www.spokesman.com Open in urlscan Pro
2600:9000:21f3:5200:0:b5fb:e6c0:93a1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://comcast-accountupdates.com/
Effective URL:
https://www.spokesman.com/
Submission: On December 08 via automatic, source certstream-suspicious (December 8th 2022, 2:59:01 pm UTC) — Scanned from DE

Summary HTTP 269 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 60 IPs in 9 countries across 47 domains to perform 269 HTTP transactions. The main IP is 2600:9000:21f3:5200:0:b5fb:e6c0:93a1, located in United States and belongs to AMAZON-02, US. The main domain is www.spokesman.com. The Cisco Umbrella rank of the primary domain is 162173.
TLS certificate: Issued by Amazon on July 20th 2022. Valid for: a year.

This is the only time www.spokesman.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	164.92.121.13 164.92.121.13	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 1	2600:9000:206... 2600:9000:206f:ea00:13:3ce1:5800:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:21f... 2600:9000:21f3:5200:0:b5fb:e6c0:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:205... 2600:9000:2057:ba00:2:4597:5e80:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2600:9000:211... 2600:9000:211e:8800:1e:dc88:cb00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.66.97.129 18.66.97.129	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
5	2600:9000:225... 2600:9000:2250:8600:18:730a:3f00:93a1	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1 2	107.178.250.234 107.178.250.234	15169 (GOOGLE) (GOOGLE)
9	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
1	13.224.189.14 13.224.189.14	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
9	34.224.131.223 34.224.131.223	14618 (AMAZON-AES) (AMAZON-AES)
2	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:800... 2a04:4e42:800::282	54113 (FASTLY) (FASTLY)
17	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
1	13.32.27.65 13.32.27.65	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:206... 2600:9000:206f:8e00:14:c3e7:6780:93a1	16509 (AMAZON-02) (AMAZON-02)
1	35.227.203.93 35.227.203.93	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	3.134.45.248 3.134.45.248	16509 (AMAZON-02) (AMAZON-02)
3	2606:4700:e2:... 2606:4700:e2::ac40:8a04	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	44.239.110.109 44.239.110.109	16509 (AMAZON-02) (AMAZON-02)
2	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
1	34.96.74.203 34.96.74.203	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
36	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1	172.67.75.166 172.67.75.166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.216.20.40 52.216.20.40	16509 (AMAZON-02) (AMAZON-02)
2	13.69.106.211 13.69.106.211	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
10 12	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
4 8	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
6 8	185.89.210.153 185.89.210.153	29990 (ASN-APPNEX) (ASN-APPNEX)
4	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
4	104.75.89.75 104.75.89.75	16625 (AKAMAI-AS) (AKAMAI-AS)
16	116.202.48.214 116.202.48.214	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.63.164 138.201.63.164	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.64.38 138.201.64.38	24940 (HETZNER-AS) (HETZNER-AS)
1 4	46.4.10.49 46.4.10.49	24940 (HETZNER-AS) (HETZNER-AS)
1 4	138.201.84.245 138.201.84.245	24940 (HETZNER-AS) (HETZNER-AS)
4	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
8 8	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
4	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
4	18.133.50.153 18.133.50.153	16509 (AMAZON-02) (AMAZON-02)
4 8	142.250.185.102 142.250.185.102	15169 (GOOGLE) (GOOGLE)
4 4	94.23.99.218 94.23.99.218	16276 (OVH) (OVH)
4	54.76.176.197 54.76.176.197	16509 (AMAZON-02) (AMAZON-02)
4	104.111.239.217 104.111.239.217	16625 (AKAMAI-AS) (AKAMAI-AS)
4	65.9.66.92 65.9.66.92	16509 (AMAZON-02) (AMAZON-02)
4	13.224.189.47 13.224.189.47	16509 (AMAZON-02) (AMAZON-02)
2	13.85.16.224 13.85.16.224	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	3.11.196.201 3.11.196.201	16509 (AMAZON-02) (AMAZON-02)
269	60

1 164.92.121.13 (Santa Clara, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

comcast-accountupdates.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:ea00:13:3ce1:5800:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:5200:0:b5fb:e6c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2057:ba00:2:4597:5e80:93a1 (United States)

ASN16509 (AMAZON-02, US)

thumb.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:211e:8800:1e:dc88:cb00:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-129.fra56.r.cloudfront.net

cdn-gateflipp.flippback.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2250:8600:18:730a:3f00:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.spokesman.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.250.234 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

loader-cdn.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.wgchrrammzv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.mircheigeshoa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.godiciardstia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.pranmcpkx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.czx5eyk0exbhwp43ya.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.189.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-14.fra2.r.cloudfront.net

p.flipp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 34.224.131.223 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-224-131-223.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:800::282 (United States)

ASN54113 (FASTLY, US)

polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.65 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-65.fra56.r.cloudfront.net

d31qbv1cthcecs.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:8e00:14:c3e7:6780:93a1 (United States)

ASN16509 (AMAZON-02, US)

aamcftag.aamsitecertifier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.203.93 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 93.203.227.35.bc.googleusercontent.com

pymx5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.134.45.248 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-134-45-248.us-east-2.compute.amazonaws.com

redirect.prod.experiment.routing.cloudfront.aws.a2z.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:e2::ac40:8a04 (United States)

