f43960fbdb8b4fb5af8641920f8df59c07ee17e8377578ec41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0
Origin: https://secureir.ebaystatic.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 148, 148, 148
suppress-x-frame-options: true
content-encoding: br
x-content-type-options: nosniff
x-cache-lookup: HIT from include-cache-4:80
x-cdn: AKAMAI, AKAMAI
akamai-grn: 0.451d1002.1661552390.1f4199bf, , , , 0.47611702.1663931229.47add6b9
x-edgeconnect-midmile-rtt: 0, 0, 10
content-length: 6840
x-xss-protection: 1; mode=block
last-modified: Fri, 26 Aug 2022 22:19:51 GMT
server: Akamai Resource Optimizer
date: Fri, 23 Sep 2022 11:07:09 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
access-control-allow-credentials: true
rlogid: t6q%60uebwh%3D9whhq%60uebwh*yb%7Epu%28rbpv6710-182dc3d715a-0xca
access-control-allow-headers: *
expires: Sat, 23 Sep 2023 11:07:09 GMT

POST
H3 200 _.7071663148712382.131316;suet=frd;f_ssx=1600;f_ssy=1200;f_wsx=1600;f_wsy=1200;f_wpx=0;f_wpy=0;f_uam=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F53...
metrics.nt.vc/event/e/77/ Frame 8936 43 B
221 B 64ms
61ms Ping
image/gif 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/event/e/77/_.7071663148712382.131316;suet=frd;f_ssx=1600;f_ssy=1200;f_wsx=1600;f_wsy=1200;f_wpx=0;f_wpy=0;f_uam=Mozilla%252F5.0%2520(Windows%2520NT%252010.0%253B%2520Win64%253B%2520x64)%2520AppleWebKit%252F537.36%2520(KHTML%252C%2520like%2520Gecko)%2520Chrome%252F105.0.5195.125%2520Safari%252F537.36;f_dd=1;f_tan=-1.4214488238747245;f_hc=4;f_bem=1*11000010;f_sax=1600;f_say=1200;f_sat=0;f_sal=0;f_lng=en-US;f_lngs=en-US%252Cen;f_tm=0;f_bo=0;f_ild=1;f_if=1*111111-1000101010111011111100;ii=6815462313744208;el=80;
Requested by: Host: metrics.nt.vc
URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
access-control-allow-origin: https://www.ebayadservices.com, https://www.ebayadservices.com
cf-ray: 74f2d0a6fd7dbb73-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43

POST
H3 200 _.7071663148712382.131316;suet=crld;ii=6815462313744208;el=153;
metrics.nt.vc/event/e/77/ Frame 8936 43 B
221 B 54ms
54ms Ping
image/gif 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/event/e/77/_.7071663148712382.131316;suet=crld;ii=6815462313744208;el=153;
Requested by: Host: metrics.nt.vc
URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
access-control-allow-origin: https://www.ebayadservices.com, https://www.ebayadservices.com
cf-ray: 74f2d0a76e56bb73-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43

GET
H2 200 logo.png
secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/ Frame 1E86 3 KB
3 KB 40ms
39ms Image
image/png 92.123.38.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/logo.png?1663060681496

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

92.123.38.91 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-38-91.deploy.static.akamaitechnologies.com

Software

ebay server /

Resource Hash

610279082cab4d0263e7887cadd4f8fc432df65a8e9d1e56a2a20105811ad807

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

suppress-x-frame-options: true
content-encoding: gzip
x-content-type-options: nosniff
x-cache-lookup: MISS from include-cache-0:80
x-cdn: AKAMAI
akamai-grn: , , , , 0.47611702.1663931229.47add788
vary: Accept-Encoding
content-length: 2948
x-xss-protection: 1; mode=block
server: ebay server
date: Fri, 23 Sep 2022 11:07:09 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
access-control-allow-credentials: true
rlogid: t6q%60uebwh%3D9vjdq%60uebwh*%7B1%3Fmy%28rbpv6775-183407ea624-0xd8
access-control-allow-headers: *
expires: Sat, 23 Sep 2023 11:07:09 GMT

