www.buzzfond.com Open in urlscan Pro
104.16.113.65 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://paid.outbrain.com/network/redir?p=TV-jqloioZ5gh9rbmhG_8hGi5SyowVGcgT7q1Mmv265XX_AdtaTi1qblawwXfIyYngF44vH7uQl7Ufin...
Effective URL:
https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campai...
Submission: On May 26 via api (May 26th 2022, 3:12:56 am UTC) from US — Scanned from DE

Summary HTTP 226 Redirects Behaviour Indicators

Summary

This website contacted 35 IPs in 8 countries across 27 domains to perform 226 HTTP transactions. The main IP is 104.16.113.65, located in and belongs to CLOUDFLARENET, US. The main domain is www.buzzfond.com. The Cisco Umbrella rank of the primary domain is 786793.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 16th 2021. Valid for: a year.

This is the only time www.buzzfond.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.14.132 151.101.14.132	54113 (FASTLY) (FASTLY)
17	104.16.113.65 104.16.113.65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
24	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
5	151.101.129.44 151.101.129.44	54113 (FASTLY) (FASTLY)
34	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
1	104.90.180.98 104.90.180.98	16625 (AKAMAI-AS) (AKAMAI-AS)
1	70.42.32.159 70.42.32.159	13789 (INTERNAP-...) (INTERNAP-BLK3)
5	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
52	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
3 7	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638:1::4 2a02:2638:1::4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
7	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	178.250.2.148 178.250.2.148	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3 15	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
4 6	23.35.236.247 23.35.236.247	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	37.252.173.27 37.252.173.27	29990 (ASN-APPNEX) (ASN-APPNEX)
2	88.99.165.19 88.99.165.19	24940 (HETZNER-AS) (HETZNER-AS)
15	178.250.0.139 178.250.0.139	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.2.150 178.250.2.150	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 4	138.201.63.165 138.201.63.165	24940 (HETZNER-AS) (HETZNER-AS)
1 2	2620:116:800d... 2620:116:800d:21:c5a4:625:6563:a5bb	16509 (AMAZON-02) (AMAZON-02)
2 2	104.90.192.27 104.90.192.27	16625 (AKAMAI-AS) (AKAMAI-AS)
2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
3 3	198.47.127.19 198.47.127.19	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	2a05:d01c:1d8... 2a05:d01c:1d8:8101:37a8:11c6:83f7:6fb7	16509 (AMAZON-02) (AMAZON-02)
2	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1 2	142.250.185.70 142.250.185.70	15169 (GOOGLE) (GOOGLE)
1 1	94.23.99.218 94.23.99.218	16276 (OVH) (OVH)
1 1	52.214.225.206 52.214.225.206	16509 (AMAZON-02) (AMAZON-02)
1 1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
226	35

1 151.101.14.132 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

paid.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 104.16.113.65 (None, )

ASN13335 (CLOUDFLARENET, US)

www.buzzfond.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.buzzfond.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.129.44 (United States)

ASN54113 (FASTLY, US)

cdn.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.90.180.98 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-180-98.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.159 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

trc-events.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 142.250.74.194 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.35.236.247 (Frankfurt am Main, Germany) 4 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-247.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.173.27 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.99.165.19 (Raederloh, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.19.165.99.88.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 178.250.0.139 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.par.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.150 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.165 (Reilingen, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.165.63.201.138.clients.your-server.de

hal90005.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:c5a4:625:6563:a5bb (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.90.192.27 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-192-27.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 198.47.127.19 (United States) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d01c:1d8:8101:37a8:11c6:83f7:6fb7 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.193.130 (France)

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.23.99.218 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip218.ip-94-23-99.eu

medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.214.225.206 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-214-225-206.eu-west-1.compute.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
76	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 90 tpc.googlesyndication.com — Cisco Umbrella Rank: 136	833 KB
43	doubleclick.net 4 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 40 stats.g.doubleclick.net — Cisco Umbrella Rank: 84 cm.g.doubleclick.net — Cisco Umbrella Rank: 191 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 80183	266 KB
24	criteo.net static.criteo.net — Cisco Umbrella Rank: 578 pix.eu.criteo.net — Cisco Umbrella Rank: 7369 csm.eu.criteo.net — Cisco Umbrella Rank: 7618	160 KB
17	buzzfond.com www.buzzfond.com — Cisco Umbrella Rank: 786793 cdn.buzzfond.com	404 KB
11	google.com 3 redirects adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2	2 KB
11	taboola.com cdn.taboola.com — Cisco Umbrella Rank: 991 trc.taboola.com — Cisco Umbrella Rank: 633 trc-events.taboola.com — Cisco Umbrella Rank: 1652	40 KB
10	gstatic.com www.gstatic.com fonts.gstatic.com	91 KB
8	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 163	334 KB
6	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 35704 hal90005.redintelligence.net — Cisco Umbrella Rank: 319840	79 KB
6	casalemedia.com 4 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 518 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 494	5 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 42	3 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	57 KB
3	medialead.de 1 redirects pv.medialead.de — Cisco Umbrella Rank: 47139 medialead.de — Cisco Umbrella Rank: 46700	664 B
3	pubmatic.com 3 redirects image6.pubmatic.com — Cisco Umbrella Rank: 564	1 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 214	3 KB
3	criteo.com rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 13804 ads.eu.criteo.com — Cisco Umbrella Rank: 7606 cat.nl.eu.criteo.com — Cisco Umbrella Rank: 9641	64 KB
3	outbrain.com paid.outbrain.com — Cisco Umbrella Rank: 7533 amplify.outbrain.com — Cisco Umbrella Rank: 2032 tr.outbrain.com — Cisco Umbrella Rank: 1872	5 KB
2	innovid.com 1 redirects ag.innovid.com — Cisco Umbrella Rank: 1375	683 B
2	openx.net rtb.openx.net — Cisco Umbrella Rank: 1376	414 B
2	addthis.com 2 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 1735	1 KB
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 936	792 B
2	google.de adservice.google.de — Cisco Umbrella Rank: 8526	914 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 306	461 B
1	everesttech.net 1 redirects pixel.everesttech.net — Cisco Umbrella Rank: 2982	376 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 768	646 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	58 KB
0	gemius.pl Failed googlecm.hit.gemius.pl Failed
226	27

	Domain	Requested by
52	tpc.googlesyndication.com	googleads.g.doubleclick.net paid.outbrain.com tpc.googlesyndication.com pagead2.googlesyndication.com
25	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net paid.outbrain.com www.googletagservices.com
24	pagead2.googlesyndication.com	www.buzzfond.com pagead2.googlesyndication.com googleads.g.doubleclick.net www.gstatic.com www.googletagservices.com paid.outbrain.com tpc.googlesyndication.com
15	pix.eu.criteo.net	ads.eu.criteo.com
15	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net www.buzzfond.com
13	www.buzzfond.com	paid.outbrain.com www.buzzfond.com
8	www.googletagservices.com	googleads.g.doubleclick.net
7	static.criteo.net	ads.eu.criteo.com
7	www.gstatic.com	googleads.g.doubleclick.net
7	www.google.com	3 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
6	trc-events.taboola.com	cdn.taboola.com
4	hal90005.redintelligence.net	1 redirects googleads.g.doubleclick.net hal90005.redintelligence.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	fonts.googleapis.com	googleads.g.doubleclick.net hal90005.redintelligence.net
4	adservice.google.com	pagead2.googlesyndication.com 5994599.fls.doubleclick.net
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	cdn.buzzfond.com	www.buzzfond.com
3	image6.pubmatic.com	3 redirects
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	fonts.gstatic.com	fonts.googleapis.com
3	trc.taboola.com	cdn.taboola.com
2	5994599.fls.doubleclick.net	1 redirects paid.outbrain.com
2	pv.medialead.de	hal90005.redintelligence.net googleads.g.doubleclick.net
2	ag.innovid.com	1 redirects googleads.g.doubleclick.net
2	ssum-sec.casalemedia.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	e.dlx.addthis.com	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	csm.eu.criteo.net	ads.eu.criteo.com
2	hal9000.redintelligence.net	googleads.g.doubleclick.net hal90005.redintelligence.net
2	adservice.google.de	pagead2.googlesyndication.com
2	cdn.taboola.com	www.buzzfond.com www.googletagmanager.com
1	pixel.rubiconproject.com	1 redirects
1	pixel.everesttech.net	1 redirects
1	medialead.de	1 redirects
1	cat.nl.eu.criteo.com	ads.eu.criteo.com
1	ads.eu.criteo.com	googleads.g.doubleclick.net
1	rtb.fr.eu.criteo.com	paid.outbrain.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	tr.outbrain.com	www.buzzfond.com
1	amplify.outbrain.com	www.googletagmanager.com
1	www.googletagmanager.com	www.buzzfond.com
1	paid.outbrain.com
0	googlecm.hit.gemius.pl Failed	googleads.g.doubleclick.net
226	45

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-16` - `2022-07-15`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-03` - `2023-04-04`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-18` - `2022-08-13`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-19` - `2022-06-18`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-11` - `2022-07-13`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-22` - `2022-08-24`	3 months	crt.sh
redintelligence.net R3	`2022-03-29` - `2022-06-27`	3 months	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-10` - `2022-07-04`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh
pv.medialead.de R3	`2022-04-21` - `2022-07-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh

This page contains 34 frames:

Primary Page: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Frame ID: 88A91F7895231AA48A76A65FEF9C8816
Requests: 49 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20190131/zrt_lookup.html
Frame ID: B0B25BE7FAE4E4BDC20C5349D53B95C7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&adk=1812271804&adf=3025194257&lmt=1653534771&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771463&bpp=2&bdt=225&idt=122&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3645075113578&frm=20&pv=2&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=135
Frame ID: EF9F5AA7DEFD48F96566608F6E236EAF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=5340369745&adk=3537927020&adf=1723549077&pi=t.ma~as.5340369745&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771465&bpp=2&bdt=227&idt=141&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=266&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=0iYbzFb6PX&p=https%3A//www.buzzfond.com&dtd=145
Frame ID: B51386BF82FE66FFC1D4F2CB5E12D3DE
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=3668195423&adk=564037218&adf=193788922&pi=t.ma~as.3668195423&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771467&bpp=1&bdt=229&idt=145&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=1164&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=lfJ1OriDvZ&p=https%3A//www.buzzfond.com&dtd=148
Frame ID: DB624CF8C46BC7BC1268EDF21D9881B4
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: FA19A4C4C240242CE502E2594542B1C0
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 83608DCF176090F683FB364549D0403D
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10
Frame ID: D1370B2839150ED9A7C503C30C2F508C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14
Frame ID: 7E5D7DA2A8BF5DBBAE184125FFFD1681
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18
Frame ID: 503C738CDD1944E045DB3C4EA663B355
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23
Frame ID: F4BED035D283A54D0AB63CA3B9871F66
Requests: 10 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js
Frame ID: E82B2144A84F59EFDDA4A00FB8EAC969
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1
Frame ID: CC6822A4A2E82936B6555C57DABFE4AD
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1
Frame ID: DF9BBD854744F4D140A769680C39F811
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo7wMwAKrYMHg4fYAAWEBdOj9llteKY0BasEtA&u=%7COD76M4ZFJ4r%2BqIX4kvy29nuH3DTd5dq5ITHUOi0aPYo%3D%7C&c1=YJ4X_nXZn4MS-Vyc1jpPlV4VTPO6xzWbMW9ePYRMUYXVfUoF4cAXWYg8h5DGKhCYavayMK6vuCRr10tlpRuaBSJD0Oq4BuzZQn7Fr-jeF00WX9wIE2UEcRJgyZYC6zMM1fbEmH6_rKzWB-I8-4PMaQy6KxxqfBslK0lBooe4k7cem9D09Br1g0F2chHw7AVEsCSTs-APStkBDvHmmSWrthjcAuipv5xYKZXGZXSosV54ucPtwEAXnIAU2VEuEW380dNt00cLC41U9L1mtMO79tYwyPFrcnPP-0XwPz1pRJBdy2RjkCUXuJ3vptkCudVV6M0ig33SlBWSxU63y-J1BJlor0dAANBBwzeuLK38jlUnegAApFNhHm3h8jMNHM2d6j7TUcL891iRiAu5v7VZ-Dq5Ve2m_EXg5cjOZQY4-LIYwXBa-txfHRLRLmjpgLkBcHG4rbBoUlXkgc-OS6PWWRqDUUzDyZ_L&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv4RJM_COYoPbKtiPjuwPhYiW2A7JntKxXLWY49aTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi04MTczMzU5NTY1Nzg4MTY2oAHVttLqA8gBCakCsRsSbCbssT6oAwGqBI8CT9B_AfbDhC9iA9LPeqGXRWXI3A_8txw9nUd04HXeHDIvIaPRMv5EbAhmJGvLADuJ6cGQBXRMV8LuAPWEpfeUPr3Pnr3DPgEfCMr7Dj_Zsc3jnwFXQ4RqQP-kxxisDZ0sVqiDemVnu5J4wTVdJqmgmqYHvSQaNRLTR9DeOY4WlA26M93--SGfVkXEOv7ApUKMpq2QFspEEywZyuGXnU1QGqiyokFB0xKkcjK_Tx96FRlguyUZKWhbHrsXrGfJkIm0Jlrc2tMzqs4ycwE9dRv41mZhp676a7_QnsaybzOZXVwijbllFYx21Lmrov6Q6wcmPypWY-s3V2wyOzsnhsk1GNyML4m_frA2vTuGebpYF4AGs9CYnN7m15vhAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2-INyeRgL--DStg4rd7apusJo8SQ%26client%3Dca-pub-8173359565788166%26adurl%3D
Frame ID: 3E53EE41191BA791416844709222CEBD
Requests: 26 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js
Frame ID: 52915A070B0D188F445D8759E0AAEC9D
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 938D828C7C460DFB77E1FCFA8E9657FD
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU3VnfTJSH1Jk2w0PPlf78hrCrSJ011XAukBvWV9Stf6UjycnONrewcgquBQaAfnhulLUfxp_RaDUsXXWFdUSTsxErkvc9eQIiRumXmfHCjwqy9YNkb21dFXWhLngLLJe2F0nzZbfkJHzDyLKfNEmGHjqfdIx5Q7a1IHS0uFtoPTGL324w
Frame ID: 4AC3B499DA873F8FCF215B6E44C2863C
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnfCuJGAqtFE64ToASzJNZ-_5P6iFWUkwX0CES9m4jkyzF-FuG9w16k1hZwSlINLaXWWPEHPEKMS0UCKLWkt8bxj0HUJjCRLU9-gCo4PmA6wzuFPAGGVinQdKRvEDC8T59j8KaWY-kI1UXRdsMojb0VHnXSw&cry=1&dbm_d=AKAmf-DG8tgGm8zmj2513XNA5wWn4yRlKT4vZYfzIApt2uOcMn-Q4cnPuAj_bwv3Y0UMzBWPfQ5yi449NZTfj_g7C6tqD4QCuEGckPJ9uWRKZpc4ly4Wr_SJaWPgZeeCg5-Ip7xtIg8mQv34RuyEIsbtf-oi7BKlu4jXloOY_6RZtrW82w27YuS8jrozn5ZecWGsLyhu-ecpiA4_m1KZMHxCnsNAowC-tQGerFGwb_W2Zg7BjtXjZ0b0cRX4qDgUdnTkF2D4t8AKCy1d7oliWkWWAEPCjdoqtbf7ojfv_TWvIll8ADjHK9mS6Z8LZSLmKil7gLiwZu0Qxo9majhtKXgcAosxFljPQO8wDYx148jzZotGDqTX6tegV80vZgv2GPssOy8q3CIEJRAoraaVXXUChtUn3yJYWZfYkjljhkmab8C1UesyB2wgp46ESRSXPQImM8Cq4Lzn2OwrFIEtAj5YN3Gr1hrf5Quu1oZKJWeEyvypCnxadzZPi1EvvNY2Jzi8ha6QB7dAGTzVIVxs8SSRT7_ox81n6Sra8YP3DYMv8RdQnPYrlFMv6RWggNMA-Txg0S7WQcVjTpYKf-EhB9zTtPnWFSvEXmMw3sQGo7sy8OB4r6YpeyVccxk5fLAeDPXRTLMmsfrHuYXTWHp7yZgAEgtmarx0MKtBmIX-tg-dkxcchJKhhOZkhuDHXATnLUo3vsUiYzSEaadUfrKciBdk0yjEYRKWmuUNm0nABlL_sYii9f1K8jDLwwPpPzsLj7ELsfOK1j3H8MEL9ex17h2y4-N4UmXL0Oi_cAhr0_Ch-DSq6KcurTK3RHPA5cvirKO_qJkOW7ckcTaFom4X40REVHqdGVXYJoBUojUOwJOdfwoLtEkB3_qPACQ8s0Rr8RRbKm9my_Z65X-yhzJ3cjUNBs7yJZCXCN1kLJElT7SieZD95LSUL3f7HPmeBcTi7JxYztk4vq73yIIxgiqMp0BK7s0u9rvXt-KNZi7LoFTIUiVPFGuUfa7KzZyO5x-CGFo77Q58z3CfrCO9JhRZtdXp-hyCsCa0zMw8Z3PsEGDoOX-IY8SzXGJ6geZTSxCZAsg-FCnWqDTljzDSgSm928FkmYRZsyw1T3xh1ux1FoOtUWhlsbQX_JoTNozTBz-F13eGA2JIhHu_KBMyzv2_OXjBvksPXtB1YLUCD_CvwiudbYl94EzuWijpe5mnL0G0nrvbVheJNTI8pPO9AJgATZ1JQdR6lCmTe6U_J5pSJJrFL6d79X2lrvvhD7HpNYjL45AKEHzZhq8mr7ZY27LKpn1khS61qYnf7acI5I1Qs0xtcH4ZOIFKraOe0H5SXQ69AjNAVCClUzyjauMbwXhDJrt0B2G3FBF4dqBbB5VCngQcKl_eXABvmvmUwX2vByFDQ_hvHm5oHzsdvP-nxbZezbN0lVUI1FO4GDZVpDBID01bvLJGah7mBpPKGK8xfWSzPaJqTbJfM3P5jxKvujIx1DNoUmAhEDdyK02iZBAbW2MOaqoU_ZmRqWQ1w7VKptvp_ECXl_CN8wW2WE53ltK8SOjp-bnlhODjPO4nPOlbf-GqKB_qd-tMN0U6SViI-6wUgjVX-ddUGTBhjbU7rDzz_VhlP181su7_6B1aFCVsgQYIbyeVhy9ETCLcPZuIt4NCdRe98wZw_biuCbtOlFjlpBZ5WLd0Y9UdwYiYtYoYYhVPYYCCSgxYPQT5beBjLTA8l92ale-NhEOa41LR4F8rheyyoAJAuzG9vsn28bcKKZ54z7_rIRUHtWO24KmPyB75rwUbmgI30fQva3PXeuDKVt7cfg6wQPTJ1M5ECSR4EJiBhwirDm1XsdmZzeeckjv5wgxrCPfRhR4vgBI8cqe2Vfe8lnLVg6e0MCBxe7NPLaK8gG7a1uqA6JIICxj98OryZiZpu8nCykEJuBJ2H17aySaRRDSJFEv8w6OoYOhltShcI52Hor5vnUNfy0RFWxbfk5kuWJQV3xtzA4acXn7xEHrYYpCM31JHS8uy_KOK_xyXdEvzjHqkT6qvHM-LjhBiBKjQYD-WNrrdvnRin8QNA6Cfma_z_E9v087mKrDOoEfdAMHk6hxDcMFspqBF9eP0tkIatjbS3ae6-P1YRWUvTLnqIQTJEiLlDDBTqzxusT5A95ZEyTAvzrmEXqE_myql9VEb-_XByqOqippEiwPxgMc2sxwvRmIzOTv1V7b64yaZgUrzHPXi1ox7SSETghKaKtsNJ6JoL9qzbclfPMAK2YyGMvQekVT3oeW0Vm_3TBl13HWod9dj7SO10iwIiR5MAVjZILVkvVfU7tGHCECKO7DaqzJXkopQuSB4MvprdB6YXuIH56Abg2ua9brF8W-P6htdjZ8LPdrej318OkYTz-R5FMN2CoTy10BqJ8sXHDlDnYQjua4BNvxfkFiAI_TySeyIMKN5Rg4FwLZyMKSPh50Pl25OaSAgHfiiDpYgTIAvGF_vmwWf1iJz5bslxi4B8beYKWQJ2ehoBslZ6Rof5ANwHVrUDiUMm-D9Se08t-IjnYiBVB-iDDBZs3-q13swgsX1dLxeQbyseL9U-o6aig1VwJpZFFzG75f0ob7rarRXH4v-4SB9rOZGPUqI-LPQULnxhOVjzgA8YsYfeF5W8mCIGtbptx45FIgbh20NdRy0uLuHqySeh3eFrIBEXKNRqcr3QaqrV-DRms9Frd9-WWAf7CDQdnPX_E_TcUEO7LATEY2m1FIukVk4JLVwLXLv9i2VArBde5wk20z0MCr6iCFn91DgLAdnBPXk-s7fOAXYZS87gacK1foRTbFvUeqSFq5_fGQ5HGdky5uUXOPSgKTg_7qu-1MzyTZUZAML8EEp10rmkCZpjihX78eBHFmiUqV7GwqQ_4qCPeqMyxUlFYqhjHvWZJ4GVEhio7-2NZzuAi-AXLcrgcutEOW6_8xxW8zoHgtfBqEXEzGzX7ZVpVtRGbtQrEq01IPLE74EYOB92Hg-zPNsrWp_m-oEJzQyWIf4KT2-77QdskjapbVC1BaawtkSoDlM_cVL7SF8BToetdKD_syup5FHeqs2aCZqAka1eGLVcheXDN-bQ5yDdOWQcJfYOwKt9OvAAE0WPclL3UBJnR6lzIFORY4I6mDNt7li8rC9dli7xZlYflU7b9RZUbZMGGqB77vgRRK5TAJJHrbFqh3S0cF70KNwWNqRtHAaCRGb2Q-mb2-Phcpnlnx67BTd9fj7f-WeyQ458CXA9HAPYkTgw-y5WZ480PTk0o4giR7RRq26fhLscHNrIDBemFhr2t94NNhHShJkSToX0IfTQBlaO7PpqIOdwNmLU8fN7F_BUdlR_rzvke7XtEjOTa2Du-eSVKKPb4kVi0R5crjPjZqmH1sxt3iraaLJcfI-_XNJWNN6WyBHzsWFq76baHDbqETVUcmGUesVE6hE2XKhREZmhpng7sWsvKjD0vvz_kl2wnZey1dWFic_-nTFKYhqQaJ80qi3JllV1mAjEIAW04skEjn-NTIF-TRSbr7881rGiAfP4WGXBTsUbUSlJtqHUvQ_TfQqPFBor3QJulxAlUIpFjXV9xInfLKynoWEOmXg7ZNbjj-VxqF0YTDGESMgqto_e21kuQjJD61S-c5kUSeRfcUxQw7YsSH4o0TDmJa1MhNc&cid=CAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ&rfl=2%2Chttps%253A%252F%252Fwww.buzzfond.com%252F%240
Frame ID: FEF236B277DFF8ABF217DB546C1C31DF
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html
Frame ID: FA8A3C370A2ECC46CDB10667A5BEA145
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CP-MINPCOYrG7J5mGjuwPgta4gA-2sfLvab6auIbWD9LfqN6sIxABIIPH5B5gleKQgqAHoAH44PT6A8gBCakCsRsSbCbssT6oAwHIA0iqBJoCT9DNBk6dPzERSdgr0ql3EohGwok9qSw12iObJfJs5oycYyp8VzyH6_A6DYI8T6M9aIQE3r5ChzSE0wE06tHXZVrlK2Faq9mpeArVrhHiNMqPXgQ8AXFpaiJefCQXEzY9BHPH5R-BICpTqXH3j2g-6EvgMU4yxcjWvXAoeQClrhI3hpNppdbfZJO0O1BmhYlNXBaKQUGOPAVfHwXbtQd8iwq6_KKjDxoFNm_MpRd6oEkfH7-QzxyKYKkVA6JuoQdFGXX3zkiwdG9kMJ0fFy6z91-aBOqFWNISe1MpHrJXlVAqJ8hmhy-ApvrwxRabBwGtmDNkimeQW05urOVS8fGYcKOKigjiRCRhkD5RaCSt7AR8IHrL_zKwsS_WwASZ_Yz7uQOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH8J6LBagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEMSADdIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi04MTczMzU5NTY1Nzg4MTY2GAA&sigh=qUiPnmuhOD4&uach_m=[UACH]&template_id=419
Frame ID: 97402747822F536B765D4BA7867F21D6
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html
Frame ID: F9DB210996FD0AD9C3665439D6357121
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=Cr-CJNPCOYu7uJ_-TjuwPp-a24AW2sfLvab6auIbWD9LfqN6sIxABIIPH5B5gleKQgqAHoAH44PT6A8gBCakCsRsSbCbssT6oAwHIA0iqBJoCT9DkiafVH7QHwAnQBMJBU8lhXRjTHfTqlHBDE3wcWDqK7sGa0JHoNnRA4XgbNjws1k1kxGnLnID7iGHIa1yoEII4NCSlZO924FcgEWF3OdgDro5Bvn7F8egaZKRUVU48HqPoJfIA5X03OLhbPa8Hq46qo7mZLgF1FMtzfTpS7Ypv3pqTRk7BbcLHvF7bNxTX2j7aCa1TJ4srtZ45y7VpDb9f17Z0QLeXlhdTl4zS4g1h0TQT7ZG-JO8L-9nHY1Q9IxuPLgOwJ7XBrGASQlEz0VZbCSYjSoGpq3jTQsoisM-wJuHpXTMnUp74Wyc32ep984cxBYBVJAOFyg27WQuh42BLzPrWr5QzCjTpQjgT6uXP13-FPd0GwhJnwASZ_Yz7uQOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH8J6LBagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEM-NCtIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi04MTczMzU5NTY1Nzg4MTY2GAA&sigh=STV1nuEeNMc&uach_m=[UACH]&template_id=419
Frame ID: 5491757BE1045D31D3AD460137AB711E
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6E0EE6D88146A14C093EAAF219A4B76E
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 683ED7F89A2A7712EC37119A6158457F
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 10FC28091E642DB23E9AAE62C2DE688D
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js
Frame ID: D7E0899C2E13D62D9B70B8EED71462FA
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js
Frame ID: 12647F3115CF1711E46D63C02A8076EA
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005&t=htlp
Frame ID: 58B811070FFB900C929BFFC024EA7FC6
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47
Frame ID: 2EABD11F7781F0EFC7813A978DB46D55
Requests: 2 HTTP requests in this frame