ASN13335 (CLOUDFLARENET, US)

api.aamapiv2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.239.110.109 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-239-110-109.us-west-2.compute.amazonaws.com

aamcf.aamsitecertifier.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.74.203 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 203.74.96.34.bc.googleusercontent.com

api.pymx5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.75.166 (United States)

ASN13335 (CLOUDFLARENET, US)

api-mg2.db-ip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.216.20.40 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

paywall-ad-bucket.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.69.106.211 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 216.58.212.162 (United States) 10 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.80.39.216 (Canada) 4 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.89.210.153 (Frankfurt am Main, Germany) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.75.89.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-89-75.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 116.202.48.214 (Krefeld, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.214.48.202.116.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.164 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.164.63.201.138.clients.your-server.de

hal90006.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.64.38 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.38.64.201.138.clients.your-server.de

hal900011.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 46.4.10.49 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.49.10.4.46.clients.your-server.de

hal90001.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.84.245 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.245.84.201.138.clients.your-server.de

hal900025.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 145.239.193.130 (France) 8 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 88.198.250.30 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.133.50.153 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.185.102 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 94.23.99.218 (France) 4 redirects

ASN16276 (OVH, FR)
PTR: ip218.ip-94-23-99.eu

medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.76.176.197 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com

ad-server.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.239.217 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-217.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 65.9.66.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-92.fra56.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.224.189.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-47.fra2.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

prod-spokesman-proxy-connext.azurewebsites.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.11.196.201 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	googlesyndication.com efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 101 tpc.googlesyndication.com — Cisco Umbrella Rank: 142	728 KB
41	doubleclick.net 14 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 190 stats.g.doubleclick.net — Cisco Umbrella Rank: 74 googleads.g.doubleclick.net — Cisco Umbrella Rank: 34 cm.g.doubleclick.net — Cisco Umbrella Rank: 205 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 85782	264 KB
32	redintelligence.net 4 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 38358 hal90006.redintelligence.net — Cisco Umbrella Rank: 359509 hal900011.redintelligence.net — Cisco Umbrella Rank: 362594 hal90001.redintelligence.net — Cisco Umbrella Rank: 287169 hal900025.redintelligence.net — Cisco Umbrella Rank: 338133	166 KB
20	spokesman.com 1 redirects spokesman.com — Cisco Umbrella Rank: 112086 www.spokesman.com — Cisco Umbrella Rank: 162173 thumb.spokesman.com — Cisco Umbrella Rank: 179891 static.spokesman.com — Cisco Umbrella Rank: 282392 media.spokesman.com — Cisco Umbrella Rank: 253086	13 MB
12	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 17760 api.webgains.io — Cisco Umbrella Rank: 50133	125 KB
12	medialead.de 12 redirects pv.medialead.de — Cisco Umbrella Rank: 51738 medialead.de — Cisco Umbrella Rank: 51281	5 KB
11	matheranalytics.com 1 redirects js.matheranalytics.com — Cisco Umbrella Rank: 10351 www.i.matheranalytics.com — Cisco Umbrella Rank: 9960	45 KB
10	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 26 region1.google-analytics.com — Cisco Umbrella Rank: 2554	40 KB
8	adnxs.com 6 redirects ib.adnxs.com — Cisco Umbrella Rank: 208	8 KB
8	casalemedia.com 4 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 512	6 KB
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 188	327 KB
7	google.com adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2	2 KB
7	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 47	336 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	3 KB
5	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 371	109 KB
4	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 47552	7 KB
4	awin1.com www.awin1.com — Cisco Umbrella Rank: 13731	3 KB
4	ad-server.eu ad-server.eu — Cisco Umbrella Rank: 103287	1 KB
4	webgains.com track.webgains.com — Cisco Umbrella Rank: 39921	7 KB
4	media01.eu pb.media01.eu — Cisco Umbrella Rank: 50108	1 KB
4	office-partner.de adv.office-partner.de — Cisco Umbrella Rank: 139863	4 KB
4	teads.tv sync.teads.tv — Cisco Umbrella Rank: 1207	688 B
4	openx.net us-u.openx.net — Cisco Umbrella Rank: 405	546 B
3	pranmcpkx.com cdn.pranmcpkx.com — Cisco Umbrella Rank: 38444	2 MB
3	aamapiv2.com api.aamapiv2.com — Cisco Umbrella Rank: 51909	8 KB
2	azurewebsites.net prod-spokesman-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 374667	1 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 794	408 B
2	amazonaws.com paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 35229	2 KB
2	czx5eyk0exbhwp43ya.biz cdn.czx5eyk0exbhwp43ya.biz — Cisco Umbrella Rank: 30128	5 KB
2	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 2139	44 KB
2	pymx5.com pymx5.com — Cisco Umbrella Rank: 91768 api.pymx5.com — Cisco Umbrella Rank: 100062	10 KB
2	aamsitecertifier.com aamcftag.aamsitecertifier.com — Cisco Umbrella Rank: 60040 aamcf.aamsitecertifier.com — Cisco Umbrella Rank: 38405	28 KB
2	google.de adservice.google.de — Cisco Umbrella Rank: 8575 www.google.de — Cisco Umbrella Rank: 6073	1 KB
1	db-ip.com api-mg2.db-ip.com — Cisco Umbrella Rank: 23987	799 B
1	godiciardstia.com cdn.godiciardstia.com — Cisco Umbrella Rank: 53017	48 KB
1	mircheigeshoa.com cdn.mircheigeshoa.com — Cisco Umbrella Rank: 52744	23 KB
1	a2z.com redirect.prod.experiment.routing.cloudfront.aws.a2z.com	48 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	185 B
1	cloudfront.net d31qbv1cthcecs.cloudfront.net	2 KB
1	wgchrrammzv.com cdn.wgchrrammzv.com — Cisco Umbrella Rank: 36633	2 KB
1	polyfill.io polyfill.io — Cisco Umbrella Rank: 1385	571 B
1	flipp.com p.flipp.com — Cisco Umbrella Rank: 15009
1	azureedge.net loader-cdn.azureedge.net — Cisco Umbrella Rank: 25713	12 KB
1	flippback.com cdn-gateflipp.flippback.com — Cisco Umbrella Rank: 15338	18 KB
1	comcast-accountupdates.com 1 redirects comcast-accountupdates.com	466 B
0	alexametrics.com Failed certify.alexametrics.com Failed
269	47