GET
H2 200 visual.jpg
secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/ Frame 1E86 34 KB
34 KB 30ms
30ms Image
image/jpeg 92.123.38.91
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/visual.jpg?1663060681496

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220921/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

92.123.38.91 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-38-91.deploy.static.akamaitechnologies.com

Software

ebay server /

Resource Hash

4b477d7547e842d19c8d44615823e3dc6411d7d9fe0731e3bc5127453c190a77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://secureir.ebaystatic.com/cr/mscdn/336b409a7ae9f000bed016b7e6b3d866/index.html?mpck=svcs.ebay.com%2Fdelstats%2Femail%2Flocation%3Fuser-id%3D43188348269%26ch%3D4%26ci%3D-1%26mobtrkcd%3D%26si%3D77%26et%3Dadclick%26loc%3Dhttps%2525253A%2525252F%2525252Frover.ebay.com%2525252Frover%2525252F1%2525252F707-166314-871238-2%2525252F4%2525253Fmpt%2525253D14828%25252526ff5%2525253D%25252526ff6%2525253D%25252526ff7%2525253D%25252526ff8%2525253D%25252526ff9%2525253D%25252526ff19%2525253D%25252526ext_id%2525253D%25252526ir_DAP_A1%2525253D0%25252526siteid%2525253D77%25252526ff10%2525253D131316%25252526ipn%2525253Dadmain2%25252526ff13%2525253D1%25252526ff14%2525253Dunknown%25252526ff20%2525253D0%25252526%26ff14%3Dunknown%26ff20%3D0%26mpcr%3D131316%26rvr_id%3D6815462313744208&mpt=&mpcr=131316&crdata=&imp_rvr_id=6815462313744208&siteID=77&mpcrgif=&mpvc=https%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253Dl%2526ai%253DC55PiW5MtY4jVLcXgxgPnvrWICq-Kt8Vspviv3KIQz_fdmLoBEAEg78r2IWCV4pCCoAegAZbGm_4DyAEJqQKxv2Bf_mWwPqgDAaoE8gFP0HcuZxU4EZsPH5RxrqMd_NywBe7u4ZyxhA5B0qovpZ_tDUheCEA8COSDUCw972J_cyAktxz0SwQV-rpTDTfBw9jOmEdjgRw7AVBTNRFfS8LnLUcb52kbldkJmDM3GPdJbwXgPq-tySghjtdwNNaRi30AJlsBrnC9eyrgiNKDSNZnIHiV9WTirZZ5-llE9dmuzq3FHXV4B2yUPGN_1VivcgU8ZT_SyQE0dp6MOKIUf4m5_lOssZNvnC13MRcHdoPZvv3xFJlwzfhQF12QNnaU13CnuyBkMQPKCz9AbzcafqiZJSjaZDiMeEosKFcAxciFlsAEh4u1tIsEoAYRgAe39Zd5qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIEQiA4YAQEAEYHzICqgI6AoBAgAoBmAsByAsBgAwBuAwB2BMK0BUBmBYB-BYBgBcB%2526num%253D1%2526cid%253DCAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4%2526sig%253DAOD64_33-T7IVqgkj9icDOXEvd3dAlot8Q%2526client%253Dca-pub-3344897177583439%2526adurl%253D&rvr_chocolate=true&rvr_ckquery=norover%3D1%26mkevt%3D1%26mkcid%3D4%26mkrid%3D707-166314-871238-2%26mpt%3D14828%26ff5%3D%26ff6%3D%26ff7%3D%26ff8%3D%26ff9%3D%26ff19%3D%26ext_id%3D%26ir_DAP_A1%3D0%26gclid%3D%7Bgclid%7D&mpvcget=0&mpvcredir=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

suppress-x-frame-options: true
content-encoding: gzip
x-content-type-options: nosniff
x-cache-lookup: MISS from include-cache-3:80
x-cdn: AKAMAI
akamai-grn: , , , 0.47611702.1663931229.47add7ef
vary: Accept-Encoding
content-length: 33900
x-xss-protection: 1; mode=block
server: ebay server
date: Fri, 23 Sep 2022 11:07:09 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
access-control-allow-credentials: true
rlogid: t6q%60uebwh%3D9whhq%60uebwh*yb%7Epu%28rbpv6710-183407ea733-0xcf
access-control-allow-headers: *
expires: Sat, 23 Sep 2023 11:07:09 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 105ms
71ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220921&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8d308e0dbb230630bc7d896910158b9bd5ebeae66261f266986da399db145df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 23 Sep 2022 11:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11244
x-xss-protection: 0