Frame: https://hal90005.redintelligence.net/request_content.php?s=14445100014469304444992011971005&a=4efdb59c
Frame ID: 23E063C2B899A387B9400A906DCD63BA
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: A6421B92CA39CA8CC15D24C9A19C497B
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 3EFB36C5798A0C105D938412A9EC2888
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 5829AC4DBF9B1216321C548BDD9B68F7
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

What Happens To Your Body If You Sleep With Socks - BuzzFond

Page URL History Show full URLs

http://paid.outbrain.com/network/redir?p=TV-jqloioZ5gh9rbmhG_8hGi5SyowVGcgT7q1Mmv265XX_AdtaTi1qblawwX... Page URL
https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Mautic (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

[^a-z]mtc.*\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

226
Requests

92 %
HTTPS

44 %
IPv6

27
Domains

45
Subdomains

35
IPs

8
Countries

2396 kB
Transfer

5417 kB
Size

33
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://paid.outbrain.com/network/redir?p=TV-jqloioZ5gh9rbmhG_8hGi5SyowVGcgT7q1Mmv265XX_AdtaTi1qblawwXfIyYngF44vH7uQl7UfinpEPP4aYE_r6_XctflwkUrNR-7ZgKYg3_CIXG8K69fFPIiN4eEizMtiXCVi9MtGsAP2kUVsJxGTySksPVm75LjjNeJGw_8tVZsHVsv-MlfEVTia9YTsZpN0DUCaSZk2mA-3uiGjNECk5IRtnykkJmMQZToI804_j9aLMKYq9vcLGzEICyLSUWkmEK466RqmYngFJ6_BrgRu9Wha7NTi99uS5IZpTzNhxImhiVtD38cVU09ZXN&c=62c3ae31&v=3 Page URL
https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 71

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1

Request Chain 132

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1

Request Chain 133

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGUCmVx-uUGztyECjyNM4NY&google_cver=1

Request Chain 134

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU3ODMxNDA0Mjc0NDc5MjY0Ng%3D%3D

Request Chain 181

https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-8173359565788166%26output%3Dhtml%26h%3D240%26adk%3D4147636252%26adf%3D308362495%26pi%3Dt.aa~a.1397822562~rp.3%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1653534772%26rafmt%3D1%26to%3Dqs%26pwprc%3D3037641804%26psa%3D1%26format%3D300x240%26url%3Dhttps%253A%252F%252Fwww.buzzfond.com%252Fwhat-happens-to-your-body-if-you-sleep-with-socks%252F%253Futm_source%253DCNN%2526utm_medium%253Doutbrain%2526utm_campaign%253D00daffd5a6c52890dcd11ce8780c662d38%2526utm_content%253DCNN%252BEdition%252B%252528Turner%252BInternational%252529%2526utm_term%253D0014dace722b21ef3ebec62fc10f878c42%2526itm_term%253Dbf%2526dicbo%253Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%2526obOrigUrl%253Dtrue%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1653534772608%26bpp%3D2%26bdt%3D1370%26idt%3D-M%26shv%3Dr20220523%26mjsv%3Dm202205230101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D3deba6f7292ece3b-22aba8029dcd00bd%253AT%253D1653534771%253ART%253D1653534771%253AS%253DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ%26prev_fmts%3D0x0%252C728x90%252C728x90%26nras%3D2%26correlator%3D3645075113578%26frm%3D20%26pv%3D1%26ga_vid%3D1135698774.1653534772%26ga_sid%3D1653534772%26ga_hid%3D968036649%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1008%26ady%3D1252%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759842%252C44760475%252C44761044%252C31067756%26oid%3D2%26psts%3DAGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%252CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng%26pvsid%3D3371456103291399%26pem%3D123%26tmod%3D314249946%26uas%3D0%26nvt%3D1%26ref%3Dhttp%253A%252F%252Fpaid.outbrain.com%252F%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3Dl1bNSbMnvA%26p%3Dhttps%253A%2F%2Fwww.buzzfond.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.buzzfond.com&random=3657376098846&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-8173359565788166%26output%3Dhtml%26h%3D240%26adk%3D4147636252%26adf%3D308362495%26pi%3Dt.aa~a.1397822562~rp.3%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1653534772%26rafmt%3D1%26to%3Dqs%26pwprc%3D3037641804%26psa%3D1%26format%3D300x240%26url%3Dhttps%253A%252F%252Fwww.buzzfond.com%252Fwhat-happens-to-your-body-if-you-sleep-with-socks%252F%253Futm_source%253DCNN%2526utm_medium%253Doutbrain%2526utm_campaign%253D00daffd5a6c52890dcd11ce8780c662d38%2526utm_content%253DCNN%252BEdition%252B%252528Turner%252BInternational%252529%2526utm_term%253D0014dace722b21ef3ebec62fc10f878c42%2526itm_term%253Dbf%2526dicbo%253Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%2526obOrigUrl%253Dtrue%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1653534772608%26bpp%3D2%26bdt%3D1370%26idt%3D-M%26shv%3Dr20220523%26mjsv%3Dm202205230101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D3deba6f7292ece3b-22aba8029dcd00bd%253AT%253D1653534771%253ART%253D1653534771%253AS%253DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ%26prev_fmts%3D0x0%252C728x90%252C728x90%26nras%3D2%26correlator%3D3645075113578%26frm%3D20%26pv%3D1%26ga_vid%3D1135698774.1653534772%26ga_sid%3D1653534772%26ga_hid%3D968036649%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1008%26ady%3D1252%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759842%252C44760475%252C44761044%252C31067756%26oid%3D2%26psts%3DAGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%252CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng%26pvsid%3D3371456103291399%26pem%3D123%26tmod%3D314249946%26uas%3D0%26nvt%3D1%26ref%3Dhttp%253A%252F%252Fpaid.outbrain.com%252F%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3Dl1bNSbMnvA%26p%3Dhttps%253A%2F%2Fwww.buzzfond.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.buzzfond.com&random=3657376098846&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 183

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIHtlsy9e2kCwjQE0DPxv7QiFe-KXHMlo-2hPfILxkDJVRxxHGt55r3QUMdbTqOks9WHasSadpoZDtVfToTsBw7toKbm1ZQ&google_gid=CAESENS4uuTDAGcqGO1h2whTfIo&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIHtlsy9e2kCwjQE0DPxv7QiFe-KXHMlo-2hPfILxkDJVRxxHGt55r3QUMdbTqOks9WHasSadpoZDtVfToTsBw7toKbm1ZQ&google_gid=CAESENS4uuTDAGcqGO1h2whTfIo&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjYwMzEyNTMwMDAxMDI0MTE0NzIzNQ%3D%3D&google_push=AYg5qPIHtlsy9e2kCwjQE0DPxv7QiFe-KXHMlo-2hPfILxkDJVRxxHGt55r3QUMdbTqOks9WHasSadpoZDtVfToTsBw7toKbm1ZQ

Request Chain 185

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBsGwP5gCBjJqUwHvjI5FDY&google_cver=1&google_push=AYg5qPLWq3fFEdyk8DsVdBFw7Ab48aSj11_y_7dOONSaZ3Khhi_ForSME3eu5ehnn4j4EywklO984WBjkyQhPGXhf8CmdKFghaSo HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBsGwP5gCBjJqUwHvjI5FDY&google_cver=1&google_push=AYg5qPLWq3fFEdyk8DsVdBFw7Ab48aSj11_y_7dOONSaZ3Khhi_ForSME3eu5ehnn4j4EywklO984WBjkyQhPGXhf8CmdKFghaSo&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLWq3fFEdyk8DsVdBFw7Ab48aSj11_y_7dOONSaZ3Khhi_ForSME3eu5ehnn4j4EywklO984WBjkyQhPGXhf8CmdKFghaSo

Request Chain 186

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1&google_push=AYg5qPJeewyqG8STo2F-f2RaMJD0XoXvZ_c2Nmt5dFnUZpcrQZQBqMlNZJVxmHMb6XDzQB4iq7AKoVQp5DqWob1RJkQByVIDviMY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPJeewyqG8STo2F-f2RaMJD0XoXvZ_c2Nmt5dFnUZpcrQZQBqMlNZJVxmHMb6XDzQB4iq7AKoVQp5DqWob1RJkQByVIDviMY&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1

Request Chain 191

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 197

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47

Request Chain 199

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005

Request Chain 205

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDanRjKed3xe2WvEUlNjZNs&google_cver=1&google_push=AYg5qPKVSS6r1E0O3bRr_GKqc1iZ9K4ecrC2n6pXoiB13BasZqvIGQODcfv0le15Dto_0SOxLWxCBMVS_R_alR9xE6VJpybI2lgR HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKVSS6r1E0O3bRr_GKqc1iZ9K4ecrC2n6pXoiB13BasZqvIGQODcfv0le15Dto_0SOxLWxCBMVS_R_alR9xE6VJpybI2lgR&google_hm=vWHh0q1r2x8fZWVrFLRy9g

Request Chain 206

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPK4wiH0HoRFF5sI7u3Sbl8apVVR3eM0364sfPGk_j9nb3nXar7ezfrrXv8JU9Ob8hctpnJtWUOcOz5rxDGPb3a2-b3Fwkyb&google_gid=CAESENjyHGDxOeP2uzfHB1HkuyA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW83d05RQUFBTm5KajNnNA&google_push=AYg5qPK4wiH0HoRFF5sI7u3Sbl8apVVR3eM0364sfPGk_j9nb3nXar7ezfrrXv8JU9Ob8hctpnJtWUOcOz5rxDGPb3a2-b3Fwkyb

Request Chain 208

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBsGwP5gCBjJqUwHvjI5FDY&google_cver=1&google_push=AYg5qPLKowwbjxCUtAJxgxAshKk9-m3JNrEFM3ZLVFqS-QxudUb8yyWS2Z7rBRgv5gua8EuiGcws-Cxi7DZc8og9itIhcSJ8-TeT HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLKowwbjxCUtAJxgxAshKk9-m3JNrEFM3ZLVFqS-QxudUb8yyWS2Z7rBRgv5gua8EuiGcws-Cxi7DZc8og9itIhcSJ8-TeT

Request Chain 209

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFaJAFm8NZFoBLmatG26rYk&google_cver=1&google_push=AYg5qPIY0vHZFPGGIaY6UZ6zZ2RTOYkA7uMOztIiv2mHcXSTjC08GSeyGLK0X6BUsof2pya9i-HtDJ906jUKoK9zgWjEbmQTE9gn HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNNRldUMVYtMjQtMTFYMQ==&google_push=AYg5qPIY0vHZFPGGIaY6UZ6zZ2RTOYkA7uMOztIiv2mHcXSTjC08GSeyGLK0X6BUsof2pya9i-HtDJ906jUKoK9zgWjEbmQTE9gn

Request Chain 210

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1&google_push=AYg5qPL1-Hh7tYRuNU2GywNJPK4RBjLioyRrQITrMaZnLR0zTUbp0ESvclwP7PSi4w_VZygbZFDw_25i786__URDxmW6hhLAAl1y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPL1-Hh7tYRuNU2GywNJPK4RBjLioyRrQITrMaZnLR0zTUbp0ESvclwP7PSi4w_VZygbZFDw_25i786__URDxmW6hhLAAl1y&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1

Request Chain 211

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEG_jlW3133ITk0LlJKwSjEc&google_cver=1&google_push=AYg5qPK520Jb28A9SqUB5zpjf-sojz2IVq2bXh2SL02yoLnSViNOUUV5z1xj5Bx6OyNQkA6WSc040TFqLwBrcM0KfNKW-N-HQd-e HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPK520Jb28A9SqUB5zpjf-sojz2IVq2bXh2SL02yoLnSViNOUUV5z1xj5Bx6OyNQkA6WSc040TFqLwBrcM0KfNKW-N-HQd-e&google_hm=Wc6qTa7oT9yv9t_L8v7gYw

226 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK redir Show response
paid.outbrain.com/network/ 2 KB
1 KB 100ms
94ms Document
text/html 151.101.14.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://paid.outbrain.com/network/redir?p=TV-jqloioZ5gh9rbmhG_8hGi5SyowVGcgT7q1Mmv265XX_AdtaTi1qblawwXfIyYngF44vH7uQl7UfinpEPP4aYE_r6_XctflwkUrNR-7ZgKYg3_CIXG8K69fFPIiN4eEizMtiXCVi9MtGsAP2kUVsJxGTySksPVm75LjjNeJGw_8tVZsHVsv-MlfEVTia9YTsZpN0DUCaSZk2mA-3uiGjNECk5IRtnykkJmMQZToI804_j9aLMKYq9vcLGzEICyLSUWkmEK466RqmYngFJ6_BrgRu9Wha7NTi99uS5IZpTzNhxImhiVtD38cVU09ZXN&c=62c3ae31&v=3
Protocol: HTTP/1.1
Server: 151.101.14.132 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0770be4f78c7c13147f6dc6dc3b05296e34ae904175fae2afacd8d2d6df12acd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 560
Content-Type: text/html;charset=utf-8
Date: Thu, 26 May 2022 03:12:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
Pragma: no-cache
Traffic-Path: NYDC1, LGA, FRA, Europe1
Vary: Accept-Encoding, User-Agent
Via: 1.1 varnish, 1.1 varnish
X-Cache: MISS, MISS
X-Cache-Hits: 0, 0
X-Served-By: cache-lga21921-LGA, cache-fra19171-FRA
X-Timer: S1653534771.831117,VS0,VE88
X-TraceId: c615df7e1335ebf048674f58e9812914

GET
H2 200 Primary Request / Show response
www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/ 27 KB
7 KB 287ms
245ms Document
text/html 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Requested by: Host: paid.outbrain.com
URL: http://paid.outbrain.com/network/redir?p=TV-jqloioZ5gh9rbmhG_8hGi5SyowVGcgT7q1Mmv265XX_AdtaTi1qblawwXfIyYngF44vH7uQl7UfinpEPP4aYE_r6_XctflwkUrNR-7ZgKYg3_CIXG8K69fFPIiN4eEizMtiXCVi9MtGsAP2kUVsJxGTySksPVm75LjjNeJGw_8tVZsHVsv-MlfEVTia9YTsZpN0DUCaSZk2mA-3uiGjNECk5IRtnykkJmMQZToI804_j9aLMKYq9vcLGzEICyLSUWkmEK466RqmYngFJ6_BrgRu9Wha7NTi99uS5IZpTzNhxImhiVtD38cVU09ZXN&c=62c3ae31&v=3
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ThinkPHP
Resource Hash: 6b03e4e57cb42e65d381281fa1e226c33d67293d133ba70c0c8e41efd957c99f

Request headers

Referer: http://paid.outbrain.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 711354deb8c723af-ZRH
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 26 May 2022 03:12:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: cloudflare
vary: Accept-Encoding
x-powered-by: ThinkPHP

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 159 KB
55 KB 153ms
72ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2471978e1171417f89974e80cccb21486b8691652a7bbeeb604eed9fa518a98c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56224
x-xss-protection: 0
server: cafe
etag: 12099965819983503597
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 26 May 2022 03:12:51 GMT

GET
H2 200 style.css
www.buzzfond.com/Public/Css/ 27 KB
6 KB 26ms
26ms Stylesheet
text/css 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b1853975c021d4423d0213962a40c9bae838da219fd458474af22e5cc18daf1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 11 Mar 2022 06:55:19 GMT
server: cloudflare
age: 68415
etag: W/"10a09a-9cd7-5d9ebd053f7f7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Fri, 24 Jun 2022 08:12:36 GMT
cache-control: max-age=2592000
cf-polished: origSize=40151
cf-ray: 711354e049ed23af-ZRH
cf-bgj: minify

GET
H2 200 swiper-bundle.min.css
www.buzzfond.com/Public/Css/ 13 KB
4 KB 22ms
22ms Stylesheet
text/css 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Css/swiper-bundle.min.css
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab4620524f7a08c502887be3119a9174305cce8939e89b4c7f365a8043b4dd54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 21 Jan 2021 09:32:35 GMT
server: cloudflare
age: 68415
etag: "2456e-3572-5b965c070b2c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 711354e049ee23af-ZRH
content-length: 4133
expires: Fri, 24 Jun 2022 08:12:36 GMT

GET
H2 200 logo-black.png
www.buzzfond.com/Public/Images/ 24 KB
24 KB 140ms
139ms Image
image/png 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.buzzfond.com/Public/Images/logo-black.png
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9dd1098039117ec8d876d5377e658d91e29efa73163239def6b876496a46e459

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: MISS
last-modified: Mon, 25 Oct 2021 06:58:14 GMT
server: cloudflare
etag: "245c2-60d8-5cf27e27bed80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 711354e07a0423af-ZRH
content-length: 24792
expires: Sat, 25 Jun 2022 03:12:51 GMT

GET
H2 200 load.png
www.buzzfond.com/Public/Images/ 34 B
241 B 22ms
21ms Image
image/webp 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.buzzfond.com/Public/Images/load.png
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b339c6accd6f80db6b6a809b1b668606e307bcdbc9016fc15fe2922d4288e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: HIT
age: 163436
cf-polished: origFmt=png, origSize=88
content-disposition: inline; filename="load.webp"
content-length: 34
last-modified: Tue, 08 Jan 2019 11:55:42 GMT
server: cloudflare
etag: "245bf-58-57ef10654eb80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 23 Jun 2022 05:48:54 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 711354e07a0523af-ZRH
cf-bgj: imgq:85,h2pri

GET
H2 200 arrow.png
www.buzzfond.com/Public/Images/ 826 B
980 B 25ms
24ms Image
image/webp 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.buzzfond.com/Public/Images/arrow.png
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4611c694de0819ad83742cbdb99c29fe792c252d63edf7ab1193f02e8c975db3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: HIT
age: 68414
cf-polished: origFmt=png, origSize=2830
content-disposition: inline; filename="arrow.webp"
content-length: 826
last-modified: Fri, 11 Mar 2022 06:54:03 GMT
server: cloudflare
etag: "10a095-b0e-5d9ebcbc94df5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Fri, 24 Jun 2022 08:12:37 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 711354e07a0623af-ZRH
cf-bgj: imgq:85,h2pri

GET
H2 200 jquery-1.11.1.min.js Show response
www.buzzfond.com/Public/Js/ 94 KB
33 KB 22ms
22ms Script
application/javascript 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Js/jquery-1.11.1.min.js
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 19 Jul 2014 09:58:40 GMT
server: cloudflare
age: 68414
etag: "42851-1762a-4fe88eb16f400-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 711354e07a0023af-ZRH
content-length: 33225
expires: Fri, 24 Jun 2022 08:12:37 GMT

GET
H2 200 main2.js Show response
www.buzzfond.com/Public/Js/ 3 KB
1 KB 452ms
451ms Script
application/javascript 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Js/main2.js?v=2.0
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a141ff968e3e019b75b4831f9ce72566a080f855767f7d81ef6a1c63418f551f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Mon, 14 Mar 2022 02:14:53 GMT
server: cloudflare
etag: "10a088-aeb-5da243efc403e-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 711354e07a0323af-ZRH
content-length: 1148
expires: Sat, 25 Jun 2022 03:12:51 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 161 KB
58 KB 133ms
50ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WSPQTFJ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eabb7dbd96c4af6e89a4edc4aab086a81aae02b76ea5c714d7b127757efb9803

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59347
x-xss-protection: 0
expires: Thu, 26 May 2022 03:12:51 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1040822/ 55 KB
17 KB 30ms
7ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1040822/tfa.js
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f1498bd2a9c3663de6bd3827bc03396140743b8ec409dfc0201399952958f093

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-version-id: 3AQl.xawplED_C2hrKtf2b9T8flrxZw2
content-encoding: gzip
etag: "7421e33fd0633ffc1b3d26c7a1e9d925"
age: 0
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 17380
x-amz-id-2: Pk8j4vLYM10IXor5sRIVoshMlbj4vklwVQhsjivxXQYn8J4TTiw7UlV43BwMxxjEh4R88MhpPFQ=
x-served-by: cache-hhn4055-HHN
last-modified: Sun, 22 May 2022 11:23:51 GMT
server: AmazonS3
x-timer: S1653534771.295848,VS0,VE1
date: Thu, 26 May 2022 03:12:51 GMT
vary: Accept-Encoding
x-amz-request-id: YP78GD5QTR7TXC05
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 70
x-cache-hits: 1