	Domain	Requested by
36	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.spokesman.com efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com googleads.g.doubleclick.net
17	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com www.googletagservices.com
16	hal9000.redintelligence.net	efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com hal90006.redintelligence.net hal900025.redintelligence.net hal90001.redintelligence.net hal900011.redintelligence.net
12	cm.g.doubleclick.net	10 redirects googleads.g.doubleclick.net
11	securepubads.g.doubleclick.net	www.spokesman.com securepubads.g.doubleclick.net www.googletagservices.com
9	www.i.matheranalytics.com	www.spokesman.com
9	www.google-analytics.com	www.googletagmanager.com www.spokesman.com www.google-analytics.com
8	api.webgains.io	analytics.webgains.io
8	5994599.fls.doubleclick.net	4 redirects www.spokesman.com
8	pv.medialead.de	8 redirects
8	ib.adnxs.com	6 redirects googleads.g.doubleclick.net
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
8	googleads.g.doubleclick.net	efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com www.spokesman.com
8	static.spokesman.com	www.spokesman.com static.spokesman.com
7	www.googletagservices.com	securepubads.g.doubleclick.net efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
7	www.googletagmanager.com	www.spokesman.com www.googletagmanager.com cdn.godiciardstia.com adv.office-partner.de
5	fonts.googleapis.com	securepubads.g.doubleclick.net hal90006.redintelligence.net hal900025.redintelligence.net hal90001.redintelligence.net hal900011.redintelligence.net
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	adservice.google.com	securepubads.g.doubleclick.net 5994599.fls.doubleclick.net
5	media.spokesman.com	www.spokesman.com
5	thumb.spokesman.com	www.spokesman.com
4	cdn.track.production.webgains.team	efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com track.webgains.com
4	analytics.webgains.io	track.webgains.com
4	www.awin1.com	efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
4	ad-server.eu	efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
4	medialead.de	4 redirects
4	track.webgains.com	www.spokesman.com
4	pb.media01.eu	hal90006.redintelligence.net hal900025.redintelligence.net hal90001.redintelligence.net hal900011.redintelligence.net
4	adv.office-partner.de	hal90006.redintelligence.net hal900025.redintelligence.net hal90001.redintelligence.net hal900011.redintelligence.net
4	hal900025.redintelligence.net	1 redirects efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com hal900025.redintelligence.net
4	hal90001.redintelligence.net	1 redirects efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com hal90001.redintelligence.net
4	hal900011.redintelligence.net	1 redirects efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com hal900011.redintelligence.net
4	hal90006.redintelligence.net	1 redirects efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com hal90006.redintelligence.net
4	sync.teads.tv	googleads.g.doubleclick.net
4	us-u.openx.net	googleads.g.doubleclick.net
3	cdn.pranmcpkx.com	loader-cdn.azureedge.net cdn.pranmcpkx.com
3	api.aamapiv2.com	aamcftag.aamsitecertifier.com www.spokesman.com api.aamapiv2.com
2	prod-spokesman-proxy-connext.azurewebsites.net	cdn.pranmcpkx.com
2	fonts.gstatic.com	fonts.googleapis.com
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	paywall-ad-bucket.s3.amazonaws.com	cdn.pranmcpkx.com
2	cdn.czx5eyk0exbhwp43ya.biz	cdn.pranmcpkx.com
2	az416426.vo.msecnd.net	loader-cdn.azureedge.net cdn.pranmcpkx.com
2	www.google.com	www.spokesman.com tpc.googlesyndication.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	js.matheranalytics.com	1 redirects www.spokesman.com
1	api-mg2.db-ip.com	cdn.mircheigeshoa.com
1	api.pymx5.com	pymx5.com
1	cdn.godiciardstia.com	loader-cdn.azureedge.net
1	cdn.mircheigeshoa.com	loader-cdn.azureedge.net
1	aamcf.aamsitecertifier.com
1	redirect.prod.experiment.routing.cloudfront.aws.a2z.com
1	www.facebook.com
1	pymx5.com	www.googletagmanager.com
1	aamcftag.aamsitecertifier.com	www.spokesman.com
1	d31qbv1cthcecs.cloudfront.net	www.spokesman.com
1	cdn.wgchrrammzv.com	loader-cdn.azureedge.net
1	polyfill.io	loader-cdn.azureedge.net
1	www.google.de	www.spokesman.com
1	adservice.google.de	securepubads.g.doubleclick.net
1	region1.google-analytics.com	www.googletagmanager.com
1	p.flipp.com	cdn-gateflipp.flippback.com
1	loader-cdn.azureedge.net	static.spokesman.com
1	cdn-gateflipp.flippback.com	www.spokesman.com
1	www.spokesman.com
1	spokesman.com	1 redirects
1	comcast-accountupdates.com	1 redirects
0	certify.alexametrics.com Failed
269	69

This site contains links to these domains. Also see Links.