GET
H3 200 EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js Show response
pagead2.googlesyndication.com/bg/ Frame FE19 36 KB
16 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js

Requested by

Host: www.heatbud.com
URL: https://www.heatbud.com/valag76785

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

122285db9f84c3c42757d585b75701d549325f150e0d65701389a6a6bfa3a25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15943
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Sep 2023 11:07:07 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 23 Sep 2022 11:07:09 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 69EE 13 KB
5 KB 17ms
15ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 898
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 10:52:11 GMT
expires: Sat, 23 Sep 2023 10:52:11 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B8AC 783 B
535 B 60ms
25ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2668dcf98ff7a20b4897ba5b1b6e77cd2e92667814c93d734055940a87560e03

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ORUH6PeTk0PmRfgAly0ftQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.heatbud.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-ORUH6PeTk0PmRfgAly0ftQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 23 Sep 2022 11:07:09 GMT
expires: Fri, 23 Sep 2022 11:07:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js Show response
pagead2.googlesyndication.com/bg/ Frame 69EE 36 KB
16 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/EiKF25-Ew8QnV9WFt1cB1UkyXxUODWVwE4mmpr-jolo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

122285db9f84c3c42757d585b75701d549325f150e0d65701389a6a6bfa3a25a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15943
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Sep 2023 11:07:07 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B8AC 0
0 49ms
49ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220921&jk=446441447353290&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 69EE 0
10 B 16ms
15ms Image
text/plain 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?o0AHAw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3 200 _.7071663148712382.131316;pd=googleads.g.doubleclick.net;pp=%252F;sz=728x90;if=100;lt=670;al=1;av=C1;nd=500;mv=28;v1f=400;v1e=597;v7=480;v6=517;vin=1;vbiv=01000000000010;vbin=01000000000010;ii=6815...
metrics.nt.vc/event/v/77/ Frame 8936 43 B
221 B 32ms
32ms Ping
image/gif 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/event/v/77/_.7071663148712382.131316;pd=googleads.g.doubleclick.net;pp=%252F;sz=728x90;if=100;lt=670;al=1;av=C1;nd=500;mv=28;v1f=400;v1e=597;v7=480;v6=517;vin=1;vbiv=01000000000010;vbin=01000000000010;ii=6815462313744208;el=1049;
Requested by: Host: metrics.nt.vc
URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:10 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
access-control-allow-origin: https://www.ebayadservices.com, https://www.ebayadservices.com
cf-ray: 74f2d0acfabfbb73-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 54ms
52ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220921&jk=446441447353290&bg=!zM-lz4vNAAYIxsuQKMY7ACkAdvg8WhC0UUgvS9k2IRrdD5qwxSRExyo0acVFX6Qs95kXtslT_WuRwAIAAABuUgAAAAFoAQcKAD-bsO4cvX5IRz1gPi3-HZEhXSDEuIo-7c563tm3aNwnTMtkByEPWKSrJiBVf_HxZdmOwAzjEv4Qo5u2HtBkZt6ZAqGBnOzqweJU4oGHODVSjq2t1BZzdxMFTIjGQKHdoLt8iGQtAwcIwCaBcq_mIyUaybcKTTii55BgSmwvomCKtLfhMlgF6_0X_JV2Wb7YfPjMSTA_3FqEEkMvR_-8jc7K8nZ3ch92qohNf5sXqkzH8Z8ROWh_lvwLFjcR-Kt7Zfu4C3SOaQ_ev0ue0EMIqqtybj96_6zqvXeOKKNc1aTPItvUC_anC4ML2VRmvYw-udbQFPS-NFprG-HWNk8QYg5cZ6HTu0LbrkQxkaEMdqtjYR1kGd0KtJPdrmgNtzGD26AScaImZIBq8ePnzchBzc7X3Fr_zbAqNjlGJz-zzrf0FUmq34rEEvTUI-3xSiTO9C5hbb4WR6_jZbu3AUH2Vay9An_HJYwus64kqCG317mwxGm3QM8SmUfqgnEU99rU1-Ahnad7Tw50TSq1sCpZrnZLaMzm1S3_oGxlv3_FmkAB3GCWQALfUlc1NtTcldFoRZkePwzf6uQDSArRhZrx_V0blYxEKRxVGA51AIflC4SQzrZu6j90Xqf_5_8ul6GK6HtxVTjqqV_R1L2kGtyumwMPXe0ZoDF8amUYsynq_pg_1qlH3aDVXyHReJ3D0oND22ingyLo4GZRJaLBwHv8ICi5oi-yF5oGpHJ7LUjKeEHEuPeNyINYTDHQVlzTnl3pxU9SDR8d3tyrToevrmklZwypIUOsoy3_g9kJq3TOuBU9GmE58vblFg1vza6_EIwYHtVxwAq9NgtLJcoEvCt7ZwWgKm40U7YRWqI_O2g0bgM_TjWam0h1JnJ56Bgfh2lIfX9in1rqzbd3Ug0BM5o0chpHaAw6VgW2gmLUh43r-sS_EDqIISJEbN54gpmq-iFnKG3j3RT-N4IKnt0abWC1ugEtaVxf
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.heatbud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 81B9 42 B
64 B 52ms
51ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssVAGUxyixlh2tJXqrDx-wH19rKXf6mmjBguxLmmFXjSlM1J4Sf3St3Pz8Vw3jiAFD0-SzD4fr-5nD9whJTVMQX7NPJaYIbqmlPWho8yB-ZSuerkWpeul4oy18XRh3LXTM0WLM1KQ&sai=AMfl-YQn9bbAvO9p7dnFvJem44546RzCOflf8YdSPiigVtd77pBxy1XlWXwCvG_fdlbw16Z75k0UJhpfp2Ah&sig=Cg0ArKJSzI0FxdDuMadvEAE&cid=CAQSGwCsnQUxYGgNF2oTKSL1Ni857NPjT0xUxiBn9BgBIA4&id=lidar2&mcvt=1000&p=-1,1,123.265625,1006&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220921&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1663931228479&rpt=1184&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 23 Sep 2022 11:07:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 _.7071663148712382.131316;pd=googleads.g.doubleclick.net;pp=%252F;sz=728x90;if=100;lt=670;al=1;av=C1;nd=500;mv=28;v1f=1959;v7=1959;vin=2;vbiv=01000000000010;vbin=02000000000020;ii=6815462313744208;...
metrics.nt.vc/event/v/77/ Frame 8936 43 B
223 B 45ms
44ms Ping
image/gif 2606:4700:10::6816:6ac
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://metrics.nt.vc/event/v/77/_.7071663148712382.131316;pd=googleads.g.doubleclick.net;pp=%252F;sz=728x90;if=100;lt=670;al=1;av=C1;nd=500;mv=28;v1f=1959;v7=1959;vin=2;vbiv=01000000000010;vbin=02000000000020;ii=6815462313744208;el=3050;
Requested by: Host: metrics.nt.vc
URL: https://metrics.nt.vc/metrics.js?ii=6815462313744208&cn=rvrcnt6815462313744208&sz=728x90&cl=77&ee=&es=&dfp=0&ed=&eu=&ep=&est=&ec=&pl=7071663148712382&cr=131316&hu=&cg=&maid=&df=1&dapc=model_id,n,g&dapb=0&cgs=uvscg&iat=1663931229049&ev=iluvchdseaj&vic=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:6ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.ebayadservices.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

date: Fri, 23 Sep 2022 11:07:12 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: image/gif
access-control-allow-origin: : https://www.ebayadservices.com, https://www.ebayadservices.com
cf-ray: 74f2d0b98e4dbb73-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43