GET
H2 200 Texta-Regular.ttf
www.buzzfond.com/Public/Fonts/ 67 KB
30 KB 150ms
150ms Font
font/ttf 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Fonts/Texta-Regular.ttf
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bdb1cd6eb6a48113dab6201ce184d8a2dd15c153a3d8d721d1022d5cad9a51c

Request headers

Referer: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Origin: https://www.buzzfond.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Wed, 13 Oct 2021 07:24:47 GMT
server: cloudflare
etag: W/"245b0-10aac-5ce36db56adc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/ttf
cache-control: max-age=2592000
cf-ray: 711354e07a0923af-ZRH
expires: Sat, 25 Jun 2022 03:12:51 GMT

GET
H2 200 DomaineDisp-Semibold.otf
www.buzzfond.com/Public/Fonts/ 72 KB
39 KB 145ms
145ms Font
font/otf 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Fonts/DomaineDisp-Semibold.otf
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2439eb29fac11292df03993726b4b26c69d7bc65edebd4c1a183f37df3f0447

Request headers

Referer: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Origin: https://www.buzzfond.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Fri, 03 Jan 2014 08:27:36 GMT
server: cloudflare
etag: W/"24576-1207c-4ef0caeac0e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/otf
cf-ray: 711354e07a0a23af-ZRH

GET
H2 200 Gilroy-Regular.otf
www.buzzfond.com/Public/Fonts/ 121 KB
52 KB 32ms
32ms Font
font/otf 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Fonts/Gilroy-Regular.otf
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c033498e9d968673cff0289e25ebb594a2fd83b2973d7b53543faac92974e12f

Request headers

Referer: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Origin: https://www.buzzfond.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 15 May 2021 08:07:02 GMT
server: cloudflare
age: 68414
etag: W/"245a3-1e480-5c259d8661580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/otf
cf-ray: 711354e07a0e23af-ZRH

GET
H2 200 Gilroy-Bold.otf
www.buzzfond.com/Public/Fonts/ 135 KB
74 KB 148ms
147ms Font
font/otf 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Fonts/Gilroy-Bold.otf
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7843dbf33f2eb996f407f21acb322db23be1a6cb72c049fb1f7f779a8ffc519

Request headers

Referer: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Origin: https://www.buzzfond.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Mon, 22 Mar 2021 02:14:56 GMT
server: cloudflare
etag: W/"245a1-21a84-5be16a1c2a800"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/otf
cf-ray: 711354e07a0f23af-ZRH

GET
H2 200 DomaineDispMedium.woff.ttf
www.buzzfond.com/Public/Fonts/ 59 KB
25 KB 141ms
141ms Font
font/ttf 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.buzzfond.com/Public/Fonts/DomaineDispMedium.woff.ttf
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6930c4007dda348574ebe771d9b9ec333a4296c8a0e4fed786f5040e68467c30

Request headers

Referer: https://www.buzzfond.com/Public/Css/style.css?v=1.1.1
Origin: https://www.buzzfond.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Sun, 24 Sep 2017 11:28:18 GMT
server: cloudflare
etag: W/"2459f-ea20-559edbd15d880"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/ttf
cache-control: max-age=2592000
cf-ray: 711354e07a1023af-ZRH
expires: Sat, 25 Jun 2022 03:12:51 GMT

GET
H2 200 what-happens-to-your-body-if-you-sleep-with-socks_1.webp
cdn.buzzfond.com/Images/content/what-happens-to-your-body-if-you-sleep-with-socks/ 42 KB
42 KB 152ms
140ms Image
image/webp 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buzzfond.com/Images/content/what-happens-to-your-body-if-you-sleep-with-socks/what-happens-to-your-body-if-you-sleep-with-socks_1.webp
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04b2d174446a243ce8b98e4968fe90225e77253a62a3c138512fbc13f4b017ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: MISS
last-modified: Mon, 07 Feb 2022 01:01:16 GMT
server: cloudflare
etag: "4d00af-a6c4-5d7632342a56e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 711354e0da5523af-ZRH
content-length: 42692
expires: Fri, 27 May 2022 03:12:51 GMT

GET
H2 200 77-incredible-celebrity-cars-we-bet-they-dont-save-on-auto-insurance.webp
cdn.buzzfond.com/Images/cover/ 26 KB
26 KB 156ms
145ms Image
image/webp 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buzzfond.com/Images/cover/77-incredible-celebrity-cars-we-bet-they-dont-save-on-auto-insurance.webp
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72e5f728922d5d66f06b2c60c65010553173cea2d08c6fac92df6540bc5248fd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: MISS
last-modified: Wed, 16 Dec 2020 07:27:10 GMT
server: cloudflare
etag: "3291d-6736-5b68fcdaddcdb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 711354e0da5723af-ZRH
content-length: 26422
expires: Fri, 27 May 2022 03:12:51 GMT

GET
H2 200 a-tour-inside-steve-harveys-15-million-heavenly-new-atlanta-mansion.webp
cdn.buzzfond.com/Images/cover/ 28 KB
28 KB 155ms
144ms Image
image/webp 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buzzfond.com/Images/cover/a-tour-inside-steve-harveys-15-million-heavenly-new-atlanta-mansion.webp
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d67183dbc3efe1173064a66963608046766bd4c8ab8806aa53995e8fe571c75d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: MISS
last-modified: Wed, 26 Aug 2020 02:29:00 GMT
server: cloudflare
etag: "1faae1-7108-5adbe951c0a85"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 711354e0da5823af-ZRH
content-length: 28936
expires: Fri, 27 May 2022 03:12:51 GMT

GET
H2 200 20-incredible-uses-of-vicks-vaporub-you-dont-realize.webp
cdn.buzzfond.com/Images/cover/ 11 KB
11 KB 187ms
176ms Image
image/webp 104.16.113.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buzzfond.com/Images/cover/20-incredible-uses-of-vicks-vaporub-you-dont-realize.webp
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.113.65 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d29b2e7dd9b174a0763ec7ad831de70eb28fbf0e9bc338023abe6eb647708d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
cf-cache-status: MISS
last-modified: Fri, 22 Oct 2021 02:44:35 GMT
server: cloudflare
etag: "1faa72-2a3a-5cee7fdd69a21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 711354e0da5a23af-ZRH
content-length: 10810
expires: Fri, 27 May 2022 03:12:51 GMT

GET
H2 200 json Show response
trc.taboola.com/1040822/trc/3/ 2 KB
1 KB 30ms
22ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1040822/trc/3/json?tim=1653534771336&data=%7B%22id%22%3A83%2C%22ii%22%3A%22%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1653534771328%2C%22cv%22%3A%2220220522-5-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%22%2C%22e%22%3A%22http%3A%2F%2Fpaid.outbrain.com%2F%22%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dhitstour-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1653534771335%2C%22ref%22%3A%22http%3A%2F%2Fpaid.outbrain.com%2F%22%2C%22item-url%22%3A%22https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue%22%2C%22tos%22%3A3%2C%22ssd%22%3A1%2C%22scd%22%3A46%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040822/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9dad4e03374208bc27394176dc42eb53830b7f9c6b248514de9d4aa4998ef821

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-vcl-time-ms: 16
date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
server: nginx
x-timer: S1653534771.350459,VS0,VE16
x-served-by: cache-hhn4055-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 json Show response
trc.taboola.com/1162268/trc/3/ 2 KB
1 KB 23ms
23ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1162268/trc/3/json?tim=1653534771371&data=%7B%22id%22%3A333%2C%22ii%22%3A%22%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1653534771328%2C%22cv%22%3A%2220220522-5-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%22%2C%22e%22%3A%22http%3A%2F%2Fpaid.outbrain.com%2F%22%2C%22cb%22%3A%22TFASC.trkCallback1%22%2C%22qs%22%3A%22%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dhitstour-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1653534771340%2C%22ref%22%3A%22http%3A%2F%2Fpaid.outbrain.com%2F%22%2C%22item-url%22%3A%22https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue%22%2C%22tos%22%3A7%2C%22ssd%22%3A1%2C%22scd%22%3A46%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040822/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ea110bca5902995d5d57f0d74ad54124a9cbeeab1169b50fcbde4ff9e9cacf9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-vcl-time-ms: 16
date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
server: nginx
x-timer: S1653534771.376155,VS0,VE16
x-served-by: cache-hhn4055-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205230101/ 314 KB
112 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205230101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8173359565788166&plah=www.buzzfond.com&bust=31067756

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4bf76e126fa009e176c86ada1aabed072f81e7774e5c327400cb45478beda168

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114385
x-xss-protection: 0
server: cafe
etag: 8306869019495222350
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 26 May 2022 03:12:51 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220523/r20190131/ Frame B0B2 10 KB
5 KB 120ms
38ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220523/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5116
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4404
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 01:47:35 GMT
etag: 3347421328414474149
expires: Thu, 09 Jun 2022 01:47:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 94 KB
37 KB 126ms
44ms Script
application/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-TDK7ZHC

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WSPQTFJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5b0c111073f2332d32b3e9422ac088f1f9a255532a6cbc1839895dfde44f7e8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37479
x-xss-protection: 0
expires: Thu, 26 May 2022 03:12:51 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 8 KB
3 KB 29ms
7ms Script
application/x-javascript 104.90.180.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WSPQTFJ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.90.180.98 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-180-98.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7e8ef05a55eafab5277e6449520107db94dfb01b497a52f283e7ffa6ee49363d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Thu, 26 May 2022 03:12:51 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Feb 2022 12:30:38 GMT
Server: AkamaiNetStorage
ETag: "23b34d08f648c3f51b232443afced826:1644409863.170279"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3150
Expires: Thu, 26 May 2022 03:32:51 GMT

GET
H2 200 json Show response
trc.taboola.com/1042653/trc/3/ 2 KB
1 KB 23ms
23ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1042653/trc/3/json?tim=1653534771498&data=%7B%22id%22%3A170%2C%22ii%22%3A%22%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1653534771328%2C%22cv%22%3A%2220220522-5-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%22%2C%22e%22%3A%22http%3A%2F%2Fpaid.outbrain.com%2F%22%2C%22cb%22%3A%22TFASC.trkCallback2%22%2C%22qs%22%3A%22%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dhitstour-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1653534771498%2C%22ref%22%3A%22http%3A%2F%2Fpaid.outbrain.com%2F%22%2C%22item-url%22%3A%22https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue%22%2C%22tos%22%3A165%2C%22ssd%22%3A1%2C%22scd%22%3A46%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040822/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f80916a31281cb9d243b56400a624d914c995c0198ee7ef3b486cdc14f53afb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-vcl-time-ms: 17
date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
server: nginx
x-timer: S1653534772.502083,VS0,VE17
x-served-by: cache-hhn4055-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1042653/ 55 KB
17 KB 7ms
7ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WSPQTFJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1f322935e772a438d6ea519a6422103df0cea4fb4e1a5f3b04ee20cfdaad3f58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-version-id: AgfMQObu81l4DBFARvms8keaEE1ZFnS4
content-encoding: gzip
etag: "68df1f3e27448f08aaa7d2102b22cebb"
age: 0
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 17378
x-amz-id-2: 5uhcl18m9DfrXg/0CxR46/8ZwnFVJI8pZNb95jsiAbo4XVy0F1+zP9Ml8CYhQ0iCFH4FoRGAtWcAdj0FGCyQRA==
x-served-by: cache-hhn4055-HHN
last-modified: Sun, 22 May 2022 11:21:31 GMT
server: AmazonS3
x-timer: S1653534772.502301,VS0,VE1
date: Thu, 26 May 2022 03:12:51 GMT
vary: Accept-Encoding
x-amz-request-id: XZMKJF0EJF49RCDE
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 70
x-cache-hits: 1

GET
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 43 B
256 B 450ms
117ms Image
image/gif 70.42.32.159
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.outbrain.com/unifiedPixel?marketerId=00bc4ac2ce0b69ec73bf946bbd8a749e0a&obApiVersion=1.0-gtm&obtpVersion=1.6.0&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&optOut=false&ob_click_id=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&bust=025925404709172817
Requested by: Host: www.buzzfond.com
URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.159 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Thu, 26 May 2022 03:12:51 GMT
Cache-Control: no-cache
X-TraceId: deb8d69b08431ccb0bd29301c5e6b0bd
content-encoding: gzip
Content-Length: 60
Content-Type: image/gif;

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
646 B 150ms
44ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.buzzfond.com&callback=_gfp_s_&client=ca-pub-8173359565788166

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205230101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8173359565788166&plah=www.buzzfond.com&bust=31067756

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86bfadb072579433073974de1ad02a98fa6c0931f582d7e1a3a50947f6305f14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 132ms
46ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.buzzfond.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 125ms
45ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.buzzfond.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 May 2022 03:12:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EF9F 185 KB
48 KB 925ms
851ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&adk=1812271804&adf=3025194257&lmt=1653534771&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771463&bpp=2&bdt=225&idt=122&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3645075113578&frm=20&pv=2&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=135

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dbc5aab7ffa1ef622b29a49bb2d4dda993c70188713d283824436ccda2db5540

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 49441
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
expires: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B513 71 KB
29 KB 504ms
439ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=5340369745&adk=3537927020&adf=1723549077&pi=t.ma~as.5340369745&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771465&bpp=2&bdt=227&idt=141&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=266&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=0iYbzFb6PX&p=https%3A//www.buzzfond.com&dtd=145

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04bc19d01fed0f201fa71aab93f41bbb1f3d15bfa4063b8185f4bcfe60514690

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 29239
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
expires: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DB62 88 KB
32 KB 753ms
693ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=3668195423&adk=564037218&adf=193788922&pi=t.ma~as.3668195423&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771467&bpp=1&bdt=229&idt=145&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=1164&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=lfJ1OriDvZ&p=https%3A//www.buzzfond.com&dtd=148

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2882653a857d312314c28563f5cd6a6504208234ff08b19d2d43c6017477ba0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 32963
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
expires: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 117ms
38ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WSPQTFJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 5885
date: Thu, 26 May 2022 01:34:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 26 May 2022 03:34:46 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 45ms
45ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=968036649&t=pageview&_s=1&dl=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&dr=http%3A%2F%2Fpaid.outbrain.com%2F&ul=en-us&de=UTF-8&dt=What%20Happens%20To%20Your%20Body%20If%20You%20Sleep%20With%20Socks%20-%20BuzzFond&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEABQAAAAC~&jid=1326092057&gjid=761658802&cid=1135698774.1653534772&tid=UA-61791336-3&_gid=905163874.1653534772&_r=1&gtm=2wg5n0WSPQTFJ&cd5=bf&z=579573142

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.buzzfond.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:51 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.buzzfond.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
440 B 57ms
19ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-61791336-3&cid=1135698774.1653534772&jid=1326092057&gjid=761658802&_gid=905163874.1653534772&_u=YAhAAEAAQAAAAC~&z=897931183

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.buzzfond.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 26 May 2022 03:12:51 GMT
content-type: text/plain
access-control-allow-origin: https://www.buzzfond.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 17948887663691194815
tpc.googlesyndication.com/daca_images/simgad/ Frame B513 36 KB
36 KB 135ms
47ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/17948887663691194815

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=5340369745&adk=3537927020&adf=1723549077&pi=t.ma~as.5340369745&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771465&bpp=2&bdt=227&idt=141&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=266&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=0iYbzFb6PX&p=https%3A//www.buzzfond.com&dtd=145

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a30aa9785bdf516c0f4721d942e43ac5652ed6c183a9400bed4eb50706d7c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 03:06:06 GMT
x-content-type-options: nosniff
age: 86806
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36974
x-xss-protection: 0
last-modified: Tue, 24 May 2022 13:23:27 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 25 May 2023 03:06:06 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame B513 21 KB
9 KB 123ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:29 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame B513 3 KB
1 KB 130ms
46ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B513 136 KB
42 KB 63ms
54ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame B513 17 KB
7 KB 125ms
41ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 02:59:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 780
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 02:59:52 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame B513 32 KB
13 KB 175ms
91ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

170aba10d06d97475a89f9e6a41fd239eccdc9b66321b123a9579740ea9e2b32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 00:00:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11539
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13007
x-xss-protection: 0
server: cafe
etag: 15107675193488962307
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 00:00:33 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B513 0
0 79ms
79ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C093YM_COYo7dKoaRjuwP6e-KkA2V29bEaenF8tCCEIqo68nyLhABIIPH5B5gleKQgqAHoAH88__HAsgBAqkCRqIZcKZAZz6oAwHIA8kEqgSpAk_QxlQzneVxd9e1Sw_O2q4DyriKHWUuKaETYfoas_R7lE2vntfT1jOLbPUWcWZLp_Pshf8q7uCdNKKT80MFfjFiC4bmnk_M_hB43vKLGM-zTjasdVWaVm1bDBCIinWeHb0UokxpBl9epFzCmU1dpapdgwa3dHTWPHiK8rZ026lE05oFfoNxnvAD-0pB5Lq1_FKNlHnoK1BNeDbFGeudujyFZbq-xmdgn0ll1hMvRtx8jid0PkxUJIAhxf4chugu1o86VQQHaTteRzUhijh9QzZ4pN6iEoFsFYgCxW-pJTSvIk8ybD01c46Yjg54dFwp8cl3KfRGREiM3KmC-20lEN8bPexXIYQ38rYXFKr8CSsiw890AbbhECNIorhKWLs3ZAPPXijjlR3c_sAEtLzwzIMEoAYCgAfsi4C4AagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEOiOBdIICQiA4YAQEAEYH4AKAcgLAdgTA9AVAZgWAYAXAbIXHAoaCAASFHB1Yi04MTczMzU5NTY1Nzg4MTY2GAA&sigh=6SbI_ibM1Ks&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=5340369745&adk=3537927020&adf=1723549077&pi=t.ma~as.5340369745&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771465&bpp=2&bdt=227&idt=141&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=266&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=0iYbzFb6PX&p=https%3A//www.buzzfond.com&dtd=145
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FA19 143 B
163 B 36ms
36ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=5340369745&adk=3537927020&adf=1723549077&pi=t.ma~as.5340369745&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771465&bpp=2&bdt=227&idt=141&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=266&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=0iYbzFb6PX&p=https%3A//www.buzzfond.com&dtd=145
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2861
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 02:25:11 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B513 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d55f94b01d0a5e7962dfdbd10e6525078aca29385c09c9119fc43545c877a3e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame FA19
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

53ms
53ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 03:12:52 GMT
expires: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 03:12:52 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 d621b03a35f4c7525d5f66bc0317e797.js Show response
www.gstatic.com/mysidia/ Frame DB62 9 KB
4 KB 125ms
42ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d621b03a35f4c7525d5f66bc0317e797.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=3668195423&adk=564037218&adf=193788922&pi=t.ma~as.3668195423&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771467&bpp=1&bdt=229&idt=145&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=1164&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=lfJ1OriDvZ&p=https%3A//www.buzzfond.com&dtd=148

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cba179f85e06c1302fec3484afc33d4e658aa2841564b64f31dc81dff33300ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 18:25:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3695
x-xss-protection: 0
last-modified: Thu, 12 May 2022 07:58:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 18:25:46 GMT

GET
H2 200 7d60ffe73ea98b9ecf112e176f5f0245.js Show response
www.gstatic.com/mysidia/ Frame DB62 15 KB
7 KB 119ms
36ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7d60ffe73ea98b9ecf112e176f5f0245.js?tag=pingback

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73c40374ec6beeae8ef306a7e771d27b61f2059861ff39715c3f02ca4c1cb5ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 13:57:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 220550
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
last-modified: Thu, 12 May 2022 07:58:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 13:57:02 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame DB62 8 KB
1 KB 133ms
49ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 May 2022 01:34:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 26 May 2022 03:12:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame DB62 2 KB
904 B 38ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:57 GMT

GET
H2 200 a44a0b8f447061e92ca19622c4392a02.js Show response
www.gstatic.com/mysidia/ Frame DB62 6 KB
2 KB 122ms
40ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a44a0b8f447061e92ca19622c4392a02.js?tag=analytics_pingback_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa3777d578531c63cb5b48a28d1f0135a9769ca2ee44ae916aadb341089140e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 19:27:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 200718
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2233
x-xss-protection: 0
last-modified: Thu, 12 May 2022 07:58:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 19:27:34 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame DB62 21 KB
8 KB 112ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame DB62 3 KB
1 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DB62 136 KB
42 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame DB62 17 KB
7 KB 109ms
40ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 200 937d951ae0167fdfcf48a5545b1fd715.js Show response
www.gstatic.com/mysidia/ Frame DB62 30 KB
12 KB 118ms
39ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/937d951ae0167fdfcf48a5545b1fd715.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b84c26fc972d527005b6353058ff181ca9dfbb9047bed018e6b019f965d3cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 14:13:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219585
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12375
x-xss-protection: 0
last-modified: Thu, 12 May 2022 07:58:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 14:13:07 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DB62 0
0 80ms
79ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CETPuM_COYujeKsGXrATM353YA-7E75lqx6eU_PcP2dkeEAEgg8fkHmCV4pCCoAegAfGD_ZUDyAEBqAMByAPLBKoEogJP0C-p0TJOEz8-sFJWYYzqHbD9sN2s8FMiaVxn6EVdy-7pn9CCB5GElsTkhOMzeBGDpdMRnCCwo9E4elYc5SDmNBDEEQXHa4cz2fCo0NDthcsbozosBz-xVKhm73_p2nfcait_YfXa-WGxVyxQTmiKmbcOTBpa5jfyzjZ4FZtBhU494LAganC8pa7JTHsT1eT7ZhUNBLy-q8PvuC8-zUlpawSxoi6E7nCmlw2OjreUpPBbqhZOEAxosHM6GeXrBy5YHsZtfEbGWmjlidVIo6d01eNS3n1Vohdh6VTlqtpL5kc_fHRQE6fHlUcsU7HH1ipHeQKbZTXletB0SN5iM-tdaUq5gHZYVlEX45aLxpclrSySnag_pvPf6lZgJ_EDFyleU8AE-MWDzZIEgAeEiNx_qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQgvMG0ggJCIDhgBAQARgfgAoByAsB2BMD0BUBgBcBshccChoIABIUcHViLTgxNzMzNTk1NjU3ODgxNjYYAA&sigh=-p2F3rRJ-uE&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=3668195423&adk=564037218&adf=193788922&pi=t.ma~as.3668195423&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771467&bpp=1&bdt=229&idt=145&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=1164&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=lfJ1OriDvZ&p=https%3A//www.buzzfond.com&dtd=148
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8360 143 B
163 B 37ms
36ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=3668195423&adk=564037218&adf=193788922&pi=t.ma~as.3668195423&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771467&bpp=1&bdt=229&idt=145&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=1164&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=lfJ1OriDvZ&p=https%3A//www.buzzfond.com&dtd=148
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2861
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 02:25:11 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DB62 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6fb16a7114ad02b30e411574afa76430c7faf567e437f6e1fe1ef103845a0aa9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v44/ Frame DB62 28 KB
28 KB 126ms
39ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v44/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 24 May 2022 22:12:07 GMT
x-content-type-options: nosniff
age: 104445
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28276
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:33:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 May 2023 22:12:07 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205230101/ 147 KB
52 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205230101/reactive_library_fy2019.js?bust=31067756

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a20a7f38a2b97aaff2e9efb1615e2bfed5770fb84f54a2ddc8b2c365e6e44d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53671
x-xss-protection: 0
server: cafe
etag: 2983380312948168671
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 125ms
47ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.buzzfond.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 118ms
45ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.buzzfond.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D137 24 KB
11 KB 325ms
325ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a942a97f2bdbdda6b213510a33dcbdf369532baee90c2f21f81c6c01c90534f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 11695
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7E5D 132 KB
43 KB 324ms
323ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c7239a044877cfd3dc7bdd67523e2fe698edd2fd4886ea52a6b3cedb17dc8f4