Domain
checkout.spokesman.com
myaccount.spokesman.com
spokesmanreview-wa.newsmemory.com
podcasts.google.com
itunes.apple.com
open.spotify.com
triple9digital.com
www.latahcreek.com
www.gordonphysicaltherapy.com
medicine.wsu.edu
www.mcmanusplays.com
www.snapwa.org
www.spokanelibrary.org
www.affinityforliving.com
www.shannonhelm.com
www.sylvanlearning.com
big-table.com
umispokane.com
www.huckleberrysnaturalmarket.com
www.spokane7.com
www.facebook.com
twitter.com
www.legacy.com
pics.spokesman.com

Subject Issuer	Validity	Valid
spokesman.com Amazon	`2022-07-20` - `2023-08-18`	a year	crt.sh
*.flippback.com Amazon	`2022-07-01` - `2023-07-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2022-10-25` - `2023-10-25`	a year	crt.sh
flipp.com Amazon	`2022-08-31` - `2023-09-28`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
www.i.matheranalytics.com Amazon	`2022-01-13` - `2023-02-11`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
polyfill.io GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-03-08` - `2023-04-09`	a year	crt.sh
sni2bf2bgl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-31` - `2023-11-02`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.aamsitecertifier.com Amazon	`2022-05-29` - `2023-06-27`	a year	crt.sh
*.pymx5.com Go Daddy Secure Certificate Authority - G2	`2022-09-01` - `2023-09-17`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-09-16` - `2022-12-15`	3 months	crt.sh
*.prod.experiment.routing.cloudfront.aws.a2z.com Amazon	`2022-09-12` - `2023-10-11`	a year	crt.sh
*.aamapiv2.com E1	`2022-10-22` - `2023-01-20`	3 months	crt.sh
sni2bf2fgl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-31` - `2023-11-02`	a year	crt.sh
sni2bf2egl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-31` - `2023-11-02`	a year	crt.sh
sni2bf2agl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2022-10-31` - `2023-11-02`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-17` - `2023-05-17`	a year	crt.sh
snibe7egl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-31` - `2023-03-03`	a year	crt.sh
*.s3.amazonaws.com Amazon	`2022-09-21` - `2023-08-26`	a year	crt.sh
in.applicationinsights.azure.com Microsoft Azure TLS Issuing CA 05	`2022-11-21` - `2023-11-16`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
teads.tv R3	`2022-10-27` - `2023-01-25`	3 months	crt.sh
redintelligence.net R3	`2022-12-05` - `2023-03-05`	3 months	crt.sh
adv.office-partner.de R3	`2022-11-02` - `2023-01-31`	3 months	crt.sh
*.media01.eu RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-05-20` - `2023-05-21`	a year	crt.sh
*.webgains.com Amazon	`2022-06-14` - `2023-07-13`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-11-07` - `2023-01-30`	3 months	crt.sh
www.awin1.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-18` - `2023-04-19`	a year	crt.sh
*.webgains.io Amazon	`2022-08-23` - `2023-09-21`	a year	crt.sh
cdn.track.production.webgains.team Amazon	`2022-09-29` - `2023-10-28`	a year	crt.sh
*.azurewebsites.net Microsoft Azure TLS Issuing CA 01	`2022-03-14` - `2023-03-09`	a year	crt.sh

This page contains 36 frames:

Primary Page: https://www.spokesman.com/
Frame ID: A0C81658FE6F95CCB23920D7E671F56A
Requests: 87 HTTP requests in this frame