Verdicts & Comments Add Verdict or Comment

111 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.ebayadservices.com/marketingtracking/v1	1970-01-20 08:21:47	Name: adguid Value: 5d6cc826ae244ac288d65a6fa8ca2b09
www.heatbud.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 7E7192AB3009E9DAEC1416DC762B5223
.heatbud.com/	1970-01-20 15:48:11	Name: _ga Value: GA1.2.186807094.1663931228
.heatbud.com/	1970-01-20 06:13:37	Name: _gid Value: GA1.2.545047468.1663931228
.heatbud.com/	1970-01-20 06:12:11	Name: _gat_UA-48436913-1 Value: 1
.heatbud.com/	1970-01-20 15:33:47	Name: __gads Value: ID=ef0e4ab873140727-2268391f4ad70086:T=1663931227:RT=1663931227:S=ALNI_MYUf1OUNwghPnzEpiwhiNssVU7rug
.doubleclick.net/	1970-01-20 15:33:47	Name: IDE Value: AHWqTUnHbIiASC_mUVrSyrauCj9LTyFBgNLCB2hlgYRUxH56XdfXMXzc2PgU3tQEoBc
.doubleclick.net/	1970-01-20 06:12:14	Name: DSID Value: NO_DATA
.insightexpressai.com/	1970-01-20 07:54:51	Name: TID Value: 00000000-0000-0022-298a-b91663931229
.insightexpressai.com/	1970-01-20 07:54:51	Name: DW Value: 00000000-0000-0022-298a-b91663931229
.insightexpressai.com/	1970-01-20 07:54:51	Name: DW_Time Value: 1663931229