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLGl_YWZ_PcCFRmDgwcdAisO8A&gqi=NPCOYuX5Jr397_UPnaaW2AI&layout=/sadbundle/%24csp%253Der3%24/13286003456218249693/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 44231
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLGl_YWZ_PcCFRmDgwcdAisO8A&gqi=NPCOYuX5Jr397_UPnaaW2AI&layout=/sadbundle/%24csp%253Der3%24/13286003456218249693/index.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 503C 132 KB
43 KB 337ms
337ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2621bf47f6f2d4593cdacd431c534fb67d841ba040d9c5e00cd23e8d4cbff973

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CO7Y_YWZ_PcCFf-JgwcdJ7MNXA&gqi=NPCOYt6jJ_Ox7_UPhLGhGA&layout=/sadbundle/%24csp%253Der3%24/13286003456218249693/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 44290
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CO7Y_YWZ_PcCFf-JgwcdJ7MNXA&gqi=NPCOYt6jJ_Ox7_UPhLGhGA&layout=/sadbundle/%24csp%253Der3%24/13286003456218249693/index.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F4BE 74 KB
31 KB 284ms
283ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae3d8bf762457b735c4a211756caeea9c394cb713605cf5d51b04b68d2df3c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 31377
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame E82B 35 KB
13 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB62 0
20 B 72ms
72ms Ping
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoRCAEqDWJhbm5lci1ub2xvZ28KCggCKgZzZXJ2ZXIKFQgEKhFteXNpZGlhX2FuYWx5dGljcwoNECshAAAAAAAAKEAwBAoNEAMhAAAAmplFjEAwBAoNEAohAAAAAAAAJ0AwBAoNEA0hAAAAAAAAAAAwBAoMEB4qBjcyOHg5MDAECgwQGSoGNzI4eDkwMAQKDRAOIQAAAAAAAAAAMAQKDRAEIQAAAMzMqIxAMAQKDRAPIQAAAAAAAAAAMAQKDRArIQAAAAAAADtAMAQKDRAFIQAAAJqZqYxAMAQKDRAQIQAAAADgPeBAMAQKDRARIQAAAACAMdBAMAQKDRASIQAAAAAAABRAMAQKDRATIQAAAAAAAAhAMAQKDRAXIQAAAJqZhY1AMAQSGkNLakV3NFdaX1BjQ0ZjRUxpd29kekc4SE93Ihx0ZXh0L21hY2F3X3dpbGRjYXRfbG9uZ3RpdGxlKBU=

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/7d60ffe73ea98b9ecf112e176f5f0245.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8360
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

60ms
60ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 03:12:52 GMT
expires: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 03:12:52 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 45ms
44ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.buzzfond.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/ Frame CC68 10 KB
4 KB 36ms
36ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5613
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4404
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 01:39:19 GMT
etag: 3347421328414474149
expires: Thu, 09 Jun 2022 01:39:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/ Frame DF9B 10 KB
4 KB 36ms
36ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 5613
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4404
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 01:39:19 GMT
etag: 3347421328414474149
expires: Thu, 09 Jun 2022 01:39:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame CC68 4 KB
633 B 128ms
48ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cba47082178b1574a96fa49c257693082949237914f632073da2f476dc81e0db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 May 2022 01:32:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 26 May 2022 03:12:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame CC68 205 B
229 B 40ms
39ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 02:33:07 GMT
x-content-type-options: nosniff
age: 2385
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 26 May 2023 02:33:07 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame CC68 604 B
628 B 40ms
39ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 00:51:46 GMT
x-content-type-options: nosniff
age: 8466
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 26 May 2023 00:51:46 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/elements/html/ Frame CC68 19 KB
8 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01284adf0039080c4d89732ef83440fd31b310a7bf3867b83b030f99ffd1f1c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 01:29:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6227
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8280
x-xss-protection: 0
server: cafe
etag: 1405619832300133377
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 01:29:05 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DF9B 0
0 78ms
78ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CkE4AM_COYoPbKtiPjuwPhYiW2A7JntKxXLWY49aTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi04MTczMzU5NTY1Nzg4MTY2oAHVttLqA8gBCakCsRsSbCbssT6oAwGqBIwCT9B_AfbDhC9iA9LPeqGXRWXI3A_8txw9nUd04HXeHDIvIaPRMv5EbAhmJGvLADuJ6cGQBXRMV8LuAPWEpfeUPr3Pnr3DPgEfCMr7Dj_Zsc3jnwFXQ4RqQP-kxxisDZ0sVqiDemVnu5J4wTVdJqmgmqYHvSQaNRLTR9DeOY4WlA26M93--SGfVkXEOv7ApUKMpq2QFspEEywZyuGXnU1QGqiyokFB0xKkcjK_Tx96FRlguyUZKWhbHrsXrGfJkIm0Jlrc2tMzqs4ycwE9dRv41mZhp676a7_QnsaybzOZXVwijbllFYw01pg5JXEM-Li6K4mGXk3PXng4jTEJnkuB0OEq3TahUqizF7-VxoAGs9CYnN7m15vhAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTgxNzMzNTk1NjU3ODgxNjYYAA&sigh=buPo8bKIzsQ&uach_m=[UACH]&cid=CAQSGwCNIrLM-N6vd2ar7SZIiGtoRUW8s4D5JEVD1hgB

Requested by

Host: paid.outbrain.com
URL: http://paid.outbrain.com/network/redir?p=TV-jqloioZ5gh9rbmhG_8hGi5SyowVGcgT7q1Mmv265XX_AdtaTi1qblawwXfIyYngF44vH7uQl7UfinpEPP4aYE_r6_XctflwkUrNR-7ZgKYg3_CIXG8K69fFPIiN4eEizMtiXCVi9MtGsAP2kUVsJxGTySksPVm75LjjNeJGw_8tVZsHVsv-MlfEVTia9YTsZpN0DUCaSZk2mA-3uiGjNECk5IRtnykkJmMQZToI804_j9aLMKYq9vcLGzEICyLSUWkmEK466RqmYngFJ6_BrgRu9Wha7NTi99uS5IZpTzNhxImhiVtD38cVU09ZXN&c=62c3ae31&v=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame DF9B 0
0 49ms
15ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kJKhEcz6RO0HfJ2DYgICAAAAX20n-6_hTTcQM_COYtcAAhf1L84XhSUwABIAAA&wp=Yo7wMwAKrYMHg4fYAAWEBdOj9llteKY0BasEtA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
server: Kestrel
server-processing-duration-in-ticks: 295330
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 3E53 240 KB
63 KB 182ms
145ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo7wMwAKrYMHg4fYAAWEBdOj9llteKY0BasEtA&u=%7COD76M4ZFJ4r%2BqIX4kvy29nuH3DTd5dq5ITHUOi0aPYo%3D%7C&c1=YJ4X_nXZn4MS-Vyc1jpPlV4VTPO6xzWbMW9ePYRMUYXVfUoF4cAXWYg8h5DGKhCYavayMK6vuCRr10tlpRuaBSJD0Oq4BuzZQn7Fr-jeF00WX9wIE2UEcRJgyZYC6zMM1fbEmH6_rKzWB-I8-4PMaQy6KxxqfBslK0lBooe4k7cem9D09Br1g0F2chHw7AVEsCSTs-APStkBDvHmmSWrthjcAuipv5xYKZXGZXSosV54ucPtwEAXnIAU2VEuEW380dNt00cLC41U9L1mtMO79tYwyPFrcnPP-0XwPz1pRJBdy2RjkCUXuJ3vptkCudVV6M0ig33SlBWSxU63y-J1BJlor0dAANBBwzeuLK38jlUnegAApFNhHm3h8jMNHM2d6j7TUcL891iRiAu5v7VZ-Dq5Ve2m_EXg5cjOZQY4-LIYwXBa-txfHRLRLmjpgLkBcHG4rbBoUlXkgc-OS6PWWRqDUUzDyZ_L&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv4RJM_COYoPbKtiPjuwPhYiW2A7JntKxXLWY49aTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi04MTczMzU5NTY1Nzg4MTY2oAHVttLqA8gBCakCsRsSbCbssT6oAwGqBI8CT9B_AfbDhC9iA9LPeqGXRWXI3A_8txw9nUd04HXeHDIvIaPRMv5EbAhmJGvLADuJ6cGQBXRMV8LuAPWEpfeUPr3Pnr3DPgEfCMr7Dj_Zsc3jnwFXQ4RqQP-kxxisDZ0sVqiDemVnu5J4wTVdJqmgmqYHvSQaNRLTR9DeOY4WlA26M93--SGfVkXEOv7ApUKMpq2QFspEEywZyuGXnU1QGqiyokFB0xKkcjK_Tx96FRlguyUZKWhbHrsXrGfJkIm0Jlrc2tMzqs4ycwE9dRv41mZhp676a7_QnsaybzOZXVwijbllFYx21Lmrov6Q6wcmPypWY-s3V2wyOzsnhsk1GNyML4m_frA2vTuGebpYF4AGs9CYnN7m15vhAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2-INyeRgL--DStg4rd7apusJo8SQ%26client%3Dca-pub-8173359565788166%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4f6986c286d003e7dfc6ac2c845165de38d935032b49b6a61ed72cec76ae025a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:52 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=8jfPKKApbAriX40uMu_l4HgNSDkZuoBs4txC6v33KJNZY1nkLhoXIi5MUyc8pJ2P4BsBwvuqg19OyIiBKX4uhBN0a6X3uLv4fVTDbV_TIwu1VkzH1dFc2Cqp_y1w7Hux3Lo0wGNsJrx6Kd38OF9hIHoEtcotj4sGFj7iv0xLQ10hEc51QXBFh3xfJfjfbHwl5VRlN8gZf7f3d8k-KitJ7s3Xcqj0eoWdTp7I0WrHAXyZ5YBVSO1RuimSgAL2Ikm_fv59Vw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 130258176
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame DF9B 3 KB
1 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 769
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DF9B 136 KB
42 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:52 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame DF9B 17 KB
7 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame 5291 35 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H2 204 unip Show response
trc-events.taboola.com/1040822/log/3/ 0
248 B 126ms
14ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1040822/log/3/unip?en=pre_d_eng_tb&tos=1568&scd=46&ssd=1&est=1653534771332&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1653534772901&vi=1653534771328&ri=8320948486f3c979bdecddd14d0d1f49&ref=http%3A%2F%2Fpaid.outbrain.com%2F&cv=20220522-5-RELEASE&item-url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.buzzfond.com
pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 unip Show response
trc-events.taboola.com/1042653/log/3/ 0
247 B 126ms
15ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1042653/log/3/unip?en=pre_d_eng_tb&tos=1569&scd=46&ssd=1&est=1653534771332&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1653534772902&vi=1653534771328&ri=b6fc698ea0b507adc08a98cf00c97966&ref=http%3A%2F%2Fpaid.outbrain.com%2F&cv=20220522-5-RELEASE&item-url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.buzzfond.com
pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 unip Show response
trc-events.taboola.com/1162268/log/3/ 0
247 B 125ms
15ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1162268/log/3/unip?en=pre_d_eng_tb&tos=1570&scd=46&ssd=1&est=1653534771332&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1653534772903&vi=1653534771328&ri=2e148219453b62f48a02b4463f26b669&ref=http%3A%2F%2Fpaid.outbrain.com%2F&cv=20220522-5-RELEASE&item-url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.buzzfond.com
pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
DATA 200
OK truncated
/ Frame DF9B 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2adc08ef063571d56558d6a6f06d3e2d5fb2041f0335f1389401b71094d9e9b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 523745527312232507
tpc.googlesyndication.com/simgad/ Frame F4BE 35 KB
35 KB 37ms
37ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/523745527312232507?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkTcLTa9aoyH8nCiZ7jtcAINj1bSA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc667f2ef8dff50a11d49c56e128d27c4282b977a62434544dea160c112ed035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Sun, 22 May 2022 21:12:09 GMT
x-content-type-options: nosniff
age: 280843
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36124
x-xss-protection: 0
last-modified: Tue, 08 Mar 2022 08:22:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 22 May 2023 21:12:09 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame F4BE 21 KB
8 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame F4BE 3 KB
1 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F4BE 136 KB
42 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame F4BE 17 KB
7 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame F4BE 0
0 47ms
46ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTF_ZrFL1CJOHbKrRBFcVGME2xJN6o1b_KN47zXQI7_3FZGlZD5gdatYbmenRNAg6BE0ExqdmlxSPs8V7PRmmX96ub6tA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame F4BE 32 KB
13 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

170aba10d06d97475a89f9e6a41fd239eccdc9b66321b123a9579740ea9e2b32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 00:00:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11540
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13007
x-xss-protection: 0
server: cafe
etag: 15107675193488962307
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 00:00:33 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB62 0
20 B 72ms
71ms Ping
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoRCAEqDWJhbm5lci1ub2xvZ28KCggCKgZzZXJ2ZXIKFQgEKhFteXNpZGlhX2FuYWx5dGljcwoNEBQhAAAAAOBd6EAwBAoNEBUhAAAAAAAAKkAwBAoNEBYhAAAAAAAAFEAwBAoNEBghAAAAmpmXk0AwBAoNEDIhAAAAAKCZyT8wBAoNEDMhAAAAAKCZyT8wBAoNEDQhAAAAAKCZyT8wBAoNEDUhAAAAAKCZyT8wBAoNEDYhAAAAAKCZyT8wBAoNEDchAAAAAKCZyT8wBAoNEDghAAAAQDNzTkAwBAoNEDkhAAAAZmaOh0AwBAoNEDohAAAAAADoh0AwBAoNEDshAAAANDODjUAwBAoNEDwhAAAANDODjUAwBAoNED0hAAAAmpmFjUAwBAoNED4hAAAAMzN7k0AwBAoNED8hAAAAMzN7k0AwBAoNEEAhAAAAZmaek0AwBBIaQ0tqRXc0V1pfUGNDRmNFTGl3b2R6RzhIT3ciHHRleHQvbWFjYXdfd2lsZGNhdF9sb25ndGl0bGUoFQ==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/7d60ffe73ea98b9ecf112e176f5f0245.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame F4BE 0
0 83ms
82ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CDLWeNPCOYqCVKLiLjuwPwueT6AXWn4Clar2Bvbu7D9nZHhABIIPH5B5gleKQgqAHoAH62ZqnAcgBAqkC9SwSEe9pcD6oAwHIA8kEqgScAk_QvQSNGvZuBKQrD95bNpmuonHtKWFTPU3FsGQXq81eNw1b8hn3_jJZIziPwY7HwHpVsauGgqT9uliebfwhVXR7H2uSCT7De5eJVbukn1963Ve6FSktiie99hN2eIkrSeyECzv4ZdYcWl3sla28bfoQL00gkk9bfx_3gknAoB6tBD0x7bWmT__qDAddFYuH-lnMajgaJ8jD7GPKJNmmzCBapS2yrogGeVsa9OX3EnPcklYjXM6wAnM9Uab0o_H4pBOwklGIaUOsYYer5lpKo7mX813TyBVwzHp24ofsjo4VJVzysubPQil0qCA0B2_vQ28b7MpffTJQalMhYNuAxQkkI4rtOZzrtprKxzo2p334iL787porsfInS4kiwASYkM26_QOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH7qXl2AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBD-hRHSCAkIgOGAEBABGB-ACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItODE3MzM1OTU2NTc4ODE2NhgA&sigh=KxGm3-UJ-FM&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 938D 8 KB
892 B 48ms
48ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 May 2022 01:37:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 26 May 2022 03:12:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 938D 2 KB
904 B 63ms
62ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:57 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame 938D 21 KB
8 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 144
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 938D 3 KB
1 KB 62ms
61ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 938D 136 KB
42 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 938D 17 KB
7 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 200 937d951ae0167fdfcf48a5545b1fd715.js Show response
www.gstatic.com/mysidia/ Frame 938D 30 KB
12 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/937d951ae0167fdfcf48a5545b1fd715.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b84c26fc972d527005b6353058ff181ca9dfbb9047bed018e6b019f965d3cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 14:13:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219586
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12375
x-xss-protection: 0
last-modified: Thu, 12 May 2022 07:58:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 21 Aug 2022 14:13:07 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4AC3 624 B
297 B 48ms
47ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU3VnfTJSH1Jk2w0PPlf78hrCrSJ011XAukBvWV9Stf6UjycnONrewcgquBQaAfnhulLUfxp_RaDUsXXWFdUSTsxErkvc9eQIiRumXmfHCjwqy9YNkb21dFXWhLngLLJe2F0nzZbfkJHzDyLKfNEmGHjqfdIx5Q7a1IHS0uFtoPTGL324w

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FEF2 14 KB
10 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnfCuJGAqtFE64ToASzJNZ-_5P6iFWUkwX0CES9m4jkyzF-FuG9w16k1hZwSlINLaXWWPEHPEKMS0UCKLWkt8bxj0HUJjCRLU9-gCo4PmA6wzuFPAGGVinQdKRvEDC8T59j8KaWY-kI1UXRdsMojb0VHnXSw&cry=1&dbm_d=AKAmf-DG8tgGm8zmj2513XNA5wWn4yRlKT4vZYfzIApt2uOcMn-Q4cnPuAj_bwv3Y0UMzBWPfQ5yi449NZTfj_g7C6tqD4QCuEGckPJ9uWRKZpc4ly4Wr_SJaWPgZeeCg5-Ip7xtIg8mQv34RuyEIsbtf-oi7BKlu4jXloOY_6RZtrW82w27YuS8jrozn5ZecWGsLyhu-ecpiA4_m1KZMHxCnsNAowC-tQGerFGwb_W2Zg7BjtXjZ0b0cRX4qDgUdnTkF2D4t8AKCy1d7oliWkWWAEPCjdoqtbf7ojfv_TWvIll8ADjHK9mS6Z8LZSLmKil7gLiwZu0Qxo9majhtKXgcAosxFljPQO8wDYx148jzZotGDqTX6tegV80vZgv2GPssOy8q3CIEJRAoraaVXXUChtUn3yJYWZfYkjljhkmab8C1UesyB2wgp46ESRSXPQImM8Cq4Lzn2OwrFIEtAj5YN3Gr1hrf5Quu1oZKJWeEyvypCnxadzZPi1EvvNY2Jzi8ha6QB7dAGTzVIVxs8SSRT7_ox81n6Sra8YP3DYMv8RdQnPYrlFMv6RWggNMA-Txg0S7WQcVjTpYKf-EhB9zTtPnWFSvEXmMw3sQGo7sy8OB4r6YpeyVccxk5fLAeDPXRTLMmsfrHuYXTWHp7yZgAEgtmarx0MKtBmIX-tg-dkxcchJKhhOZkhuDHXATnLUo3vsUiYzSEaadUfrKciBdk0yjEYRKWmuUNm0nABlL_sYii9f1K8jDLwwPpPzsLj7ELsfOK1j3H8MEL9ex17h2y4-N4UmXL0Oi_cAhr0_Ch-DSq6KcurTK3RHPA5cvirKO_qJkOW7ckcTaFom4X40REVHqdGVXYJoBUojUOwJOdfwoLtEkB3_qPACQ8s0Rr8RRbKm9my_Z65X-yhzJ3cjUNBs7yJZCXCN1kLJElT7SieZD95LSUL3f7HPmeBcTi7JxYztk4vq73yIIxgiqMp0BK7s0u9rvXt-KNZi7LoFTIUiVPFGuUfa7KzZyO5x-CGFo77Q58z3CfrCO9JhRZtdXp-hyCsCa0zMw8Z3PsEGDoOX-IY8SzXGJ6geZTSxCZAsg-FCnWqDTljzDSgSm928FkmYRZsyw1T3xh1ux1FoOtUWhlsbQX_JoTNozTBz-F13eGA2JIhHu_KBMyzv2_OXjBvksPXtB1YLUCD_CvwiudbYl94EzuWijpe5mnL0G0nrvbVheJNTI8pPO9AJgATZ1JQdR6lCmTe6U_J5pSJJrFL6d79X2lrvvhD7HpNYjL45AKEHzZhq8mr7ZY27LKpn1khS61qYnf7acI5I1Qs0xtcH4ZOIFKraOe0H5SXQ69AjNAVCClUzyjauMbwXhDJrt0B2G3FBF4dqBbB5VCngQcKl_eXABvmvmUwX2vByFDQ_hvHm5oHzsdvP-nxbZezbN0lVUI1FO4GDZVpDBID01bvLJGah7mBpPKGK8xfWSzPaJqTbJfM3P5jxKvujIx1DNoUmAhEDdyK02iZBAbW2MOaqoU_ZmRqWQ1w7VKptvp_ECXl_CN8wW2WE53ltK8SOjp-bnlhODjPO4nPOlbf-GqKB_qd-tMN0U6SViI-6wUgjVX-ddUGTBhjbU7rDzz_VhlP181su7_6B1aFCVsgQYIbyeVhy9ETCLcPZuIt4NCdRe98wZw_biuCbtOlFjlpBZ5WLd0Y9UdwYiYtYoYYhVPYYCCSgxYPQT5beBjLTA8l92ale-NhEOa41LR4F8rheyyoAJAuzG9vsn28bcKKZ54z7_rIRUHtWO24KmPyB75rwUbmgI30fQva3PXeuDKVt7cfg6wQPTJ1M5ECSR4EJiBhwirDm1XsdmZzeeckjv5wgxrCPfRhR4vgBI8cqe2Vfe8lnLVg6e0MCBxe7NPLaK8gG7a1uqA6JIICxj98OryZiZpu8nCykEJuBJ2H17aySaRRDSJFEv8w6OoYOhltShcI52Hor5vnUNfy0RFWxbfk5kuWJQV3xtzA4acXn7xEHrYYpCM31JHS8uy_KOK_xyXdEvzjHqkT6qvHM-LjhBiBKjQYD-WNrrdvnRin8QNA6Cfma_z_E9v087mKrDOoEfdAMHk6hxDcMFspqBF9eP0tkIatjbS3ae6-P1YRWUvTLnqIQTJEiLlDDBTqzxusT5A95ZEyTAvzrmEXqE_myql9VEb-_XByqOqippEiwPxgMc2sxwvRmIzOTv1V7b64yaZgUrzHPXi1ox7SSETghKaKtsNJ6JoL9qzbclfPMAK2YyGMvQekVT3oeW0Vm_3TBl13HWod9dj7SO10iwIiR5MAVjZILVkvVfU7tGHCECKO7DaqzJXkopQuSB4MvprdB6YXuIH56Abg2ua9brF8W-P6htdjZ8LPdrej318OkYTz-R5FMN2CoTy10BqJ8sXHDlDnYQjua4BNvxfkFiAI_TySeyIMKN5Rg4FwLZyMKSPh50Pl25OaSAgHfiiDpYgTIAvGF_vmwWf1iJz5bslxi4B8beYKWQJ2ehoBslZ6Rof5ANwHVrUDiUMm-D9Se08t-IjnYiBVB-iDDBZs3-q13swgsX1dLxeQbyseL9U-o6aig1VwJpZFFzG75f0ob7rarRXH4v-4SB9rOZGPUqI-LPQULnxhOVjzgA8YsYfeF5W8mCIGtbptx45FIgbh20NdRy0uLuHqySeh3eFrIBEXKNRqcr3QaqrV-DRms9Frd9-WWAf7CDQdnPX_E_TcUEO7LATEY2m1FIukVk4JLVwLXLv9i2VArBde5wk20z0MCr6iCFn91DgLAdnBPXk-s7fOAXYZS87gacK1foRTbFvUeqSFq5_fGQ5HGdky5uUXOPSgKTg_7qu-1MzyTZUZAML8EEp10rmkCZpjihX78eBHFmiUqV7GwqQ_4qCPeqMyxUlFYqhjHvWZJ4GVEhio7-2NZzuAi-AXLcrgcutEOW6_8xxW8zoHgtfBqEXEzGzX7ZVpVtRGbtQrEq01IPLE74EYOB92Hg-zPNsrWp_m-oEJzQyWIf4KT2-77QdskjapbVC1BaawtkSoDlM_cVL7SF8BToetdKD_syup5FHeqs2aCZqAka1eGLVcheXDN-bQ5yDdOWQcJfYOwKt9OvAAE0WPclL3UBJnR6lzIFORY4I6mDNt7li8rC9dli7xZlYflU7b9RZUbZMGGqB77vgRRK5TAJJHrbFqh3S0cF70KNwWNqRtHAaCRGb2Q-mb2-Phcpnlnx67BTd9fj7f-WeyQ458CXA9HAPYkTgw-y5WZ480PTk0o4giR7RRq26fhLscHNrIDBemFhr2t94NNhHShJkSToX0IfTQBlaO7PpqIOdwNmLU8fN7F_BUdlR_rzvke7XtEjOTa2Du-eSVKKPb4kVi0R5crjPjZqmH1sxt3iraaLJcfI-_XNJWNN6WyBHzsWFq76baHDbqETVUcmGUesVE6hE2XKhREZmhpng7sWsvKjD0vvz_kl2wnZey1dWFic_-nTFKYhqQaJ80qi3JllV1mAjEIAW04skEjn-NTIF-TRSbr7881rGiAfP4WGXBTsUbUSlJtqHUvQ_TfQqPFBor3QJulxAlUIpFjXV9xInfLKynoWEOmXg7ZNbjj-VxqF0YTDGESMgqto_e21kuQjJD61S-c5kUSeRfcUxQw7YsSH4o0TDmJa1MhNc&cid=CAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ&rfl=2%2Chttps%253A%252F%252Fwww.buzzfond.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9a9c0e6a34440347bfb24f7b85791cb6830205e677250aab2c13847eec1c338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10620
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame FEF2 3 KB
1 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FEF2 136 KB
42 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame FEF2 17 KB
7 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FEF2 42 B
63 B 72ms
71ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DsWRp_9MSNC2JWmria8COKnWHoUO1ABaS0y8VPNYNTw0QwgUCPTm8U_qga8PKCF6cjh4EPntVCFtUaT-hjR0yOMH5_UlI2bwpdNQVKs8gAXnfk7AE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 8 KB
3 KB 39ms
36ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