Frame: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: AF0F37E29E8C6E6ACDC5EBFF0CCA0E43
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: A7F637AD4CA52C9DFFC2DFAC48E0E201
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4716E460BD107679E5D0EDB67FA3943C
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLQ1nb4LgUGwoMIBzyH5evDbTWY7Q1MsM-BVYF6d5g9YeJJ0g8xldNgXzQGvKXpLUyvZ5UxM2D2EjJfsOLk8EOI2sumnYy-2MXPHI7Ztj7ua8La4QTSMAZiXhaub5Zx6eAh9vI61ycNJpxEMYUn2thMatL_UPX5V1bEoRTYUbdPXPyZQj5BIAx9bKN6WuHzlTLGRHr6gowyWXLRErHk2XYaN9c0IdOsa0lbvQEbI0_Q64GUD2BnAYQ6Z0T_J1-HdAsWNtGkhZwba0ZI_OYEHq7gZaArrKDmjL5V8x-7gVPFQ9LWrhU8wE6skSUOTcg0R7LRu_aRhCuUG71hgI20l0-sayuf-JCk9A6DmVOVdFXekiF_N0duHBR&sai=AMfl-YT0G5XrMqqOhbm8plZhPelM-N9iA0imx1ihWUQ9Kx-2X2pMSkaVMDEtSD3ZbwMUF43mGhaTA81hO7XQh9SxPI8yHRB4vYpJyYb91x5kXVJeOPXdsECZRPedqlZlOId0bDcBUdLVaIRRDiWsrS4Mxg&sig=Cg0ArKJSzD0JP5lTzi5KEAE&uach_m=[UACH]&adurl=
Frame ID: B924C8B19995D975D219A588007E3B09
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-pf1t5o1H3CqocLZtC9mE5LkBIMsxviK5xmV5whqoKw0BuO3fJM77q9h2mBVYMQkUmG6ilt_tb9IuCIVF_absSwWTgcvk3Otl9Y3WJA27pSPNLHU-ROBbaNU_09EeNjBvPhYnW9tije4WhV01keFiUBMY-ray1bwpUCXuEdE-34BGCzxwzKbRXXlBu5icBNe5pBLbCHQpsOXe1mfWexXhoq89pqh_inp9vspdwhwDQ09IYbgtnSsuX_44m7MTsoL91r7s_MxFe_GqrqQgfO1BPMbu2hbtKkArFiiiYHGGf18Eae9cf73LAFBZGwfOtFGyktFuvYJJ6RRM9qhOvQLGXJpci6rDp3K9aQiu&sai=AMfl-YTNgd5BFzD_TZJj3ML04GesQoYRSH7oQj6ZMyTsGAGUgnLwP2CgA9meCNlnWzGNJRgvfo8ztSbyjxqbYRA9aUSl0wzakDuQ1MQ0efp5GXK-4kGwfvz77waDuKnPuS0id7Ow_5zLaKfkqXGuKqDKlA&sig=Cg0ArKJSzHHHJBh_Vz2vEAE&uach_m=[UACH]&adurl=
Frame ID: A7363BE4BA5F6AE45FD07CC2D8050175
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuzdQOH0V_JOBGYf0y9zHf-2vtp9vODVk1qO_D4lFXzwm8neE0gK_KnUfGQAR6Hvqkhz1ni2ogL-olXq9zIXIRDu5XW0BZ_BP8IQdD71G5TI0t8d4Rl3XBgHdKNAJccQir64z5eKVNCWnsm9pw6R6RuT0EX-C_Fe3xTKi8NBFk4T0P7u_sAl_huSXpnYZjozH-W86Qj9LkkCFfEkBb7T6Fhlrb7KVu5eti62x5xGby0WlGLu535VYwQvTUBbhe2mLjOj1iXHmNgX1BKjW41JlQgqvi7kic_8KDPAWDeexsbb1zbvUiZCh6llM_p1bkhpVxEDNFvZc1MpnDS4Qq44OqSJ-tY&sai=AMfl-YSiYUDiLFRUgypf0Exu6QV_JD3kT-dEyYQV84OEYgxcVUNL0cLOAhA2w-jfHzv6B7la8QKV0sqFhdl0xSsDkdSs0nN2EO1NpWdVM_3oL4BezI9irUVu_pXlkbb7wowSu_j2N_XoDWyqGY_C_ottJw&sig=Cg0ArKJSzJK9dxvFteCgEAE&uach_m=[UACH]&adurl=
Frame ID: 5C582B8D4DC8C25FE28081EAF0A3CEED
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs
Frame ID: 2C469FEF4F7DD9A2436CE9D1BA1099B6
Requests: 15 HTTP requests in this frame

Frame: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C3CF7F6BACA6ABAA0AA3C339CCD1DD07
Requests: 17 HTTP requests in this frame

Frame: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: CDAB639363C3DB2AA268E5706ED79E66
Requests: 17 HTTP requests in this frame

Frame: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 08533E79B41C8AF9F5B5FB2F89FEE3AB
Requests: 17 HTTP requests in this frame

Frame: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: FB48B529B56C1CDEF639F6147D5D5527
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVjLm_GItDL2HQqbIWD9DYQwENw1gXQx-gkHCWG8uZT1pQF5S7VlWCGsx3IB2iFZKyOh9GD7RbclYa33SIUCDWnCCGwD1JFLeelOuhglnYPSkJw5k1oXfRg_4DNuRpViJFqB96wCtByksiK9U4BrqgOqjcM_lzlZS6lSzoARHzDo1O1GVE
Frame ID: 3A310F884386A6E5FD882D27F8FDF5D1
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXN97CXtb6oTY8hIm_ABa32l0_pEfMxi76_TXCaOV9HmfTjwLM4wYx2HDHO29E-it9iJHWZ81nJfnVoHEJ2ofAqc3JZo9qLHYlDBOK3QUJTnEQNdI95DCBhEynxdf_s2CL-QjU9Sxp63f685jFa2HeCTxThQhb-wSFdhW31SN8o_r2UKMU
Frame ID: F63019CCEB9DEA1A994E78179F95195B
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX1Y2tkmiD9GkwSovXRWho4Y7OEVK1SCLz7RKZxxHZJ4nNpa5XZRQAg0f2J-cFnpTGeOdSnssbvMfPVqryjIY2MXGFk3ZS9630sxbU_HX4HX-uT9hQLrhP5cIi3sOgEMmUyr7WfAdKWmoGCckwDQakc9XT5wKy7EaswiD9lTPCQ2HAVIdY
Frame ID: 022A1114B181CB780308E7516008986D
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUmL3-BADyZmgeEWFo4FgwBg0vKXS1Txl8NObXEI-XXkZY5RzR-1hQPL779GTThiVFvw8o4m7CL7efEJwCqU8JIciuL7EukxohKVAwKeKRIQ9Czf87aVcztaDWIcYkJZvJ9BY7U9YRf9x5J42w7KzY1mjwx6DC3hIWMGwHFvvJd51GxsSM
Frame ID: EC1F6F45F48AA3E8B8C6EC7542A50294
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B510140F67309135846650F84A90669B
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C6036F67FCABE3978717EC77C8D55BEC
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9FC308795AB9C9BAAB7227EE779A51C0
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 5CF44151BD2AD3D1D200532673D0ED84
Requests: 3 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 6A6AB800AD43B9133301E2FE8E5AA9BB
Requests: 2 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22540900075928304444550012167006&actionid=981741&produktid=&dt_url=
Frame ID: 085F5C4CF75F7817E18F576A053FFEAF
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757
Frame ID: BC46AC75A5D8DC1689E5DF6CB55A6081
Requests: 2 HTTP requests in this frame