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ajax.googleapis.com
buttons-config.sharethis.com
count-server.sharethis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
l.sharethis.com
metrics.nt.vc
pagead2.googlesyndication.com
partner.googleadservices.com
platform-api.sharethis.com
platform-cdn.sharethis.com
secure.insightexpressai.com
secureir.ebaystatic.com
tpc.googlesyndication.com
www.ebayadservices.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.heatbud.com
13.32.121.95
13.32.99.78
18.196.212.55
209.140.129.66
2600:9000:206e:9800:c:abe:f440:93a1
2600:9000:2156:3c00:1d:85c3:6640:93a1
2606:4700:10::6816:6ac
2a00:1450:4001:800::2003
2a00:1450:4001:806::2002
2a00:1450:4001:806::2008
2a00:1450:4001:80b::2002
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2001
2a00:1450:4001:811::2004
2a00:1450:4001:813::2002
2a00:1450:4001:813::200a
2a00:1450:4001:829::2002
2a00:1450:4001:829::2003
2a00:1450:4001:829::200a
2a00:1450:4001:82f::2002
2a02:26f0:3500:590::1ec4
44.224.156.148
92.123.38.91
0b33a4f5d5ffde5c10183148afa22dc1e11a36286ae2eefec04fb646be388dda
122285db9f84c3c42757d585b75701d549325f150e0d65701389a6a6bfa3a25a
12942e23b47319bc5eb290ab03aa490d10166cf91f01c70e66f2ecede33e0b56
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19deef89d86a2e8ea114da378250890253a6a3be22dc53f4d5e16f96d98e583e
24d4e0f8cafec6ed8ec300da07a616dfc212854c1739678979c55021d04b5b5c
2668dcf98ff7a20b4897ba5b1b6e77cd2e92667814c93d734055940a87560e03
2d45b3eb68f70907d3780983cc56becd3c3101deea78943f0191e1031d8ae514
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
34586a8b3f0d9723be13ff897264acaa4a59c45912cd33313d273687af2c4f24
357b43b23a327e02e7e5a8987441641f43e57caec9516a77c0516e4c7d3e6030
3a0df9a49ee15729b2eb0c887c490a23b7e54b3cd41b3bb516d607f43e14001e
4304c5b4d05266100cb5b3671a5caa41a9d0eec02af52fa14e3e01136b0cf91e
4878563f9e1719453a1e8e51080c43f81f19dc1a748620ad6528b99d6fb3c4d2
4884fec2c73aa52a2461073c1b87d1ceb80f400520391b43f97ca7d3c39eeb24
48abbbb87d8a3a1f97940449fd42b27a75079b449e844fad811e1231cdc57836
4b477d7547e842d19c8d44615823e3dc6411d7d9fe0731e3bc5127453c190a77
4b90e13ebc85d7fd3dc0e2665b491ad10fc544cf8bc57f76ed39459c0e02f2b8
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
610279082cab4d0263e7887cadd4f8fc432df65a8e9d1e56a2a20105811ad807
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
650b0d89118580fd96419aa8b05d77a9f8bb927f41c848fe784e15134affb9af
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ffea916206a419bd12b20e2e70adebb408430749d39970700052df73bd57e82
700ad5e597681fb45dfc74f05206ad9c2229a6c710c45b413842ddfe03ce4d50
74541c7ce0756e2bb064899630af95b77f90fce37c4a70a13b5df509b8988859
7d7ab07e3d133e66c4b39c6e78f6f32ed29814963f42f914804b182028355e79
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
852942cd647c48a81ed1918477cae3dc3d5a8a64ddb5fb791cee2d2ef8f46722
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
8a792b187d7974f43960fbdb8b4fb5af8641920f8df59c07ee17e8377578ec41
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
970e36889d6a47606de3b219bb778668cbba78c1dd060d5309eccd1512b5f569
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
a046289a29195690b7aec507f3bc7ce55bf243c578c018165aee5999fe19188b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
acb93136314655be58b4d24a30d903721ae25f69c675ba4265d69b8f7c56f277
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b34551ae25916c460423b82beb8e0675b27f76a9a2908f18286260fbd6de6681
b8d308e0dbb230630bc7d896910158b9bd5ebeae66261f266986da399db145df
bc8e5789225325fd3ea6b4f4e05c0f8fb8430a98b4b6cb47e9bf026736551491
bdfe50cf48f3ea22cf9cb7b8d6089a205f99ab66071c751a367f697cbcd1e8a9
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c39e9db358e5d8045bebf902ed71b49c17d66f175c8ce0dcaeec96ec7d09090b
c795d45bb067d9aaebb392cfca2f10a84680b6cccfadf9b6f44ab25c248f06fc
c93293804abb59b6c4bb2686399126752ed627283ba13a30d8a0d74d6762f5f5
d485f54c3ae5920cd21c8d180458c50f092554777b97f9c52ac6f76359838a05
d736a9ab548c380016f6f053e1d06eed64870b3f452ce206f75747f7b5c5be07
d862ec0d2b72e9f1575615db28f4196cbf0f586adb2208c605c691d6e06ee6ed
d97ebf0edded1557b04fbc43254f59560d01e17285d967ee062ecb9a2094f4cd
db4dfa1f2cbb7c5879dcdc583ef8ad451bb44552f28f2454659d714fabb9d2bb
e0eef53bf9432ab73a90915259db28009669de54a461723720876b777f8051f7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e6480171803c66741b9d13c44e06e9817bb8f51479574044d5226cb2dc28a897
ebfce0994985bca52727650d284edcfbf6fa653193f347c2f23cc466be11d6d8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1535199f71b96d423d3f991a5a0a92ca5779e74d2e23a509b5022ef347129a2
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f70a7c1ea2073559d52ecdc93c5e48bbed7ec17f4db14cf9e29d9744f7a534be
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f84baffc2306cfe2673a1193c83ab6fa13e55a181c8f2a0353d064ab1de30f48

www.heatbud.com Open in urlscan Pro 44.224.156.148 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

94 Requests

100 %HTTPS

74 %IPv6

16 Domains

24 Subdomains

24 IPs

3 Countries

1326 kBTransfer

3081 kBSize

11 Cookies

1 Outgoing links

Redirected requests

94 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.heatbud.com Open in urlscan Pro
44.224.156.148 Public Scan

Screenshot
Live screenshot

Full Image

94
Requests

100 %
HTTPS

74 %
IPv6

16
Domains

24
Subdomains

24
IPs

3
Countries

1326 kB
Transfer

3081 kB
Size

11
Cookies

94 HTTP transactions
3 data transactions