207b12e06eb1dc5c3c3bf9f868034f970558cd911ab42e9046baa75260dd5422

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 419642
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2579
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Sat, 21 May 2022 06:38:51 GMT
expires: Sun, 21 May 2023 06:38:51 GMT
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9740 0
0 81ms
79ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CP-MINPCOYrG7J5mGjuwPgta4gA-2sfLvab6auIbWD9LfqN6sIxABIIPH5B5gleKQgqAHoAH44PT6A8gBCakCsRsSbCbssT6oAwHIA0iqBJoCT9DNBk6dPzERSdgr0ql3EohGwok9qSw12iObJfJs5oycYyp8VzyH6_A6DYI8T6M9aIQE3r5ChzSE0wE06tHXZVrlK2Faq9mpeArVrhHiNMqPXgQ8AXFpaiJefCQXEzY9BHPH5R-BICpTqXH3j2g-6EvgMU4yxcjWvXAoeQClrhI3hpNppdbfZJO0O1BmhYlNXBaKQUGOPAVfHwXbtQd8iwq6_KKjDxoFNm_MpRd6oEkfH7-QzxyKYKkVA6JuoQdFGXX3zkiwdG9kMJ0fFy6z91-aBOqFWNISe1MpHrJXlVAqJ8hmhy-ApvrwxRabBwGtmDNkimeQW05urOVS8fGYcKOKigjiRCRhkD5RaCSt7AR8IHrL_zKwsS_WwASZ_Yz7uQOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH8J6LBagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEMSADdIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi04MTczMzU5NTY1Nzg4MTY2GAA&sigh=qUiPnmuhOD4&uach_m=[UACH]&template_id=419

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame 9740 21 KB
8 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 144
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 9740 3 KB
1 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9740 136 KB
42 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 9740 17 KB
7 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9740 0
0 47ms
47ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQzd6YYfl1OcCQ8dJw8FTxkgwPsgT0uD_OtGILbScsP_auUUJlMSV9yO4ldclvRQEFY5Y_GpG-nwbNT6TzbN_rUNm_AcQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 8 KB
3 KB 38ms
38ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

207b12e06eb1dc5c3c3bf9f868034f970558cd911ab42e9046baa75260dd5422

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 419642
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2579
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Sat, 21 May 2022 06:38:51 GMT
expires: Sun, 21 May 2023 06:38:51 GMT
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5491 0
0 79ms
79ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cr-CJNPCOYu7uJ_-TjuwPp-a24AW2sfLvab6auIbWD9LfqN6sIxABIIPH5B5gleKQgqAHoAH44PT6A8gBCakCsRsSbCbssT6oAwHIA0iqBJoCT9DkiafVH7QHwAnQBMJBU8lhXRjTHfTqlHBDE3wcWDqK7sGa0JHoNnRA4XgbNjws1k1kxGnLnID7iGHIa1yoEII4NCSlZO924FcgEWF3OdgDro5Bvn7F8egaZKRUVU48HqPoJfIA5X03OLhbPa8Hq46qo7mZLgF1FMtzfTpS7Ypv3pqTRk7BbcLHvF7bNxTX2j7aCa1TJ4srtZ45y7VpDb9f17Z0QLeXlhdTl4zS4g1h0TQT7ZG-JO8L-9nHY1Q9IxuPLgOwJ7XBrGASQlEz0VZbCSYjSoGpq3jTQsoisM-wJuHpXTMnUp74Wyc32ep984cxBYBVJAOFyg27WQuh42BLzPrWr5QzCjTpQjgT6uXP13-FPd0GwhJnwASZ_Yz7uQOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH8J6LBagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEM-NCtIICQiA4YAQEAEYH4AKAcgLAdgTDdAVAZgWAYAXAbIXHAoaCAASFHB1Yi04MTczMzU5NTY1Nzg4MTY2GAA&sigh=STV1nuEeNMc&uach_m=[UACH]&template_id=419

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame 5491 21 KB
8 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:10:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 144
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:10:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 5491 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:00:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:00:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5491 136 KB
42 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42680
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653478767633683"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 5491 17 KB
7 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Jun 2022 03:12:42 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5491 0
0 47ms
47ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRzpz7TXkVGLS0vmgZfWZGDWnRMc9O_N8IfD5oVtehOtfDIGG_CVvs0KYImbFipJnqNlCMiWmwLGC6Znw27GQ07Y0Zeqg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 3E53 2 KB
1 KB 50ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo7wMwAKrYMHg4fYAAWEBdOj9llteKY0BasEtA&u=%7COD76M4ZFJ4r%2BqIX4kvy29nuH3DTd5dq5ITHUOi0aPYo%3D%7C&c1=YJ4X_nXZn4MS-Vyc1jpPlV4VTPO6xzWbMW9ePYRMUYXVfUoF4cAXWYg8h5DGKhCYavayMK6vuCRr10tlpRuaBSJD0Oq4BuzZQn7Fr-jeF00WX9wIE2UEcRJgyZYC6zMM1fbEmH6_rKzWB-I8-4PMaQy6KxxqfBslK0lBooe4k7cem9D09Br1g0F2chHw7AVEsCSTs-APStkBDvHmmSWrthjcAuipv5xYKZXGZXSosV54ucPtwEAXnIAU2VEuEW380dNt00cLC41U9L1mtMO79tYwyPFrcnPP-0XwPz1pRJBdy2RjkCUXuJ3vptkCudVV6M0ig33SlBWSxU63y-J1BJlor0dAANBBwzeuLK38jlUnegAApFNhHm3h8jMNHM2d6j7TUcL891iRiAu5v7VZ-Dq5Ve2m_EXg5cjOZQY4-LIYwXBa-txfHRLRLmjpgLkBcHG4rbBoUlXkgc-OS6PWWRqDUUzDyZ_L&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCv4RJM_COYoPbKtiPjuwPhYiW2A7JntKxXLWY49aTAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi04MTczMzU5NTY1Nzg4MTY2oAHVttLqA8gBCakCsRsSbCbssT6oAwGqBI8CT9B_AfbDhC9iA9LPeqGXRWXI3A_8txw9nUd04HXeHDIvIaPRMv5EbAhmJGvLADuJ6cGQBXRMV8LuAPWEpfeUPr3Pnr3DPgEfCMr7Dj_Zsc3jnwFXQ4RqQP-kxxisDZ0sVqiDemVnu5J4wTVdJqmgmqYHvSQaNRLTR9DeOY4WlA26M93--SGfVkXEOv7ApUKMpq2QFspEEywZyuGXnU1QGqiyokFB0xKkcjK_Tx96FRlguyUZKWhbHrsXrGfJkIm0Jlrc2tMzqs4ycwE9dRv41mZhp676a7_QnsaybzOZXVwijbllFYx21Lmrov6Q6wcmPypWY-s3V2wyOzsnhsk1GNyML4m_frA2vTuGebpYF4AGs9CYnN7m15vhAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2-INyeRgL--DStg4rd7apusJo8SQ%26client%3Dca-pub-8173359565788166%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 21 May 2023 03:12:53 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 3E53 2 KB
1 KB 51ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 21 May 2023 03:12:53 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 3E53 308 B
636 B 36ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 21 May 2023 03:12:53 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 3E53 293 B
621 B 35ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 21 May 2023 03:12:53 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 3E53 43 B
348 B 55ms
16ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=dULPuSl4EbN_8tzXJbKwsXxvAZni8EyTLRNYS3YXYP_X66hIbvRz8xo7cX5-Ba4OB3p-iUtmcoqBPDA-LrsZdXeh9lMTgTPUCX9_utqw8N1aql_jo_TnPZe9BRWVBILdcASV_BgqdW8qQVRiTHlwqLvbv1dpOjyIdAqSM-TWfvcoAKrviRZ6STsdTzr9HO7YDzfarqNsJzpGq1zfHWoRZigqsWPVIoRPUEiOxfJjX1-DaPv_BwWeBS94cpHR_L8MNiZU5SeSDTaoLzn4CwrS896F322Fw5Ie72DbwRtx6edBmIyh6-asI-RBqzT9vP8Nv60sjuytuZmW4TCSQSu0O9T5jxNOYrLaNn7BH09r3N_ndY7tTSw1sqvVgil7iH-GGQgUb0W2c5ldZoTWdNQ38ddh5IntgZ4-8_zSFQcAbgzi_4Vs2i99xtm7fc59xM1QDTHPBw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:52 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2424454
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4AC3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1

43 B
894 B

17ms
17ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU3VnfTJSH1Jk2w0PPlf78hrCrSJ011XAukBvWV9Stf6UjycnONrewcgquBQaAfnhulLUfxp_RaDUsXXWFdUSTsxErkvc9eQIiRumXmfHCjwqy9YNkb21dFXWhLngLLJe2F0nzZbfkJHzDyLKfNEmGHjqfdIx5Q7a1IHS0uFtoPTGL324w
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 26 May 2022 03:12:53 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4AC3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU3VnfTJSH1Jk2w0PPlf78hrCrSJ011XAukBvWV9Stf6UjycnONrewcgquBQaAfnhulLUfxp_RaDUsXXWFdUSTsxErkvc9eQIiRumXmfHCjwqy9YNkb21dFXWhLngLLJe2F0nzZbfkJHzDyLKfNEmGHjqfdIx5Q7a1IHS0uFtoPTGL324w
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 26 May 2022 03:12:53 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP429Jm7gXLDfdimNd1eqVA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4AC3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGUCmVx-uUGztyECjyNM4NY&google_cver=1

43 B
1020 B

8ms
8ms

Image
image/gif

37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGUCmVx-uUGztyECjyNM4NY&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiq5LvGATAB&v=APEucNU3VnfTJSH1Jk2w0PPlf78hrCrSJ011XAukBvWV9Stf6UjycnONrewcgquBQaAfnhulLUfxp_RaDUsXXWFdUSTsxErkvc9eQIiRumXmfHCjwqy9YNkb21dFXWhLngLLJe2F0nzZbfkJHzDyLKfNEmGHjqfdIx5Q7a1IHS0uFtoPTGL324w

Protocol

HTTP/1.1

Server

37.252.173.27 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9e2436ba-75a0-496b-a57c-b38cf3cdf888
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGUCmVx-uUGztyECjyNM4NY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4AC3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU3ODMxNDA0Mjc0NDc5MjY0Ng%3D%3D

170 B
188 B

139ms
77ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU3ODMxNDA0Mjc0NDc5MjY0Ng%3D%3D

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
X-Proxy-Origin: 185.213.155.176; 185.213.155.176; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2d42d61b-72de-469b-932e-8de62e03678d
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU3ODMxNDA0Mjc0NDc5MjY0Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FEF2 41 KB
15 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DnfCuJGAqtFE64ToASzJNZ-_5P6iFWUkwX0CES9m4jkyzF-FuG9w16k1hZwSlINLaXWWPEHPEKMS0UCKLWkt8bxj0HUJjCRLU9-gCo4PmA6wzuFPAGGVinQdKRvEDC8T59j8KaWY-kI1UXRdsMojb0VHnXSw&cry=1&dbm_d=AKAmf-DG8tgGm8zmj2513XNA5wWn4yRlKT4vZYfzIApt2uOcMn-Q4cnPuAj_bwv3Y0UMzBWPfQ5yi449NZTfj_g7C6tqD4QCuEGckPJ9uWRKZpc4ly4Wr_SJaWPgZeeCg5-Ip7xtIg8mQv34RuyEIsbtf-oi7BKlu4jXloOY_6RZtrW82w27YuS8jrozn5ZecWGsLyhu-ecpiA4_m1KZMHxCnsNAowC-tQGerFGwb_W2Zg7BjtXjZ0b0cRX4qDgUdnTkF2D4t8AKCy1d7oliWkWWAEPCjdoqtbf7ojfv_TWvIll8ADjHK9mS6Z8LZSLmKil7gLiwZu0Qxo9majhtKXgcAosxFljPQO8wDYx148jzZotGDqTX6tegV80vZgv2GPssOy8q3CIEJRAoraaVXXUChtUn3yJYWZfYkjljhkmab8C1UesyB2wgp46ESRSXPQImM8Cq4Lzn2OwrFIEtAj5YN3Gr1hrf5Quu1oZKJWeEyvypCnxadzZPi1EvvNY2Jzi8ha6QB7dAGTzVIVxs8SSRT7_ox81n6Sra8YP3DYMv8RdQnPYrlFMv6RWggNMA-Txg0S7WQcVjTpYKf-EhB9zTtPnWFSvEXmMw3sQGo7sy8OB4r6YpeyVccxk5fLAeDPXRTLMmsfrHuYXTWHp7yZgAEgtmarx0MKtBmIX-tg-dkxcchJKhhOZkhuDHXATnLUo3vsUiYzSEaadUfrKciBdk0yjEYRKWmuUNm0nABlL_sYii9f1K8jDLwwPpPzsLj7ELsfOK1j3H8MEL9ex17h2y4-N4UmXL0Oi_cAhr0_Ch-DSq6KcurTK3RHPA5cvirKO_qJkOW7ckcTaFom4X40REVHqdGVXYJoBUojUOwJOdfwoLtEkB3_qPACQ8s0Rr8RRbKm9my_Z65X-yhzJ3cjUNBs7yJZCXCN1kLJElT7SieZD95LSUL3f7HPmeBcTi7JxYztk4vq73yIIxgiqMp0BK7s0u9rvXt-KNZi7LoFTIUiVPFGuUfa7KzZyO5x-CGFo77Q58z3CfrCO9JhRZtdXp-hyCsCa0zMw8Z3PsEGDoOX-IY8SzXGJ6geZTSxCZAsg-FCnWqDTljzDSgSm928FkmYRZsyw1T3xh1ux1FoOtUWhlsbQX_JoTNozTBz-F13eGA2JIhHu_KBMyzv2_OXjBvksPXtB1YLUCD_CvwiudbYl94EzuWijpe5mnL0G0nrvbVheJNTI8pPO9AJgATZ1JQdR6lCmTe6U_J5pSJJrFL6d79X2lrvvhD7HpNYjL45AKEHzZhq8mr7ZY27LKpn1khS61qYnf7acI5I1Qs0xtcH4ZOIFKraOe0H5SXQ69AjNAVCClUzyjauMbwXhDJrt0B2G3FBF4dqBbB5VCngQcKl_eXABvmvmUwX2vByFDQ_hvHm5oHzsdvP-nxbZezbN0lVUI1FO4GDZVpDBID01bvLJGah7mBpPKGK8xfWSzPaJqTbJfM3P5jxKvujIx1DNoUmAhEDdyK02iZBAbW2MOaqoU_ZmRqWQ1w7VKptvp_ECXl_CN8wW2WE53ltK8SOjp-bnlhODjPO4nPOlbf-GqKB_qd-tMN0U6SViI-6wUgjVX-ddUGTBhjbU7rDzz_VhlP181su7_6B1aFCVsgQYIbyeVhy9ETCLcPZuIt4NCdRe98wZw_biuCbtOlFjlpBZ5WLd0Y9UdwYiYtYoYYhVPYYCCSgxYPQT5beBjLTA8l92ale-NhEOa41LR4F8rheyyoAJAuzG9vsn28bcKKZ54z7_rIRUHtWO24KmPyB75rwUbmgI30fQva3PXeuDKVt7cfg6wQPTJ1M5ECSR4EJiBhwirDm1XsdmZzeeckjv5wgxrCPfRhR4vgBI8cqe2Vfe8lnLVg6e0MCBxe7NPLaK8gG7a1uqA6JIICxj98OryZiZpu8nCykEJuBJ2H17aySaRRDSJFEv8w6OoYOhltShcI52Hor5vnUNfy0RFWxbfk5kuWJQV3xtzA4acXn7xEHrYYpCM31JHS8uy_KOK_xyXdEvzjHqkT6qvHM-LjhBiBKjQYD-WNrrdvnRin8QNA6Cfma_z_E9v087mKrDOoEfdAMHk6hxDcMFspqBF9eP0tkIatjbS3ae6-P1YRWUvTLnqIQTJEiLlDDBTqzxusT5A95ZEyTAvzrmEXqE_myql9VEb-_XByqOqippEiwPxgMc2sxwvRmIzOTv1V7b64yaZgUrzHPXi1ox7SSETghKaKtsNJ6JoL9qzbclfPMAK2YyGMvQekVT3oeW0Vm_3TBl13HWod9dj7SO10iwIiR5MAVjZILVkvVfU7tGHCECKO7DaqzJXkopQuSB4MvprdB6YXuIH56Abg2ua9brF8W-P6htdjZ8LPdrej318OkYTz-R5FMN2CoTy10BqJ8sXHDlDnYQjua4BNvxfkFiAI_TySeyIMKN5Rg4FwLZyMKSPh50Pl25OaSAgHfiiDpYgTIAvGF_vmwWf1iJz5bslxi4B8beYKWQJ2ehoBslZ6Rof5ANwHVrUDiUMm-D9Se08t-IjnYiBVB-iDDBZs3-q13swgsX1dLxeQbyseL9U-o6aig1VwJpZFFzG75f0ob7rarRXH4v-4SB9rOZGPUqI-LPQULnxhOVjzgA8YsYfeF5W8mCIGtbptx45FIgbh20NdRy0uLuHqySeh3eFrIBEXKNRqcr3QaqrV-DRms9Frd9-WWAf7CDQdnPX_E_TcUEO7LATEY2m1FIukVk4JLVwLXLv9i2VArBde5wk20z0MCr6iCFn91DgLAdnBPXk-s7fOAXYZS87gacK1foRTbFvUeqSFq5_fGQ5HGdky5uUXOPSgKTg_7qu-1MzyTZUZAML8EEp10rmkCZpjihX78eBHFmiUqV7GwqQ_4qCPeqMyxUlFYqhjHvWZJ4GVEhio7-2NZzuAi-AXLcrgcutEOW6_8xxW8zoHgtfBqEXEzGzX7ZVpVtRGbtQrEq01IPLE74EYOB92Hg-zPNsrWp_m-oEJzQyWIf4KT2-77QdskjapbVC1BaawtkSoDlM_cVL7SF8BToetdKD_syup5FHeqs2aCZqAka1eGLVcheXDN-bQ5yDdOWQcJfYOwKt9OvAAE0WPclL3UBJnR6lzIFORY4I6mDNt7li8rC9dli7xZlYflU7b9RZUbZMGGqB77vgRRK5TAJJHrbFqh3S0cF70KNwWNqRtHAaCRGb2Q-mb2-Phcpnlnx67BTd9fj7f-WeyQ458CXA9HAPYkTgw-y5WZ480PTk0o4giR7RRq26fhLscHNrIDBemFhr2t94NNhHShJkSToX0IfTQBlaO7PpqIOdwNmLU8fN7F_BUdlR_rzvke7XtEjOTa2Du-eSVKKPb4kVi0R5crjPjZqmH1sxt3iraaLJcfI-_XNJWNN6WyBHzsWFq76baHDbqETVUcmGUesVE6hE2XKhREZmhpng7sWsvKjD0vvz_kl2wnZey1dWFic_-nTFKYhqQaJ80qi3JllV1mAjEIAW04skEjn-NTIF-TRSbr7881rGiAfP4WGXBTsUbUSlJtqHUvQ_TfQqPFBor3QJulxAlUIpFjXV9xInfLKynoWEOmXg7ZNbjj-VxqF0YTDGESMgqto_e21kuQjJD61S-c5kUSeRfcUxQw7YsSH4o0TDmJa1MhNc&cid=CAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ&rfl=2%2Chttps%253A%252F%252Fwww.buzzfond.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 11:48:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55461
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 May 2023 11:48:32 GMT

GET
H/1.1 200
OK g2gqt23fm9fm Show response
hal9000.redintelligence.net/zone/ Frame FEF2 11 KB
4 KB 66ms
17ms Script
text/html 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g2gqt23fm9fm?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 Raederloh, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 9b6b05950998ad7c50ab53540603c0c2d82c2dd4848b18e4f0061a13e1c5428d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Thu, 26 May 2022 03:12:53 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4233
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6E0E 1 KB
749 B 39ms
38ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76749
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 05:53:44 GMT
etag: 48472445140208031
expires: Thu, 26 May 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame FA8A 9 KB
3 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 09:36:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 26 May 2022 09:36:14 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame FA8A 26 KB
10 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 16:13:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39551
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 26 May 2022 16:13:42 GMT

GET
H3 200 background.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 71 KB
71 KB 40ms
39ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/background.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9a85c34e10a09ab6d6f629bd9d6497ea724585ea2634226b9a05650bb45f45e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 419642
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72837
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 06:38:51 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 06:38:51 GMT

GET
H3 200 cta.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 5 KB
5 KB 38ms
37ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/cta.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21dd3160c70dd51a6f10ddfbc333ec72eecc7866b2ee66681bfc635c919ad957