Frame: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
Frame ID: 65EB04C4A667D884B4C0E090FA6C7883
Requests: 6 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 8D8991B4FF30366DB407691FB4E27FC3
Requests: 2 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=33732700075051904444550012167025&actionid=981741&produktid=&dt_url=
Frame ID: DD9628CEF7F35B207B428ED25E328835
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463
Frame ID: A729C4F01B6C756DD53441BD38B86C4E
Requests: 2 HTTP requests in this frame

Frame: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
Frame ID: 7CCD056ADBCF8A0EDD25DC96583A5F80
Requests: 6 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 8065F5C1E7B951FA5CA982703F649079
Requests: 2 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68509000082440504444550012167001&actionid=981741&produktid=&dt_url=
Frame ID: 8C197A7351A270EAA8964F1335103EBE
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577
Frame ID: 0BA88A1154AD77ACAE557BFBE4282851
Requests: 2 HTTP requests in this frame

Frame: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
Frame ID: A66A3AA38D28CE19176561C4EE3BE708
Requests: 6 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: C1978498D606E07A5AD86AED646CFCB4
Requests: 2 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=64530200074707104444550012167011&actionid=981741&produktid=&dt_url=
Frame ID: 62A03A27E267ECBE46A223B4770E7D22
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954
Frame ID: 1B21635353429F2D3976FFD2D1C22C3F
Requests: 2 HTTP requests in this frame

Frame: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
Frame ID: 0FC1AA0C9E2B445977BB358F8FC17DB6
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The Spokesman-Review | Local News, Business, Entertainment, Sports & Weather for Eastern WashingtonArrow-rightCameraThe Spokesman-Review NewspaperThe Spokesman-Review NewspaperThe Spokesman-ReviewClose

Page URL History Show full URLs

https://comcast-accountupdates.com/ HTTP 307
https://spokesman.com/ HTTP 301
https://www.spokesman.com/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Polyfill (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/polyfill\.min\.js

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

269
Requests

92 %
HTTPS

46 %
IPv6

47
Domains

69
Subdomains

60
IPs

9
Countries

17417 kB
Transfer

23130 kB
Size

37
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=header
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/Home?SiteCode=SR
Title: My account

Search URL Search Domain Scan URL

URL: https://myaccount.spokesman.com/
Title: Log in

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?g2i_source=spokesman&g2i_medium=header&g2i_campaign=default
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/
Title: Subscribe now

Search URL Search Domain Scan URL

URL: https://spokesmanreview-wa.newsmemory.com/?editionStart=Spokane+Daily+Chronicle
Title: Chronicle

Search URL Search Domain Scan URL

URL: https://podcasts.google.com/feed/aHR0cHM6Ly93d3cuc3ByZWFrZXIuY29tL3Nob3cvMzA4MTU5NS9lcGlzb2Rlcy9mZWVk

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/the-morning-review/id1417560040?mt=2

Search URL Search Domain Scan URL

URL: https://open.spotify.com/show/4rCqkhhshDZQVXBs04qrGB?si=7LrC97F8RaaxO5-Dwc_2fQ&nd=1

Search URL Search Domain Scan URL

URL: https://triple9digital.com/

Search URL Search Domain Scan URL

URL: https://www.latahcreek.com/

Search URL Search Domain Scan URL

URL: https://www.gordonphysicaltherapy.com/

Search URL Search Domain Scan URL

URL: https://medicine.wsu.edu/

Search URL Search Domain Scan URL

URL: http://www.mcmanusplays.com/

Search URL Search Domain Scan URL

URL: https://www.snapwa.org/

Search URL Search Domain Scan URL

URL: https://www.spokanelibrary.org/

Search URL Search Domain Scan URL

URL: https://www.affinityforliving.com/

Search URL Search Domain Scan URL

URL: https://www.shannonhelm.com/

Search URL Search Domain Scan URL

URL: https://www.sylvanlearning.com/locations/center-finder?postalCode=99201

Search URL Search Domain Scan URL

URL: https://big-table.com/

Search URL Search Domain Scan URL

URL: https://umispokane.com/

Search URL Search Domain Scan URL

URL: https://www.huckleberrysnaturalmarket.com/

Search URL Search Domain Scan URL

URL: https://www.spokane7.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/spokesmanreview/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/SpokesmanReview
Title: Twitter

Search URL Search Domain Scan URL

URL: https://checkout.spokesman.com/?stateInfo=&source=external
Title: Print edition home delivery

Search URL Search Domain Scan URL

URL: https://www.legacy.com/obituaries/spokesman/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://pics.spokesman.com/
Title: Buy photo reprints

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://comcast-accountupdates.com/ HTTP 307
https://spokesman.com/ HTTP 301
https://www.spokesman.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1611 HTTP 301
https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js

Request Chain 149

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

Request Chain 150

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5H7sNtQpiPLe0qWjhIl1AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