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4903
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 copytext.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 6 KB
6 KB 38ms
37ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/copytext.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53ef4ae476b919f54c4d0c6e57ddbb1366e3d93665b05eb4fb2e4c8149faa188

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399581
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6256
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:12 GMT

GET
H3 200 headline.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 6 KB
6 KB 53ms
52ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/headline.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c93b916747abfc49ca1540fc5a8a147752b4a928e5e8dc27feaada48d125d0d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6319
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 eyecatcher.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 8 KB
8 KB 39ms
38ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/eyecatcher.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef22484684b3673663d9f8a04d330c91991b9a002e6e0fc7f92cb7279ad26b4b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8522
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame FA8A 4 KB
4 KB 40ms
40ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/logo.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d35005caccccfa9e5e792c75685c01ae51c0cad66aec1ddba2e1291c9ca930f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3632
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 683E 143 B
163 B 36ms
35ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2862
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 02:25:11 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F4BE 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e67fb40f34de09b70a1e9d1191dba480eddac71052040a5615bc72966ea31f6e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9740 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 546b69a1feb3df5880d6b6bbd476c6e332371c778682b4b6ac0c589f44551e28

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 9740 0
20 B 145ms
72ms Other
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLGl_YWZ_PcCFRmDgwcdAisO8A&gqi=NPCOYuX5Jr397_UPnaaW2AI&layout=/sadbundle/%24csp%253Der3%24/13286003456218249693/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame F9DB 9 KB
3 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 09:36:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 26 May 2022 09:36:14 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame F9DB 26 KB
10 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 16:13:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39551
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Thu, 26 May 2022 16:13:42 GMT

GET
H3 200 background.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 71 KB
71 KB 48ms
47ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/background.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9a85c34e10a09ab6d6f629bd9d6497ea724585ea2634226b9a05650bb45f45e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 419642
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72837
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 06:38:51 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 06:38:51 GMT

GET
H3 200 cta.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 5 KB
5 KB 52ms
52ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/cta.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21dd3160c70dd51a6f10ddfbc333ec72eecc7866b2ee66681bfc635c919ad957

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4903
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 copytext.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 6 KB
6 KB 46ms
45ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/copytext.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53ef4ae476b919f54c4d0c6e57ddbb1366e3d93665b05eb4fb2e4c8149faa188

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399581
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6256
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:12 GMT

GET
H3 200 headline.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 6 KB
6 KB 47ms
46ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/headline.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c93b916747abfc49ca1540fc5a8a147752b4a928e5e8dc27feaada48d125d0d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6319
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 eyecatcher.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 8 KB
8 KB 47ms
46ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/eyecatcher.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef22484684b3673663d9f8a04d330c91991b9a002e6e0fc7f92cb7279ad26b4b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8522
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/ Frame F9DB 4 KB
4 KB 48ms
47ms Image
image/png 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/logo.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13286003456218249693/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d35005caccccfa9e5e792c75685c01ae51c0cad66aec1ddba2e1291c9ca930f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 399582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3632
x-xss-protection: 0
last-modified: Fri, 29 Apr 2022 08:40:40 GMT
server: sffe
date: Sat, 21 May 2022 12:13:11 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 21 May 2023 12:13:11 GMT

GET
DATA 200
OK truncated
/ Frame 5491 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e252d4316e3c1179fb31b8be61c3bbfe9234c3df264a8232510a82b4ea68ea74

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 3E53 12 KB
6 KB 23ms
23ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 21 May 2023 03:12:53 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 4 KB
4 KB 90ms
43ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=244&m=0&partner=10309&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F10309%2F200716%2F7918c12269204a8c8375e62384537eb5_191211_flaconi_logo_iconic_element_black.png&v=3&w=196&s=pggTumUri_Hauo_9gNf_HtMQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

a0315bfa940cec7f30ae116bee1f6d956364cbc699192ecc69711d42c66033e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30932230
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4253
expires: Fri, 19 May 2023 03:30:03 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 54 KB
54 KB 62ms
15ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=10309&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F10309%2F201126%2F809ee6eb57df4e9c9705111ad7fa7d86_img_horizontal_1.jpg&v=3&w=1200&s=Syq3pg-0qmo7oq6anRlIJI3T

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c0b26fee0bf4c8a306205ad90be4548cb4732823c4582a8bd8c5ae36930711d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28558717
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 55084
expires: Fri, 21 Apr 2023 16:11:31 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 13 KB
13 KB 93ms
46ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fz%2Fi%2Fzirkulin-propolis-kapseln-nahrungsergaenzungsmittel-30-stk-4056500084817.jpg&v=3&w=800&s=TKCtApoOcmjnu-FC8_WYd67U&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

d85e6efa3aa2da5a294244e85e0b9651d98168cef37aa89138be2af1bebcf5f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=54133
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 13154
expires: Thu, 26 May 2022 18:15:06 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 3 KB
3 KB 98ms
51ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fb%2Fi%2Fbiotherm-baume-corps-oil-therapy-koerpercreme-400-ml-3367729575248.jpg&v=3&w=800&s=ONdeDy5geytdfUBkUFzTaZpB&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

b7b667b7752b281e8d816d40ccefd82bde63dcfa4c8ce9e7ad22794b7f9663ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=13315
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3066
expires: Thu, 26 May 2022 06:54:48 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 6 KB
6 KB 90ms
43ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fs%2Fh%2Fshiseido-vital-perfection-uplifting-and-firming-enriched-gesichtscreme-50-ml-768614149408.jpg&v=3&w=800&s=Jakttb8AIrzGGAqgUboH4b20&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

b81497e274f647ef42aaa04ec827a3cda1062a4b7841526686df7d19eae6d104

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=45162
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6290
expires: Thu, 26 May 2022 15:45:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 7 KB
7 KB 97ms
50ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fy%2Fv%2Fyves-saint-laurent-libre-eau-de-parfum-30-ml-3614272648401.jpg&v=3&w=800&s=TKtcux-fer99Fx6VxzLoXB9A&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

8d499bfc8be5d66fb9cf230bf46e36ab5dcd90aca21c2d10a9d7049227b09553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=60921
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7066
expires: Thu, 26 May 2022 20:08:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 3 KB
3 KB 32ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fa%2Fv%2Faveda-control-force-firm-hold-haarspray-300-ml-018084846933.jpg&v=3&w=800&s=lxTEqbUAGy3YkKrmD8y-pt1P&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

8635a5489749d829d4bee1446dead9cb1144faf2c81230a9fdc149ae60f6003a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=33154
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2842
expires: Thu, 26 May 2022 12:25:27 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 5 KB
5 KB 33ms
28ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fa%2Fl%2Falexandre-de-paris-pince-vendome-crystal-rosa-45-cm-haarspangen-1-stk-4050848047572.jpg&v=3&w=800&s=0lHUEjNATlEOm6lVxLqJZ5YS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2777960bba436fd9da5f1004ac21d665f2e3782eb315e6aabea88ccefda7153f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=37319
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5118
expires: Thu, 26 May 2022 13:34:52 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 5 KB
6 KB 39ms
34ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fb%2Fi%2Fbiotherm-blue-therapy-red-algae-uplift-gesichtscreme-50ml-3614271844804.jpg&v=3&w=800&s=jRygBLA5diQH4eJA6joL2exX&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

283c75e109422038fe86053152f2a44b039089ac9ebb5ad8e685f8bd54a5d667

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=45447
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5506
expires: Thu, 26 May 2022 15:50:20 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 4 KB
5 KB 38ms
33ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fh%2Fa%2Fhaan-pocket-morning-glory--sunset-fleur--wood-night-haendedesinfektionsmittel-3-stk-5060669780281.jpg&v=3&w=800&s=5TprDGiCZVUUmfhGXtoZMDyF&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

8f324c3671445c0dbdf0048e9d3e6af2e84ccadc8b069de39135f465a33be5ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=54868
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4420
expires: Thu, 26 May 2022 18:27:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 14 KB
14 KB 37ms
32ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fd%2Fo%2Fdoppelherz-aktiv-b-komplex---folsaeure-nahrungsergaenzungsmittel-45-stk-4009932004656.jpg&v=3&w=800&s=HYm471EAGC7meSlsJHzcOvPk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

506f01427cb9c230a972ff1996815751e868e869b13675cfdb7cebf6b45cc7cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=26190
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 13824
expires: Thu, 26 May 2022 10:29:23 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 3 KB
3 KB 38ms
33ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fd%2Fi%2Fdior-sauvage-eau-de-parfum-60-ml-3348901368254.jpg&v=3&w=800&s=PeSajebPFKX6ClldRkI3oD5Z&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

781f16602ae74fba91999714d81dbc603ab905cabbcd434d5820143d14b2fd98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30127
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3174
expires: Thu, 26 May 2022 11:35:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 6 KB
6 KB 39ms
34ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fg%2Fi%2Fgiorgio-armani-my-way-eau-de-parfum-30-ml-3614272907652.jpg&v=3&w=800&s=TWZZ_n86S1atuoqrKVnBMkAA&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

92d1b18ad78887858b08b509dbd6bfe8520f9080e40f45086894bfdab5839bc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:52 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=84504
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6046
expires: Fri, 27 May 2022 02:41:18 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 4 KB
4 KB 37ms
32ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=10309&q=80&r=0&u=https%3A%2F%2Fcdn.flaconi.de%2Fmedia%2Fcatalog%2Fproduct%2Fb%2Fi%2Fbiotherm-life-planktontm-multi-corrective-body-milk-400-ml-3614272848573.jpg&v=3&w=800&s=r3gPi5pw2-EHxawQoZx1KXW3&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

03ab5617452202dfb00c3e9626773e0ce96812e80e576103a651721d76255a67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=34965
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 4290
expires: Thu, 26 May 2022 12:55:38 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 3E53 0
128 B 63ms
14ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=8jfPKKApbAriX40uMu_l4HgNSDkZuoBs4txC6v33KJNZY1nkLhoXIi5MUyc8pJ2P4BsBwvuqg19OyIiBKX4uhBN0a6X3uLv4fVTDbV_TIwu1VkzH1dFc2Cqp_y1w7Hux3Lo0wGNsJrx6Kd38OF9hIHoEtcotj4sGFj7iv0xLQ10hEc51QXBFh3xfJfjfbHwl5VRlN8gZf7f3d8k-KitJ7s3Xcqj0eoWdTp7I0WrHAXyZ5YBVSO1RuimSgAL2Ikm_fv59Vw&sds=2&rev=81571&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 26 May 2022 03:12:52 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 3E53 2 KB
1 KB 16ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 21 May 2023 03:12:53 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 3E53 2 KB
1 KB 15ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 21 May 2023 03:12:53 GMT

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 5491 0
20 B 72ms
71ms Other
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CO7Y_YWZ_PcCFf-JgwcdJ7MNXA&gqi=NPCOYt6jJ_Ox7_UPhLGhGA&layout=/sadbundle/%24csp%253Der3%24/13286003456218249693/index.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame B513 0
0 73ms
73ms Fetch
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CMw-1M_COYo7dKoaRjuwP6e-KkA2V29bEaenF8tCCEIqo68nyLhABIIPH5B5gleKQgqAHoAH88__HAsgBAqkCRqIZcKZAZz6oAwGqBKkCT9DGVDOd5XF317VLD87argPKuIodZS4poRNh-hqz9HuUTa-e19PWM4ts9RZxZkun8-yF_yru4J00opPzQwV-MWILhuaeT8z-EHje8osYz7NONqx1VZpWbVsMEIiKdZ4dvRSiTGkGX16kXMKZTV2lql2DBrd0dNY8eIrytnTbqUTTmgV-g3Ge8AP7SkHkurX8Uo2UeegrUE14NsUZ6526PIVlur7GZ2CfSWXWEy9G3HyOJ3Q-TFQkgCHF_hyG6C7WjzpVBAdpO15HNSGKOH1DNnik3qISgWwViALFb6klNK8iTzJsPTVzjpiODnh0XCnxyXcp9EZESIzcqYL7bSUQ3xs97FchhDfythcUqvwJKyLDz3QBtuEQI0iiuEpYuzdkA89eKOOVHdz-wAS0vPDMgwSgBgKAB-yLgLgBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ6I4F0ggJCIDhgBAQARgfgAoByAsB2BMD0BUBmBYBgBcBshccChoIABIUcHViLTgxNzMzNTk1NjU3ODgxNjYYAA&sigh=x9W-pXMBnMI&vt=1&uach_m=[UACH]&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=90&slotname=5340369745&adk=3537927020&adf=1723549077&pi=t.ma~as.5340369745&w=728&fwrn=4&fwrnh=100&lmt=1653534771&rafmt=12&psa=0&format=728x90&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&fwrattr=true&rh=90&rw=728&sfro=1&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534771465&bpp=2&bdt=227&idt=141&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=216&ady=266&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=0iYbzFb6PX&p=https%3A//www.buzzfond.com&dtd=145
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B513 42 B
64 B 71ms
71ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstyT9sXeyiFpFGXSD2h_6BWRYBDCoJi69yUbxs3TwmV6b3jKGQD_sGzWnOFKGYCAeR5s1I85CXIPYiHbsEuvBR57enPmaTZ7Q0l3JkKpM430hD4nb2ud24qGBg-&sai=AMfl-YTND1b4oFBNVCWFAptuc4y-OqAeO9i5pwP9Xq4I561nuYfq3CmBGE2Pi20WDV7tBWZMW3o3sMQtafve&sig=Cg0ArKJSzDjQRszrk39mEAE&id=lidar2&mcvt=1038&p=0,0,90,728&mtos=1038,1038,1038,1038,1038&tos=1038,0,0,0,0&v=20220525&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=3537927020&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&pay=1&rst=1653534771611&rpt=693&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 10FC 22 KB
8 KB 37ms
37ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 680
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:01:33 GMT
expires: Fri, 26 May 2023 03:01:33 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal90005.redintelligence.net/ Frame FEF2
Redirect Chain

https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

126ms
100ms

Script
application/x-javascript

138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-8173359565788166%26output%3Dhtml%26h%3D240%26adk%3D4147636252%26adf%3D308362495%26pi%3Dt.aa~a.1397822562~rp.3%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1653534772%26rafmt%3D1%26to%3Dqs%26pwprc%3D3037641804%26psa%3D1%26format%3D300x240%26url%3Dhttps%253A%252F%252Fwww.buzzfond.com%252Fwhat-happens-to-your-body-if-you-sleep-with-socks%252F%253Futm_source%253DCNN%2526utm_medium%253Doutbrain%2526utm_campaign%253D00daffd5a6c52890dcd11ce8780c662d38%2526utm_content%253DCNN%252BEdition%252B%252528Turner%252BInternational%252529%2526utm_term%253D0014dace722b21ef3ebec62fc10f878c42%2526itm_term%253Dbf%2526dicbo%253Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%2526obOrigUrl%253Dtrue%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1653534772608%26bpp%3D2%26bdt%3D1370%26idt%3D-M%26shv%3Dr20220523%26mjsv%3Dm202205230101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D3deba6f7292ece3b-22aba8029dcd00bd%253AT%253D1653534771%253ART%253D1653534771%253AS%253DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ%26prev_fmts%3D0x0%252C728x90%252C728x90%26nras%3D2%26correlator%3D3645075113578%26frm%3D20%26pv%3D1%26ga_vid%3D1135698774.1653534772%26ga_sid%3D1653534772%26ga_hid%3D968036649%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1008%26ady%3D1252%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759842%252C44760475%252C44761044%252C31067756%26oid%3D2%26psts%3DAGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%252CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng%26pvsid%3D3371456103291399%26pem%3D123%26tmod%3D314249946%26uas%3D0%26nvt%3D1%26ref%3Dhttp%253A%252F%252Fpaid.outbrain.com%252F%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3Dl1bNSbMnvA%26p%3Dhttps%253A%2F%2Fwww.buzzfond.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.buzzfond.com&random=3657376098846&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10
Protocol: HTTP/1.1
Server: 138.201.63.165 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a4b915613d8b4ee75d0929d61324dfe6fe3a07fdc60781a598bc7cf853eb9cfe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 14445100014469304444992011971005
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 997
Expires: Thu, 26 May 2022 04:12:53 +0200

Redirect headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-8173359565788166%26output%3Dhtml%26h%3D240%26adk%3D4147636252%26adf%3D308362495%26pi%3Dt.aa~a.1397822562~rp.3%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1653534772%26rafmt%3D1%26to%3Dqs%26pwprc%3D3037641804%26psa%3D1%26format%3D300x240%26url%3Dhttps%253A%252F%252Fwww.buzzfond.com%252Fwhat-happens-to-your-body-if-you-sleep-with-socks%252F%253Futm_source%253DCNN%2526utm_medium%253Doutbrain%2526utm_campaign%253D00daffd5a6c52890dcd11ce8780c662d38%2526utm_content%253DCNN%252BEdition%252B%252528Turner%252BInternational%252529%2526utm_term%253D0014dace722b21ef3ebec62fc10f878c42%2526itm_term%253Dbf%2526dicbo%253Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%2526obOrigUrl%253Dtrue%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1653534772608%26bpp%3D2%26bdt%3D1370%26idt%3D-M%26shv%3Dr20220523%26mjsv%3Dm202205230101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D3deba6f7292ece3b-22aba8029dcd00bd%253AT%253D1653534771%253ART%253D1653534771%253AS%253DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ%26prev_fmts%3D0x0%252C728x90%252C728x90%26nras%3D2%26correlator%3D3645075113578%26frm%3D20%26pv%3D1%26ga_vid%3D1135698774.1653534772%26ga_sid%3D1653534772%26ga_hid%3D968036649%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1008%26ady%3D1252%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759842%252C44760475%252C44761044%252C31067756%26oid%3D2%26psts%3DAGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%252CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng%26pvsid%3D3371456103291399%26pem%3D123%26tmod%3D314249946%26uas%3D0%26nvt%3D1%26ref%3Dhttp%253A%252F%252Fpaid.outbrain.com%252F%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3Dl1bNSbMnvA%26p%3Dhttps%253A%2F%2Fwww.buzzfond.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.buzzfond.com&random=3657376098846&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 26 May 2022 04:12:53 +0200

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6E0E 35 B
463 B 38ms
8ms Image
image/gif 2620:116:800d:21:c5a4:625:6563:a5bb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDanRjKed3xe2WvEUlNjZNs&google_cver=1&google_push=AYg5qPL7pvKXUZZOIT1awN3XoNZn7gXQHDImh_MmNcO_JSXAy-U-xz-JTi6iZwbYXVkAKmCYIhKYauhv_A6XZ58oCv9K9_dPRtnv

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:c5a4:625:6563:a5bb , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E0E
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIHtlsy...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPIHtlsy...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjYwMzEyNTMwMDAxMDI0MTE0NzIzNQ%3D%3D&google_push=AYg5qPIHtlsy9e2kCwjQE0DPxv7QiFe-KXHMlo-2hPfILxkDJVRxxHGt55r3QUMdbTqOks...

170 B
188 B

40ms
40ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjYwMzEyNTMwMDAxMDI0MTE0NzIzNQ%3D%3D&google_push=AYg5qPIHtlsy9e2kCwjQE0DPxv7QiFe-KXHMlo-2hPfILxkDJVRxxHGt55r3QUMdbTqOks9WHasSadpoZDtVfToTsBw7toKbm1ZQ

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjYwMzEyNTMwMDAxMDI0MTE0NzIzNQ%3D%3D&google_push=AYg5qPIHtlsy9e2kCwjQE0DPxv7QiFe-KXHMlo-2hPfILxkDJVRxxHGt55r3QUMdbTqOks9WHasSadpoZDtVfToTsBw7toKbm1ZQ
pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 6E0E 43 B
350 B 71ms
32ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEDqKQw-w3YGMDcdvlgWadWs&google_cver=1&google_push=AYg5qPIjiRKPjslG4oTuRjbR4OMpw9GHZn8u42-lzioN4xK9oI2FEzeQ60lVKZHiffyCswpE-6PoCf5ggXuslDN2NLr5Mhb6GlQP
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:52 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 1228uslmj0q2o0tvt9l3uchis12p7qbk

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E0E
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

40ms
40ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLWq3fFEdyk8DsVdBFw7Ab48aSj11_y_7dOONSaZ3Khhi_ForSME3eu5ehnn4j4EywklO984WBjkyQhPGXhf8CmdKFghaSo

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLWq3fFEdyk8DsVdBFw7Ab48aSj11_y_7dOONSaZ3Khhi_ForSME3eu5ehnn4j4EywklO984WBjkyQhPGXhf8CmdKFghaSo
date: Thu, 26 May 2022 03:12:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E0E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPJeewyqG8STo2F-f2RaMJD0XoXvZ_c2Nmt5dFnUZpcrQZQBqMlNZJVxmHMb6XDzQB4iq7AKoVQp5DqWob1RJk...

170 B
188 B

70ms
70ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPJeewyqG8STo2F-f2RaMJD0XoXvZ_c2Nmt5dFnUZpcrQZQBqMlNZJVxmHMb6XDzQB4iq7AKoVQp5DqWob1RJkQByVIDviMY&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPJeewyqG8STo2F-f2RaMJD0XoXvZ_c2Nmt5dFnUZpcrQZQBqMlNZJVxmHMb6XDzQB4iq7AKoVQp5DqWob1RJkQByVIDviMY&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 460
Expires: Thu, 26 May 2022 03:12:53 GMT

GET
H2 200 trk
ag.innovid.com/ Frame 6E0E 43 B
296 B 206ms
20ms Image
image/gif 2a05:d01c:1d8:8101:37a8:11c6:83f7:6fb7
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEG_jlW3133ITk0LlJKwSjEc&google_cver=1&google_push=AYg5qPJH-bCx0WaF-ADMDCMmH1FMlv_Kj_K2kvkEM63WzQo9HF9J64bKC5J3LQeGbGqwQw0jgeBqfR4kJO3QwYLBuqha2SkwX4vH
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=60&adk=2499841291&adf=1839787983&pi=t.aa~a.1401253628~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=1200x60&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1371&idt=0&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240%2C300x240&nras=5&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3052&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=4&fsb=1&xpc=U4DvNvcsLk&p=https%3A//www.buzzfond.com&dtd=23
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:37a8:11c6:83f7:6fb7 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET googleredir
googlecm.hit.gemius.pl/ Frame 6E0E 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6E0E 0
12 B 68ms
38ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JpofRzJeF8gz2QFmXRfHLtygcRvaAaR0TZrN23KZPo9bp_TsrgYhQ80AJ1XBJ-EecRyuYGIg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame D7E0 35 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 683E
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

55ms
55ms

Document
text/html

2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 03:12:53 GMT
expires: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 May 2022 03:12:53 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame 1264 35 KB
13 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame 10FC 35 KB
13 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame FA8A 35 KB
13 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame F9DB 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H/1.1 503
Service Unavailable e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame 58B8 73 B
454 B 145ms
77ms Document
text/plain 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005&t=htlp

Requested by

Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-8173359565788166%26output%3Dhtml%26h%3D240%26adk%3D4147636252%26adf%3D308362495%26pi%3Dt.aa~a.1397822562~rp.3%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1653534772%26rafmt%3D1%26to%3Dqs%26pwprc%3D3037641804%26psa%3D1%26format%3D300x240%26url%3Dhttps%253A%252F%252Fwww.buzzfond.com%252Fwhat-happens-to-your-body-if-you-sleep-with-socks%252F%253Futm_source%253DCNN%2526utm_medium%253Doutbrain%2526utm_campaign%253D00daffd5a6c52890dcd11ce8780c662d38%2526utm_content%253DCNN%252BEdition%252B%252528Turner%252BInternational%252529%2526utm_term%253D0014dace722b21ef3ebec62fc10f878c42%2526itm_term%253Dbf%2526dicbo%253Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%2526obOrigUrl%253Dtrue%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1653534772608%26bpp%3D2%26bdt%3D1370%26idt%3D-M%26shv%3Dr20220523%26mjsv%3Dm202205230101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D3deba6f7292ece3b-22aba8029dcd00bd%253AT%253D1653534771%253ART%253D1653534771%253AS%253DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ%26prev_fmts%3D0x0%252C728x90%252C728x90%26nras%3D2%26correlator%3D3645075113578%26frm%3D20%26pv%3D1%26ga_vid%3D1135698774.1653534772%26ga_sid%3D1653534772%26ga_hid%3D968036649%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1008%26ady%3D1252%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759842%252C44760475%252C44761044%252C31067756%26oid%3D2%26psts%3DAGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%252CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng%26pvsid%3D3371456103291399%26pem%3D123%26tmod%3D314249946%26uas%3D0%26nvt%3D1%26ref%3Dhttp%253A%252F%252Fpaid.outbrain.com%252F%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3Dl1bNSbMnvA%26p%3Dhttps%253A%2F%2Fwww.buzzfond.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.buzzfond.com&random=3657376098846&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

980fcf363a7373fcfd8ea3e545448bfeef574a964cd63de3241ccc92ba6e5143

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 73
Content-Type: text/plain; charset=utf-8
Date: Thu, 26 May 2022 03:12:53 GMT
Keep-Alive: timeout=20
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: B9D59BB0:93BE_91EFC182:01BB_628EF035_11B384BB:2080F

GET
H3

200

activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47 Show response
5994599.fls.doubleclick.net/ Frame 2EAB
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47?
https://5994599.fls.doubleclick.net/activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47?

390 B
344 B

107ms
46ms

Document
text/html

142.250.185.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f6.1e100.net

Software

cafe /

Resource Hash

b669a38bf0f807758e40caf18ead5967b1f1cae516847bb225a7122883360e9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 321
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:53 GMT
expires: Thu, 26 May 2022 03:12:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:53 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90005.redintelligence.net/ Frame 23E0 6 KB
2 KB 36ms
13ms Document
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/request_content.php?s=14445100014469304444992011971005&a=4efdb59c
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=g2gqt23fm9fm&nw=20&renderingType=javascript&namespace=2166d12434&subid=&uid=6f6f926d07617446&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=200x200&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtO2DNPCOYqCvJ4nT3gO975m4A6blvaBppZGcp8kP8C4QASCDx-QeYJXikIKgB8gBCakCsRsSbCbssT6oAwGqBOsBT9A58gtuScC7oeZO2e--DqIpXazp6gLE2B1q7-ZbwQi01n96knWE1fcbYjNqXJ3nxVJHdgvXbHJuBiV6MDiJCdXEJouFu0rpeej_PqKqWVcvFs25VnicALBWy3dxSQPWgqUy1KfXz1_oFEwzOPNOYdMzsK_F5uDbzKlvG3zAUo8Gu8AUc7gQ6BKFxiyhZLMpKLi42K9ltqXJ6tYxILwZpaFyo4JEEG9DXm-GM2_k9dB8FzcT7GbVlhuXrz7UfJFn3A0Cf_yXu9eShze3iCAcVgw1QiVEOAuMqn8UaycYueZDnw6y79OX3vjGC8AE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiA4YAQEAEYH4AKAZgLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASJORobVHgfbZXOyZhG2cUKd9FnZsZTFfJSUGEFR-3wrlZlfVnMQ%26sig%3DAOD64_33akJb0ASTG4c59B1j9m7YYAVHJQ%26client%3Dca-pub-8173359565788166%26dbm_c%3DAKAmf-DSTfkRwD-PPUO9MPXbrvidVmTxWeLr7P3N5SdLXRem48l21bRJxfDpLm43_P2AnZacaM6HXq71hwwt87__xVTlJOSZ13t0gj7wcxadywC2Hk0rvVfKlj80t1PgA2rc9G1ktcCr2GLdftjLVRQobdP0xUsQNQ%26cry%3D1%26dbm_d%3DAKAmf-C5GgAu7EUGkpUPcsYOghjgtOdGoWC12q0mwBwlyGIrBZMBKRRDtV_vMeZpPrTRQE0eODsdF8aIZYaAXA-TDIJ-2zDESVcLvZcJ5P2QChz7vWfHYkeeKBDXG3_VoAGpH-Ljt7B9QqJgHLM4oeHx8XDjkCQ293m-6Psap2RaWakzMZpFDnAF8kL7FCIL5GizHDDvqo3kLsm-lqI7k3et9-y0jOTyxzwb_iEBfpm7l50oMtatJTs6-L0RemdcLv2svivXfeh2LMzc5trOV1Dti-OEoy5nEZ6NaqWYHxe6gP84wpcJ7X9y56TEroY_vSHBfkvoqbPzzHKAk_OpEiW3aLluAjpG_vyWJN4V0tSVTLee1RALS3pUOvYmowfitNUoWnc8l_f0JVK9j1NkmdmM6PZWcAQkA8RfMlTmBAZ3Efxmfvr2oCO0wEollDY15fRS4wUp7nx3SA1smtUyLnLRAaOrmV0A6Vsng1jZw1wd1zO6s0G5LJLDbfuKPsKN6N29iZHU-iyR9LieDpbPcGcUtbecux7VfZEi-3x2FNvLNDZN3pFNOfSN8LTQhW9lAJpHURuczjLPm40WPBTTRiHKasOamFzPY4KM7GLPHI5UHO9rnE6jLipg93HdbekjiAETBy0ap6TJ7-OpH-aKB3bMj_7hl1Mnq1l2VDlX9DUspN0kgmPFVDb-sPnbDG5jSPfgovpUfmnBrl3QmA87otSXthtccViKLZuq74UT4UQ-JQDb_63gilQyGKRHf2dSJclHdQu8nsrIkWe89sHNj6J8aHv19MY-Zm531XUd3UDxgZvNXXuBq9eOuCrE_x3Dnpb6ebzMwDtH%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-8173359565788166%26output%3Dhtml%26h%3D240%26adk%3D4147636252%26adf%3D308362495%26pi%3Dt.aa~a.1397822562~rp.3%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1653534772%26rafmt%3D1%26to%3Dqs%26pwprc%3D3037641804%26psa%3D1%26format%3D300x240%26url%3Dhttps%253A%252F%252Fwww.buzzfond.com%252Fwhat-happens-to-your-body-if-you-sleep-with-socks%252F%253Futm_source%253DCNN%2526utm_medium%253Doutbrain%2526utm_campaign%253D00daffd5a6c52890dcd11ce8780c662d38%2526utm_content%253DCNN%252BEdition%252B%252528Turner%252BInternational%252529%2526utm_term%253D0014dace722b21ef3ebec62fc10f878c42%2526itm_term%253Dbf%2526dicbo%253Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%2526obOrigUrl%253Dtrue%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1653534772608%26bpp%3D2%26bdt%3D1370%26idt%3D-M%26shv%3Dr20220523%26mjsv%3Dm202205230101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D3deba6f7292ece3b-22aba8029dcd00bd%253AT%253D1653534771%253ART%253D1653534771%253AS%253DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ%26prev_fmts%3D0x0%252C728x90%252C728x90%26nras%3D2%26correlator%3D3645075113578%26frm%3D20%26pv%3D1%26ga_vid%3D1135698774.1653534772%26ga_sid%3D1653534772%26ga_hid%3D968036649%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1008%26ady%3D1252%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759842%252C44760475%252C44761044%252C31067756%26oid%3D2%26psts%3DAGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%252CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng%26pvsid%3D3371456103291399%26pem%3D123%26tmod%3D314249946%26uas%3D0%26nvt%3D1%26ref%3Dhttp%253A%252F%252Fpaid.outbrain.com%252F%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D1%26fsb%3D1%26xpc%3Dl1bNSbMnvA%26p%3Dhttps%253A%2F%2Fwww.buzzfond.com%26dtd%3D10&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.buzzfond.com&random=3657376098846&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 689d7ca865d3da925f00da0c2fb39e16528963b8e05021a8efd8d043e1cb9fcc

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 1851
Content-Type: text/html; charset=utf-8
Date: Thu, 26 May 2022 03:12:53 GMT
Expires: Thu, 26 May 2022 04:12:53 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

503
Service Unavailable

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame FEF2
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005

73 B
73 B

94ms
76ms

Image
text/plain

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005

Requested by

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

980fcf363a7373fcfd8ea3e545448bfeef574a964cd63de3241ccc92ba6e5143

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Thu, 26 May 2022 03:12:53 GMT
Server: nginx/1.17.5
X-IPLB-Request-ID: B9D59BB0:93C4_91EFC182:01BB_628EF035_11B384BE:2080F
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=15768000
Content-Type: text/plain; charset=utf-8
Keep-Alive: timeout=20
Content-Length: 73

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005
date: Thu, 26 May 2022 03:12:53 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A642 1 KB
749 B 38ms
38ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76749
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 05:53:44 GMT
etag: 48472445140208031
expires: Thu, 26 May 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame FEF2 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eadc212eb38c8b164c02a9806884fef9d35cbd690d71b6aa902db0085fa2da85

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 23E0 4 KB
649 B 48ms
47ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=14445100014469304444992011971005&a=4efdb59c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

918e1cfa104cf2ad2942fd66030698b8bd602ded209a4fd35552e210e59b5931

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 26 May 2022 01:36:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 26 May 2022 03:12:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 23E0 66 KB
66 KB 42ms
18ms Image
image/png 88.99.165.19
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=14445100014469304444992011971005&a=4efdb59c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.165.19 Raederloh, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.19.165.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e30e6f803e414dbea71aef42c68672ad92dd7aa103a56e1be31191d27218f8e6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Thu, 26 May 2022 03:12:53 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal90005.redintelligence.net/ Frame 23E0 0
150 B 40ms
17ms Script
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/viewability?s=14445100014469304444992011971005&a=671f282c&vb=m
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=14445100014469304444992011971005&a=4efdb59c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/request_content.php?s=14445100014469304444992011971005&a=4efdb59c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A642
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDanRjKed3xe2WvEUlNjZNs&google_cver=1&google_push=AYg5qPKVSS6r1E0O3bRr_GKqc1iZ9K4ecrC2n6pXoiB13BasZqvIGQODcf...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKVSS6r1E0O3bRr_GKqc1iZ9K4ecrC2n6pXoiB13BasZqvIGQODcfv0le15Dto_0SOxLWxCBMVS_R_alR9xE6VJpybI2lgR&google_hm=vWHh0q1r2x8f...

170 B
188 B

41ms
41ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKVSS6r1E0O3bRr_GKqc1iZ9K4ecrC2n6pXoiB13BasZqvIGQODcfv0le15Dto_0SOxLWxCBMVS_R_alR9xE6VJpybI2lgR&google_hm=vWHh0q1r2x8fZWVrFLRy9g

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPKVSS6r1E0O3bRr_GKqc1iZ9K4ecrC2n6pXoiB13BasZqvIGQODcfv0le15Dto_0SOxLWxCBMVS_R_alR9xE6VJpybI2lgR&google_hm=vWHh0q1r2x8fZWVrFLRy9g
pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A642
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPK4wiH0HoRFF5sI7u3Sbl8apVVR3eM0364sfPG...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW83d05RQUFBTm5KajNnNA&google_push=AYg5qPK4wiH0HoRFF5sI7u3Sbl8apVVR3eM0364sfPGk_j9nb3nXar7ezfrrXv8JU9Ob8hctpnJtWUOcOz5rxDGPb3a2-b3Fwkyb

170 B
188 B

40ms
39ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW83d05RQUFBTm5KajNnNA&google_push=AYg5qPK4wiH0HoRFF5sI7u3Sbl8apVVR3eM0364sfPGk_j9nb3nXar7ezfrrXv8JU9Ob8hctpnJtWUOcOz5rxDGPb3a2-b3Fwkyb

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WW83d05RQUFBTm5KajNnNA&google_push=AYg5qPK4wiH0HoRFF5sI7u3Sbl8apVVR3eM0364sfPGk_j9nb3nXar7ezfrrXv8JU9Ob8hctpnJtWUOcOz5rxDGPb3a2-b3Fwkyb
Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3 200 dds
rtb.openx.net/sync/ Frame A642 43 B
64 B 43ms
26ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEDqKQw-w3YGMDcdvlgWadWs&google_cver=1&google_push=AYg5qPKFccaAMAv3ZtstloPoZNxcLWl-nvepDj_2q6G3dD_hal_wRim1tfKmkGyZL2KiR-BsmA1Dpz2EncDvPIKq8MCWflsCQ7Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=308362495&pi=t.aa~a.1397822562~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=2&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90&nras=2&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1252&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=l1bNSbMnvA&p=https%3A//www.buzzfond.com&dtd=10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: gsmlrchlal11bef5qvgkirmvpvc624oi

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A642
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

45ms
44ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLKowwbjxCUtAJxgxAshKk9-m3JNrEFM3ZLVFqS-QxudUb8yyWS2Z7rBRgv5gua8EuiGcws-Cxi7DZc8og9itIhcSJ8-TeT

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=0cVESZx1RNy_kE2ZkZXyJw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLKowwbjxCUtAJxgxAshKk9-m3JNrEFM3ZLVFqS-QxudUb8yyWS2Z7rBRgv5gua8EuiGcws-Cxi7DZc8og9itIhcSJ8-TeT
date: Thu, 26 May 2022 03:12:52 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A642
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFaJAFm8NZFoBLmatG26rYk&google_cver=1&google_push=AYg5qPIY0vHZFPGGIaY6UZ6zZ2RTOYkA7uMOztIiv2mHcXSTjC08GSeyGLK0X6BUsof2pya9i-H...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNNRldUMVYtMjQtMTFYMQ==&google_push=AYg5qPIY0vHZFPGGIaY6UZ6zZ2RTOYkA7uMOztIiv2mHcXSTjC08GSeyGLK0X6BUsof2pya9i-HtDJ906jUKoK9zgWjEbmQTE9gn

170 B
188 B

42ms
41ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNNRldUMVYtMjQtMTFYMQ==&google_push=AYg5qPIY0vHZFPGGIaY6UZ6zZ2RTOYkA7uMOztIiv2mHcXSTjC08GSeyGLK0X6BUsof2pya9i-HtDJ906jUKoK9zgWjEbmQTE9gn

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNNRldUMVYtMjQtMTFYMQ==&google_push=AYg5qPIY0vHZFPGGIaY6UZ6zZ2RTOYkA7uMOztIiv2mHcXSTjC08GSeyGLK0X6BUsof2pya9i-HtDJ906jUKoK9zgWjEbmQTE9gn
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A642
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPL1-Hh7tYRuNU2GywNJPK4RBjLioyRrQITrMaZnLR0zTUbp0ESvclwP7PSi4w_VZygbZFDw_25i786__URDxm...

170 B
188 B

43ms
43ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPL1-Hh7tYRuNU2GywNJPK4RBjLioyRrQITrMaZnLR0zTUbp0ESvclwP7PSi4w_VZygbZFDw_25i786__URDxmW6hhLAAl1y&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 26 May 2022 03:12:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo7wNTQnvPGAP7pCMZKsmQAABLAAAAIB&google_push=AYg5qPL1-Hh7tYRuNU2GywNJPK4RBjLioyRrQITrMaZnLR0zTUbp0ESvclwP7PSi4w_VZygbZFDw_25i786__URDxmW6hhLAAl1y&google_gid=CAESECeT75iZ3hrTJ7PY7YRuzg8&google_cver=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 460
Expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A642
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEG_jlW3133ITk0LlJKwSjEc&google_cver=1&google_push=AYg5qPK520Jb28A9SqUB5zpjf-sojz2IVq2bXh2SL02yoLnSViNOUUV5z1xj5Bx6OyNQkA6WSc040TFqLwBrcM0KfNKW-N-...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPK520Jb28A9SqUB5zpjf-sojz2IVq2bXh2SL02yoLnSViNOUUV5z1xj5Bx6OyNQkA6WSc040TFqLwBrcM0KfNKW-N-HQd-e&google_hm=Wc6qTa7oT9yv9t_L...

170 B
188 B

43ms
43ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPK520Jb28A9SqUB5zpjf-sojz2IVq2bXh2SL02yoLnSViNOUUV5z1xj5Bx6OyNQkA6WSc040TFqLwBrcM0KfNKW-N-HQd-e&google_hm=Wc6qTa7oT9yv9t_L8v7gYw

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPK520Jb28A9SqUB5zpjf-sojz2IVq2bXh2SL02yoLnSViNOUUV5z1xj5Bx6OyNQkA6WSc040TFqLwBrcM0KfNKW-N-HQd-e&google_hm=Wc6qTa7oT9yv9t_L8v7gYw
pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
cache-control: no-cache
content-length: 0
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A642 0
12 B 38ms
37ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KfiIQVykjWO1t7-0wjSpViQkQlez1plev9PvF5Z0UP4vioyrB4d9mppm2_GGBfHr9IDvJe

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 23E0 13 KB
13 KB 128ms
49ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90005.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:24:52 GMT
x-content-type-options: nosniff
age: 28081
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 May 2023 19:24:52 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 23E0 13 KB
13 KB 117ms
39ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90005.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:23:45 GMT
x-content-type-options: nosniff
age: 28148
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 May 2023 19:23:45 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 10FC 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BT53iNfCOYtS6ArW5x_APqam7oAYAAAAAOAHgBAI&bg=!n5ylnNjNAAZ4vKt9WLw7ACkAdvg8WpKD3RoDUwuLdF_PDoQGNnjUSxaww6ewXdvZgq29jikBh3LtOwIAAACnUgAAAAJoAQcKAFKG58b0_vDHB4Y2ZWCEGcRbHWMPj8fSatJCrY9Z0WYcMPdCTqA-p_zA1lryP54oDDdhkQztt91rWrBFNrHkjLTAKalBSoH72CWStIPBg_OOpbKimQLfX2w6XePZUKLaMcGdTN-sq2yef0F6TLogrF1cNX5zlPNLf_d_j6f9T2sjkIgMryJfTGtV_7of82ZYUH49jnlfxursgRxUzfO4izMEBndtUL2DRomQa7Wcy9fIkxuBV97xRnKpqUswc_5aAe9OkHguV_-b-pXIPA6RZkZhxtKvgmSWGjKHrLOHcNZPmp4Gz8o5SAL8F67l7tANlvEe8Z_RqvZpXRPNawdgcDEHvbmrBl7Vj68ypGrWv1MO942pxCs0Ns1NzpCk0oF3_87CjZzehBeaGQm333_gUp73yaz4Y3PbR1YE3cXi0nV5YamDar0fB9ZfyW5Cbj3DmecB4Ko03nyAs1joD7OeYWa7J9SZfCrR8PpSQonZK33zxxiFRbquekGFJByObXth66my9qRw0BuebjvOd3Rxtvix53KYnFMvBIt9UuNrQFvUNO3RWM7KL-rbOb-oXckKHkWqMu03yuyl-gavzhtZaKc0BAKDEqEsWI5EFUB8kgjVhCHkjoEw1ZBIJimlHxHsvTaZkIjZX0epobWKCcrn9HLOxEVd5VWTAXD0j_aysFtq7l-wyDOlJ2AlcF83LRryif31zjc_ySH-xs9uToMoJDtA8UevuO9CO0-d6iSYElc9vxB2U8UiDsMY5Yll5J0VZ9N6oA9xd4xffXKaOyKsHU-Ifhtql4HRV05iKjOkbJlD9-I_GAPSTQZeAeg_qfvRcwTHL2rYucO2fZ0YwA6WuOWvsoLIOvCy9LCHOl-FIaLz1-kviNMTCmy7Ooba-I9u-YHHmqtJE1XKDECudkLjtG7HHjsC5TqEzYx3PG6oGZMoQui3fs74IEWLCsYSvrJisrHvKQCwCnTha-ca66VW07h54orun1cwMVZJJVZB503wMh1rIWFWvtl61_Q0m0R7OTutpy6RaKZUvuPja-vmY0K4Tlw8c9t2Z6Pn3IobIRHZV4k2e26pCFR0TwTNeEoImeE5yl6e

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47
adservice.google.com/ddm/fls/z/ Frame 2EAB 42 B
63 B 73ms
73ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=COmpvYaZ_PcCFQgIBgAdRtoPow;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5025519178118.47?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 51ms
50ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220523&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e18d5ab6f2fcd0e23b5e4c8b4191d8a656195100d38135a645d240b5abb57500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10391
x-xss-protection: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=968036649&t=timing&_s=2&dl=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&dr=http%3A%2F%2Fpaid.outbrain.com%2F&ul=en-us&de=UTF-8&dt=What%20Happens%20To%20Your%20Body%20If%20You%20Sleep%20With%20Socks%20-%20BuzzFond&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2974&pdt=1&dns=12&rrt=0&srt=244&tcp=29&dit=779&clt=779&_gst=546&_gbt=859&_cst=308&_cbt=543&_u=YAhAAEABQAAAAC~&jid=&gjid=&cid=1135698774.1653534772&tid=UA-61791336-3&_gid=905163874.1653534772&gtm=2wg5n0WSPQTFJ&cd5=bf&z=2131015327