Request Chain 151

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIrA_FrkFlNxKfX3eGcUafg&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1

Request Chain 152

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3Mjg0ODk0MDUwOTQ3NzQ0Ng%3D%3D

Request Chain 153

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

Request Chain 154

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5H7sNtQpiPLe0qWjhIl1AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

Request Chain 155

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIrA_FrkFlNxKfX3eGcUafg&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1

Request Chain 156

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMTU2OTg4MTQ5NzU5MzExMg%3D%3D

Request Chain 157

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1

Request Chain 159

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1

Request Chain 161

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1

Request Chain 163

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1

Request Chain 178

https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 179

https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 180

https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 181

https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 189

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=22540900075928304444550012167006&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22540900075928304444550012167006&actionid=981741&produktid=&dt_url=

Request Chain 191

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757

Request Chain 193

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22540900075928304444550012167006 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22540900075928304444550012167006 HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 196

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=33732700075051904444550012167025&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=33732700075051904444550012167025&actionid=981741&produktid=&dt_url=

Request Chain 198

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463

Request Chain 200

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=33732700075051904444550012167025 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=33732700075051904444550012167025 HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 203

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=68509000082440504444550012167001&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68509000082440504444550012167001&actionid=981741&produktid=&dt_url=

Request Chain 205

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577

Request Chain 207

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=68509000082440504444550012167001 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=68509000082440504444550012167001 HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 225

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=64530200074707104444550012167011&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=64530200074707104444550012167011&actionid=981741&produktid=&dt_url=

Request Chain 227

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954

Request Chain 229

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=64530200074707104444550012167011 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=64530200074707104444550012167011 HTTP 302
https://ad-server.eu/wm/pb/native.png

269 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.spokesman.com/
Redirect Chain

https://comcast-accountupdates.com/
https://spokesman.com/
https://www.spokesman.com/

235 KB
47 KB

56ms
11ms

Document
text/html

2600:9000:21f3:5200:0:b5fb:e6c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21f3:5200:0:b5fb:e6c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx/1.22.1 /

Resource Hash

0497e7fd8dd1dc131af40093ce8f0a954258b1354ac591c2fe2168cc194a33a6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 234
cache-control: max-age=300
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=utf-8
date: Thu, 08 Dec 2022 14:54:57 GMT
referrer-policy: same-origin
server: nginx/1.22.1
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,Cookie
via: 1.1 03d509e8374e9f42668961b5e0201348.cloudfront.net (CloudFront)
x-amz-cf-id: 6xw5rIJxv9ENv-Ve7NifcTr_qfgabRogoTGohXx1oEav1bFBvLonXw==
x-amz-cf-pop: FRA2-C2
x-amzn-trace-id: Root=1-6391fac1-3a9e4f06200cc38819609c7a
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-frame-options: DENY
x-robots-tag: noarchive

Redirect headers

age: 82
content-length: 0
date: Thu, 08 Dec 2022 14:57:31 GMT
location: https://www.spokesman.com/
server: AmazonS3
via: 1.1 547a50460a0cda7ae3dafb1c0b6d0e1a.cloudfront.net (CloudFront)
x-amz-cf-id: 9hwfH7Tv5M65h6BUcx0TloCDgLcNeUhlepN5JJWgnoAqIXPDXs3SWg==
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront

GET
H2 200 sr-loader.png
thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/ 11 KB
12 KB 49ms
11ms Image
image/webp 2600:9000:2057:ba00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/uO6q6eDqVn9RLDznlEJuDvMVKgE=/600x0/media.spokesman.com/graphics/2018/07/sr-loader.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:ba00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 04 Jun 2022 10:47:32 GMT
via: 1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
x-amz-cf-pop: FRA6-C1
age: 16171880
etag: "7b6592542ec6d8d4377eb143251c2f5b7d76aad9"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
content-length: 11662
x-amz-cf-id: 9CLXNfkFa5o5pRfTfumdQ9cCP67YAqLaWfJFaqYyaxyTyM9CUa01Cw==
expires: Tue, 30 May 2023 10:47:32 GMT

GET
H2 200 style.min.d9865cc8780e.css
static.spokesman.com/sv3/css/ 320 KB
47 KB 43ms
11ms Stylesheet
text/css 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/css/style.min.d9865cc8780e.css
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bc2c387a887f40dbb73e526b6213be9cedd527ec7b88d51b497070d97e231c6f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 27 Oct 2022 22:58:08 GMT
content-encoding: gzip
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
last-modified: Thu, 27 Oct 2022 22:55:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 3600045
etag: W/"d9865cc8780efd2ce06c12fb7ea277b9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000,public
x-amz-cf-id: 1A5rNg4os5_yQ2BWA30YtFGMwmiphKGsk0YPNC8H05fY8zubddNhIg==

GET
H2 200 jquery.min.12b69d0ae6c6.js Show response
static.spokesman.com/js/ 87 KB
31 KB 43ms
12ms Script
application/javascript 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/js/jquery.min.12b69d0ae6c6.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 19 Sep 2022 11:51:03 GMT
content-encoding: gzip
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
last-modified: Wed, 14 Sep 2022 00:47:07 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 6923270
etag: W/"12b69d0ae6c6f0c42942ae6da2896e84"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: AwiWINgJwjWW4jHk2PdpHvVFtbsY2CUW5nYejlDjPn1dRejuJc3tdA==