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 12:34:30 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 52703
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 26 May 2022 03:12:53 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3EFB 13 KB
5 KB 37ms
36ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 467
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:05:07 GMT
expires: Fri, 26 May 2023 03:05:07 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5829 783 B
534 B 49ms
48ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3478ae2c5fa0c2d71c0412ab73b78e041b67a76cc144dcb5792ceeb66862baf4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uTz-0qX3JNN9qCnsGo-evw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.buzzfond.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-uTz-0qX3JNN9qCnsGo-evw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 26 May 2022 03:12:54 GMT
expires: Thu, 26 May 2022 03:12:54 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js Show response
pagead2.googlesyndication.com/bg/ Frame 3EFB 35 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6cqjaYtYR5p4aS5jA8U1PYkQZtxk_S9KNOFLKIL9tps.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13723
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 08:13:48 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5829 0
0 88ms
87ms Image
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220523&jk=3371456103291399&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3EFB 0
10 B 38ms
37ms Image
text/plain 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?2RmvHA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DF9B 42 B
64 B 69ms
69ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv60Efcy09kG75GF_sYbkAecU8S3fJCaWl0j_vNCQ4IuS0kHsDRT-Nb1uXrCdv2IFXgFRvTTrIzD81HYFanm9Vxbw&sig=Cg0ArKJSzOsJAAWiJsBBEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=160,832,1000,1100,1320&tos=160,672,168,100,220&v=20220525&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1653534772753&rpt=139&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 May 2022 03:12:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 3E53 0
127 B 15ms
14ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 26 May 2022 03:12:53 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 90ms
90ms Image
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220523&jk=3371456103291399&bg=!QEOlQwfNAAZ4vKt9WLw7ACkAdvg8Wi1-EPn0ia3VzRliER1qWihkG78UdfpQRqjOQBuj_FqHnuNT4QIAAABRUgAAAAJoAQeZAqsUgfAHic_CM5cBrJdADl3rWAg9nOVmes-OYbtW3_zk1rS2P_EtDU-lv78fw9xGusZH6pR6FsHzlsZRQI0BWkac9FfhVSaDUIa6SJfH1IhQ6cD4rJCQkKN54Z2E-G9Zu2V1LzrhAW2p2t99s83D5YYlfvgIrf1zWHF0Uz8bLUQDGagGRfHTwaassB06TaMz6KfZ8EXYpPlBhOhom-xE6OIhwgZtr6q2M6DxT2qqoD99fHcxUbeLRM2_6Of9yw_wx3Fo2_PynFiyPNS1aSO2RX0rxG0TsektEGk-NCyjZfkeXAEx4HtyRDAy5-Sw-sE-uZi0zfCrNL_6gYUsMua_Pd4wsZaV7_n7x1-EP9wLznxL2lK2lsJgIz7x9zysLCRabIES0Je__OnbFnlIVXuMyprduU2stOK4Y96WOGhdW2IWuV4wMeW0mScG7_HI8tygxFvzCJcQ-TTi2VkU2bcOrbtvmGSQouZw0JP5wJN1oslBXVp8QwzU1muQRYBIdu4oyWYSvMGL5sl9u4VRfC9xDulnIxDMNyeJPLl-uLsKLEeLhNa64KSnbVWPo98bZoT52Rwu8IHRaiOb4fWQdnvTC0PaM0qMXejOK9CJOaZFs_H34Czux1yfNPJC2vFKrfJ0Xn37rcQ5dzIFG_fdy7EoqM-XRS5Om55nTl35vix8nLtFy-4KKytPe5i7BZ5LZCFFrCMpM0_8EqKDI1ByqYLRWSXAvDuhA_N4ypc_UFpnhLX2Eakr0LF4Jm466KDRfFHYIOPM3WVSSmqyxDaqxtlJqQ_IiZGkMjngRwS_pDayMdCUgQ3J5XE2B46h-7gINW3EjTXitLxXkvsXjuKCghMt9QlUbNo6vOsDvLOsGivV_D3P9lh3Z86sNgNVcihPSjS_uTP7QGTZOrsJFWQ-lA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H2 204 unip Show response
trc-events.taboola.com/1040822/log/3/ 0
247 B 16ms
15ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1040822/log/3/unip?en=pre_d_eng_tb&tos=4571&scd=46&ssd=1&est=1653534771332&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1653534775903&vi=1653534771328&ri=8320948486f3c979bdecddd14d0d1f49&ref=http%3A%2F%2Fpaid.outbrain.com%2F&cv=20220522-5-RELEASE&item-url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.buzzfond.com
pragma: no-cache
date: Thu, 26 May 2022 03:12:55 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 unip Show response
trc-events.taboola.com/1042653/log/3/ 0
247 B 16ms
15ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1042653/log/3/unip?en=pre_d_eng_tb&tos=4571&scd=46&ssd=1&est=1653534771332&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1653534775904&vi=1653534771328&ri=b6fc698ea0b507adc08a98cf00c97966&ref=http%3A%2F%2Fpaid.outbrain.com%2F&cv=20220522-5-RELEASE&item-url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.buzzfond.com
pragma: no-cache
date: Thu, 26 May 2022 03:12:55 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 204 unip Show response
trc-events.taboola.com/1162268/log/3/ 0
247 B 16ms
16ms XHR
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://trc-events.taboola.com/1162268/log/3/unip?en=pre_d_eng_tb&tos=4571&scd=46&ssd=1&est=1653534771332&ver=35&isls=true&src=i&invt=3000&rv=1&tim=1653534775904&vi=1653534771328&ri=2e148219453b62f48a02b4463f26b669&ref=http%3A%2F%2Fpaid.outbrain.com%2F&cv=20220522-5-RELEASE&item-url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1042653/tfa.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.buzzfond.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-origin: https://www.buzzfond.com
pragma: no-cache
date: Thu, 26 May 2022 03:12:55 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 3E53 13 KB
13 KB 16ms
16ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

d85e6efa3aa2da5a294244e85e0b9651d98168cef37aa89138be2af1bebcf5f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Thu, 26 May 2022 03:12:56 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=54130
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 13154
expires: Thu, 26 May 2022 18:15:06 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: googlecm.hit.gemius.pl
URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECoYmE7z2n5vBA-pv-WFPNQ&google_cver=1&google_push=AYg5qPJ1ppppv3wODvQZ4_SHEUo-Jnqf08S6W4YQeZC1rrnMFAfd7otmUC4PLgWXuJg94iOtULn6FWpZu7BYO_wNV1Tdcp0ABsqRzQ

Verdicts & Comments Add Verdict or Comment

90 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.buzzfond.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: ce880570a4b2842577ec18d254a5df2c
www.buzzfond.com/	1970-01-20 03:20:21	Name: bf_id Value: 8dc9e6f6e0b1db9da27e2b99f513c724
www.buzzfond.com/	1969-12-31 23:59:59	Name: pageViewsPerSession Value: 1
www.buzzfond.com/	1970-01-20 03:20:21	Name: outbrain_click_id Value: v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4
.buzzfond.com/	1970-01-20 12:40:30	Name: __gads Value: ID=3deba6f7292ece3b-22aba8029dcd00bd:T=1653534771:RT=1653534771:S=ALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ
.buzzfond.com/	1970-01-20 20:50:06	Name: _ga Value: GA1.2.1135698774.1653534772
.buzzfond.com/	1970-01-20 03:20:21	Name: _gid Value: GA1.2.905163874.1653534772
.buzzfond.com/	1970-01-20 03:18:54	Name: _gat_UA-61791336-3 Value: 1
.doubleclick.net/	1970-01-20 12:40:30	Name: IDE Value: AHWqTUnfTrIJpjiQ2SeGpxV4Lxg2RpCcX7XdW4W7ZwV-kTtBT1rHBYvMedgBLCAVclU
.doubleclick.net/	1970-01-20 03:18:58	Name: DSID Value: NO_DATA
.casalemedia.com/	1970-01-20 12:04:30	Name: CMID Value: Yo7wNTQnvPGAP7pCMZKsmQAA
.casalemedia.com/	1970-01-20 05:28:30	Name: CMPS Value: 3276
.adnxs.com/	1970-01-20 05:28:30	Name: uuid2 Value: 1578314042744792646
.casalemedia.com/	1970-01-20 05:28:30	Name: CMPRO Value: 1200
.casalemedia.com/	1970-01-20 03:20:21	Name: CMST Value: Yo7wNWKO8DUA
.adnxs.com/	1970-01-20 05:28:30	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In<d#WV.!]tbPl1M>e)ZlrFUfJ+tGXxoi[/qn^Oq4Z)L[@^9]+mA@X@J+^YvpSib?Qq+3If)y3KL9D3I?+r!BiUr
.casalemedia.com/	1970-01-20 12:04:30	Name: CMRUM3 Value: 2d628ef0352760CAESEP429Jm7gXLDfdimNd1eqVA
.quantserve.com/	1970-01-20 05:28:30	Name: d Value: ECMBCQGdJoEA
.quantserve.com/	1970-01-20 12:49:09	Name: mc Value: 628ef035-622d5-cee42-c6bba
.redintelligence.net/	1970-01-20 05:28:30	Name: 8lcfmzhxc8d6_uid Value: 0c3a096cfa6d39a2
.pubmatic.com/	1970-01-20 03:20:21	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 05:28:30	Name: KADUSERCOOKIE Value: D1C54449-9C75-44DC-BF90-4D999195F227
.innovid.com/	1970-01-20 05:28:30	Name: uuid Value: 59ceaa4d-aee8-4fdc-aff6-dfcbf2fee063-20220525 23:12:53
.e.dlx.addthis.com/	1970-01-20 12:49:09	Name: na_tc Value: Y
.addthis.com/	1970-01-20 12:49:09	Name: na_id Value: 2022052603125300010241147235
.addthis.com/	1970-01-20 12:49:09	Name: na_tc Value: Y
.addthis.com/	1970-01-20 12:49:09	Name: uid Value: 628ef035b00e676d
.addthis.com/	1970-01-20 12:49:09	Name: ouid Value: 628ef03500016a527a459817ca990b7880c1350197daafd6ff41
.dlx.addthis.com/	1970-01-20 04:02:06	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 04:02:06	Name: na_sr Value: 20220526
.dlx.addthis.com/	1970-01-20 03:18:54	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-20 04:02:06	Name: na_sc_e Value: 0
www.buzzfond.com/	1970-01-20 12:04:30	Name: bfuser-consent Value: 1

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/13286003456218249693/index.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=3690020089&pi=t.aa~a.1397823514~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240&nras=3&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=1852&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=bSPXs1rzrY&p=https%3A//www.buzzfond.com&dtd=14 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/13286003456218249693/index.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/13286003456218249693/index.html".
security	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8173359565788166&output=html&h=240&adk=4147636252&adf=2016236655&pi=t.aa~a.1397825491~rp.3&w=300&fwrn=4&fwrnh=100&lmt=1653534772&rafmt=1&to=qs&pwprc=3037641804&psa=1&format=300x240&url=https%3A%2F%2Fwww.buzzfond.com%2Fwhat-happens-to-your-body-if-you-sleep-with-socks%2F%3Futm_source%3DCNN%26utm_medium%3Doutbrain%26utm_campaign%3D00daffd5a6c52890dcd11ce8780c662d38%26utm_content%3DCNN%2BEdition%2B%2528Turner%2BInternational%2529%26utm_term%3D0014dace722b21ef3ebec62fc10f878c42%26itm_term%3Dbf%26dicbo%3Dv1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4%26obOrigUrl%3Dtrue&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653534772608&bpp=1&bdt=1370&idt=-M&shv=r20220523&mjsv=m202205230101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3deba6f7292ece3b-22aba8029dcd00bd%3AT%3D1653534771%3ART%3D1653534771%3AS%3DALNI_MZ3ZEBmVIqRoO7loym8KI6TgE_-RQ&prev_fmts=0x0%2C728x90%2C728x90%2C300x240%2C300x240&nras=4&correlator=3645075113578&frm=20&pv=1&ga_vid=1135698774.1653534772&ga_sid=1653534772&ga_hid=968036649&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1008&ady=2452&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C44761044%2C31067756&oid=2&psts=AGkb-H90GywNRYHrhodsMkpsd3TLZUUQuv5NMvtDa722Ys0BJWGuGWIeg35x2OdMCsDlaBBAKnEEi3TrJC3_aKCTAA%2CAGkb-H9feLlKijN-xfsepsNdCVl7OJKQ1Fjsq2fgTt9e-aJz3c4RJbF6N1GKKehFZF4cT116-_9I_FURQI58qng&pvsid=3371456103291399&pem=123&tmod=314249946&uas=0&nvt=1&ref=http%3A%2F%2Fpaid.outbrain.com%2F&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=phOSHZIIce&p=https%3A//www.buzzfond.com&dtd=18 Message: Refused to frame 'https://pagead2.googlesyndication.com/' because it violates the following Content Security Policy directive: "frame-src cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp=er3$/13286003456218249693/index.html".
network	error	URL: https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESECoYmE7z2n5vBA-pv-WFPNQ&google_cver=1&google_push=AYg5qPJ1ppppv3wODvQZ4_SHEUo-Jnqf08S6W4YQeZC1rrnMFAfd7otmUC4PLgWXuJg94iOtULn6FWpZu7BYO_wNV1Tdcp0ABsqRzQ Message: Failed to load resource: net::ERR_ADDRESS_UNREACHABLE
network	error	URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005&t=htlp Message: Failed to load resource: the server responded with a status of 503 (Service Unavailable)
network	error	URL: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=14445100014469304444992011971005 Message: Failed to load resource: the server responded with a status of 503 (Service Unavailable)
other	error	URL: https://www.buzzfond.com/what-happens-to-your-body-if-you-sleep-with-socks/?utm_source=CNN&utm_medium=outbrain&utm_campaign=00daffd5a6c52890dcd11ce8780c662d38&utm_content=CNN+Edition+%28Turner+International%29&utm_term=0014dace722b21ef3ebec62fc10f878c42&itm_term=bf&dicbo=v1-88cb4ed02ad8aad11dbd2ad09ba18c7d-00bc4ac2ce0b69ec73bf946bbd8a749e0a-mi2tknrtg43diljummywmljumvsgkllbgu3dallegjsdiyzyg4zgmyleg4&obOrigUrl=true Message: Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
ads.eu.criteo.com
adservice.google.com
adservice.google.de
ag.innovid.com
amplify.outbrain.com
cat.nl.eu.criteo.com
cdn.buzzfond.com
cdn.taboola.com
cm.g.doubleclick.net
cms.quantserve.com
csm.eu.criteo.net
dsum-sec.casalemedia.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googlecm.hit.gemius.pl
hal9000.redintelligence.net
hal90005.redintelligence.net
ib.adnxs.com
image6.pubmatic.com
medialead.de
pagead2.googlesyndication.com
paid.outbrain.com
partner.googleadservices.com
pix.eu.criteo.net
pixel.everesttech.net
pixel.rubiconproject.com
pv.medialead.de
rtb.fr.eu.criteo.com
rtb.openx.net
ssum-sec.casalemedia.com
static.criteo.net
stats.g.doubleclick.net
tpc.googlesyndication.com
tr.outbrain.com
trc-events.taboola.com
trc.taboola.com
www.buzzfond.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
googlecm.hit.gemius.pl
104.16.113.65
104.90.180.98
104.90.192.27
138.201.63.165
141.226.228.48
142.250.185.70
142.250.74.194
145.239.193.130
151.101.129.44
151.101.14.132
178.250.0.139
178.250.2.148
178.250.2.150
198.47.127.19
23.35.236.247
2620:116:800d:21:c5a4:625:6563:a5bb
2a00:1450:4001:801::2002
2a00:1450:4001:801::200e
2a00:1450:4001:809::2004
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:811::2001
2a00:1450:4001:812::2003
2a00:1450:4001:812::2008
2a00:1450:4001:827::2002
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a00:1450:400c:c0c::9b
2a02:2638:1::3
2a02:2638:1::4
2a02:2638::2
2a05:d01c:1d8:8101:37a8:11c6:83f7:6fb7
35.186.253.211
37.252.173.27
52.214.225.206
69.173.144.165
70.42.32.159
88.99.165.19
94.23.99.218
01284adf0039080c4d89732ef83440fd31b310a7bf3867b83b030f99ffd1f1c1
03ab5617452202dfb00c3e9626773e0ce96812e80e576103a651721d76255a67
04b2d174446a243ce8b98e4968fe90225e77253a62a3c138512fbc13f4b017ae
04bc19d01fed0f201fa71aab93f41bbb1f3d15bfa4063b8185f4bcfe60514690
0770be4f78c7c13147f6dc6dc3b05296e34ae904175fae2afacd8d2d6df12acd
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
170aba10d06d97475a89f9e6a41fd239eccdc9b66321b123a9579740ea9e2b32
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1f322935e772a438d6ea519a6422103df0cea4fb4e1a5f3b04ee20cfdaad3f58
207b12e06eb1dc5c3c3bf9f868034f970558cd911ab42e9046baa75260dd5422
21dd3160c70dd51a6f10ddfbc333ec72eecc7866b2ee66681bfc635c919ad957
2471978e1171417f89974e80cccb21486b8691652a7bbeeb604eed9fa518a98c
2621bf47f6f2d4593cdacd431c534fb67d841ba040d9c5e00cd23e8d4cbff973
2777960bba436fd9da5f1004ac21d665f2e3782eb315e6aabea88ccefda7153f
283c75e109422038fe86053152f2a44b039089ac9ebb5ad8e685f8bd54a5d667
2d55f94b01d0a5e7962dfdbd10e6525078aca29385c09c9119fc43545c877a3e
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
3478ae2c5fa0c2d71c0412ab73b78e041b67a76cc144dcb5792ceeb66862baf4
4611c694de0819ad83742cbdb99c29fe792c252d63edf7ab1193f02e8c975db3
4a30aa9785bdf516c0f4721d942e43ac5652ed6c183a9400bed4eb50706d7c9b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b84c26fc972d527005b6353058ff181ca9dfbb9047bed018e6b019f965d3cdc
4bf76e126fa009e176c86ada1aabed072f81e7774e5c327400cb45478beda168
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f6986c286d003e7dfc6ac2c845165de38d935032b49b6a61ed72cec76ae025a
4f80916a31281cb9d243b56400a624d914c995c0198ee7ef3b486cdc14f53afb
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
506f01427cb9c230a972ff1996815751e868e869b13675cfdb7cebf6b45cc7cc
53ef4ae476b919f54c4d0c6e57ddbb1366e3d93665b05eb4fb2e4c8149faa188
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
546b69a1feb3df5880d6b6bbd476c6e332371c778682b4b6ac0c589f44551e28
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5b0c111073f2332d32b3e9422ac088f1f9a255532a6cbc1839895dfde44f7e8e
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
689d7ca865d3da925f00da0c2fb39e16528963b8e05021a8efd8d043e1cb9fcc
6930c4007dda348574ebe771d9b9ec333a4296c8a0e4fed786f5040e68467c30
6b03e4e57cb42e65d381281fa1e226c33d67293d133ba70c0c8e41efd957c99f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c93b916747abfc49ca1540fc5a8a147752b4a928e5e8dc27feaada48d125d0d
6d29b2e7dd9b174a0763ec7ad831de70eb28fbf0e9bc338023abe6eb647708d0
6fb16a7114ad02b30e411574afa76430c7faf567e437f6e1fe1ef103845a0aa9
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
72e5f728922d5d66f06b2c60c65010553173cea2d08c6fac92df6540bc5248fd
7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65
73c40374ec6beeae8ef306a7e771d27b61f2059861ff39715c3f02ca4c1cb5ef
76b339c6accd6f80db6b6a809b1b668606e307bcdbc9016fc15fe2922d4288e1
781f16602ae74fba91999714d81dbc603ab905cabbcd434d5820143d14b2fd98
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7bdb1cd6eb6a48113dab6201ce184d8a2dd15c153a3d8d721d1022d5cad9a51c
7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16
7e8ef05a55eafab5277e6449520107db94dfb01b497a52f283e7ffa6ee49363d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92
8635a5489749d829d4bee1446dead9cb1144faf2c81230a9fdc149ae60f6003a
86bfadb072579433073974de1ad02a98fa6c0931f582d7e1a3a50947f6305f14
8a20a7f38a2b97aaff2e9efb1615e2bfed5770fb84f54a2ddc8b2c365e6e44d7
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8b1853975c021d4423d0213962a40c9bae838da219fd458474af22e5cc18daf1
8d499bfc8be5d66fb9cf230bf46e36ab5dcd90aca21c2d10a9d7049227b09553
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8f324c3671445c0dbdf0048e9d3e6af2e84ccadc8b069de39135f465a33be5ec
918e1cfa104cf2ad2942fd66030698b8bd602ded209a4fd35552e210e59b5931
92d1b18ad78887858b08b509dbd6bfe8520f9080e40f45086894bfdab5839bc9
980fcf363a7373fcfd8ea3e545448bfeef574a964cd63de3241ccc92ba6e5143
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b6b05950998ad7c50ab53540603c0c2d82c2dd4848b18e4f0061a13e1c5428d
9c7239a044877cfd3dc7bdd67523e2fe698edd2fd4886ea52a6b3cedb17dc8f4
9d35005caccccfa9e5e792c75685c01ae51c0cad66aec1ddba2e1291c9ca930f
9dad4e03374208bc27394176dc42eb53830b7f9c6b248514de9d4aa4998ef821
9dd1098039117ec8d876d5377e658d91e29efa73163239def6b876496a46e459
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0315bfa940cec7f30ae116bee1f6d956364cbc699192ecc69711d42c66033e6
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a141ff968e3e019b75b4831f9ce72566a080f855767f7d81ef6a1c63418f551f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4b915613d8b4ee75d0929d61324dfe6fe3a07fdc60781a598bc7cf853eb9cfe
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a7843dbf33f2eb996f407f21acb322db23be1a6cb72c049fb1f7f779a8ffc519
a942a97f2bdbdda6b213510a33dcbdf369532baee90c2f21f81c6c01c90534f0
aa3777d578531c63cb5b48a28d1f0135a9769ca2ee44ae916aadb341089140e1
ab4620524f7a08c502887be3119a9174305cce8939e89b4c7f365a8043b4dd54
ae3d8bf762457b735c4a211756caeea9c394cb713605cf5d51b04b68d2df3c59
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2adc08ef063571d56558d6a6f06d3e2d5fb2041f0335f1389401b71094d9e9b
b669a38bf0f807758e40caf18ead5967b1f1cae516847bb225a7122883360e9c
b7b667b7752b281e8d816d40ccefd82bde63dcfa4c8ce9e7ad22794b7f9663ba
b81497e274f647ef42aaa04ec827a3cda1062a4b7841526686df7d19eae6d104
b9a85c34e10a09ab6d6f629bd9d6497ea724585ea2634226b9a05650bb45f45e
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
c033498e9d968673cff0289e25ebb594a2fd83b2973d7b53543faac92974e12f
c0b26fee0bf4c8a306205ad90be4548cb4732823c4582a8bd8c5ae36930711d0
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
cba179f85e06c1302fec3484afc33d4e658aa2841564b64f31dc81dff33300ee
cba47082178b1574a96fa49c257693082949237914f632073da2f476dc81e0db
ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d67183dbc3efe1173064a66963608046766bd4c8ab8806aa53995e8fe571c75d
d85e6efa3aa2da5a294244e85e0b9651d98168cef37aa89138be2af1bebcf5f5
dbc5aab7ffa1ef622b29a49bb2d4dda993c70188713d283824436ccda2db5540
dc667f2ef8dff50a11d49c56e128d27c4282b977a62434544dea160c112ed035
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e18d5ab6f2fcd0e23b5e4c8b4191d8a656195100d38135a645d240b5abb57500
e2439eb29fac11292df03993726b4b26c69d7bc65edebd4c1a183f37df3f0447
e252d4316e3c1179fb31b8be61c3bbfe9234c3df264a8232510a82b4ea68ea74
e2882653a857d312314c28563f5cd6a6504208234ff08b19d2d43c6017477ba0
e30e6f803e414dbea71aef42c68672ad92dd7aa103a56e1be31191d27218f8e6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4a7e92291c7c3762e70fa50a9125648bf36ceb3756d1a8aab689bcea989d8e4
e67fb40f34de09b70a1e9d1191dba480eddac71052040a5615bc72966ea31f6e
e9caa3698b58479a78692e6303c5353d891066dc64fd2f4a34e14b2882fdb69b
ea110bca5902995d5d57f0d74ad54124a9cbeeab1169b50fcbde4ff9e9cacf9c
eabb7dbd96c4af6e89a4edc4aab086a81aae02b76ea5c714d7b127757efb9803
eadc212eb38c8b164c02a9806884fef9d35cbd690d71b6aa902db0085fa2da85
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef22484684b3673663d9f8a04d330c91991b9a002e6e0fc7f92cb7279ad26b4b
f1498bd2a9c3663de6bd3827bc03396140743b8ec409dfc0201399952958f093
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f9a9c0e6a34440347bfb24f7b85791cb6830205e677250aab2c13847eec1c338

www.buzzfond.com Open in urlscan Pro 104.16.113.65 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

226 Requests

92 %HTTPS

44 %IPv6

27 Domains

45 Subdomains

35 IPs

8 Countries

2396 kBTransfer

5417 kBSize

33 Cookies

0 Outgoing links

Page URL History

Redirected requests

226 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.buzzfond.com Open in urlscan Pro
104.16.113.65 Public Scan

Screenshot
Live screenshot

Full Image

226
Requests

92 %
HTTPS

44 %
IPv6

27
Domains

45
Subdomains

35
IPs

8
Countries

2396 kB
Transfer

5417 kB
Size

33
Cookies

226 HTTP transactions
7 data transactions