GET
H2 200 critical.min.7f719ef7842f.js Show response
static.spokesman.com/sv3/js/ 21 KB
7 KB 18ms
18ms Script
application/javascript 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/js/critical.min.7f719ef7842f.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5ba65148259568967389d182b434f97e0da7b6cd83abf926a602433a340ca9d0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 26 Oct 2022 08:21:38 GMT
content-encoding: gzip
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
last-modified: Mon, 24 Oct 2022 23:00:00 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 3739036
etag: W/"7f719ef7842f474e36e669c95955f7b0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: c4Lbul8jiL1apbh4el_Wh7HVuDSeG28VXqi2lOTUfpfWX2UyJFH4Dg==

GET
H2 200 flipptag.js Show response
cdn-gateflipp.flippback.com/tag/js/ 52 KB
18 KB 49ms
8ms Script
application/javascript 18.66.97.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gateflipp.flippback.com/tag/js/flipptag.js?site_id=1194406
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-129.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 836022001bc413eb8342a1faa30188ceaf2b047fbddbaf2a7b8b8ef7de18c5f0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:53:33 GMT
content-encoding: br
via: 1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront)
last-modified: Tue, 06 Dec 2022 21:40:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 320
etag: W/"c9c1460846edec3fe6fac8b848d0509a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=900
x-amz-cf-id: OrWLztetVYYOfREKpg83T-lAe1V_kjkaWv5C36vQcZbWN3J9LLlupg==

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
28 KB 96ms
35ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6126af5a92030a0c3f9880647dba6ac1aa41953a2f581282928f65df8415b8aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27584
x-xss-protection: 0
server: sffe
etag: "1415 / 919 of 1000 / last-modified: 1670501077"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 08 Dec 2022 14:58:53 GMT

GET
H2 200 base_ads.b6d5845dec51.js Show response
static.spokesman.com/ads/spokesman/ 10 KB
4 KB 11ms
11ms Script
application/javascript 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/ads/spokesman/base_ads.b6d5845dec51.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e93c85341a48fbccd80f6d316b0d45b3b951169f4390adfb5cf81609f4160d45

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Mon, 29 Aug 2022 02:13:03 GMT
content-encoding: gzip
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
last-modified: Thu, 25 Aug 2022 15:31:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 8772351
etag: W/"b6d5845dec51d4391b512b6bb304766d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: xahBI8IKzoYQxnGNVUUMWW46cMw_ImrWZOV1idAIZ0zsFtMMGyjKcw==

GET
H2 200 0-cloudy.c012b7747780.png
static.spokesman.com/sv3/img/weather/header-icons/ 10 KB
10 KB 11ms
10ms Image
image/png 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.spokesman.com/sv3/img/weather/header-icons/0-cloudy.c012b7747780.png
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 44d3c23c39b40c70cbd13bb24e0c8696aac11d9950562eb08911b726e7d5ac82

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 11 Nov 2022 00:42:49 GMT
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
last-modified: Tue, 08 Nov 2022 03:58:47 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 2384165
etag: "c012b7747780c1e51ecc733783952fa7"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000,public
accept-ranges: bytes
content-length: 10074
x-amz-cf-id: 3RUgLvzFohhyXl9bUlgNxBp3WSzV7SSxHciTRwEPJ2N-NBRMs8AwYQ==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 135 KB
50 KB 69ms
31ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3fbb19ea0d1bb2bf9b1574c539f9b140d76e57b14a3f6fec34eae9e444922a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51092
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 14:58:53 GMT

GET
DATA 200
OK truncated
/ 157 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4890a3c7a6d70985e71fb7178c58b8c3ff183e6edbb3f07a41affe5b897d3ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 63911f652aa8e.hires.jpg
media.spokesman.com/photos/2022/12/07/ 2 MB
2 MB 120ms
70ms Image
image/jpeg 2600:9000:2250:8600:18:730a:3f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.spokesman.com/photos/2022/12/07/63911f652aa8e.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:8600:18:730a:3f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 09eacc18cf8458811d1dd4c785c22ae8c9a677c8eef092de5aaf74ea1fb05910

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: wKne5t3zaJohcON5cuArHv7usIDxcxt0
date: Thu, 08 Dec 2022 14:30:29 GMT
via: 1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
last-modified: Thu, 08 Dec 2022 01:06:16 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 1705
etag: "f5efe9866cb5b3d8b7388d7ec54a3823"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 2361893
x-amz-cf-id: hJVY0kkbQCIAg6iuAGxUedaoRWfwrD30WBkx3oHGEPx4lRijbKlF_A==

GET
H2 200 638eb1643de5d.hires.jpg
media.spokesman.com/photos/2022/12/05/ 2 MB
2 MB 176ms
126ms Image
image/jpeg 2600:9000:2250:8600:18:730a:3f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.spokesman.com/photos/2022/12/05/638eb1643de5d.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:8600:18:730a:3f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6be85d90ed98c809aa47ac8fe2e2ec7d1844bd785a6de5a2429b6ef2b2116c75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: SSMMv_.Og9NodtJd3WjHBYof9PUR09kY
date: Thu, 08 Dec 2022 14:48:02 GMT
via: 1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
last-modified: Tue, 06 Dec 2022 04:40:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 652
etag: "814fb98985433a8ecb7bf99cd26aa6e0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 2106034
x-amz-cf-id: vRsD1K4j6isRR9jPz7MhjivEYgnYo0sRFRSIBKygdLasi0T-a7PQxw==

GET
H2 200 63879a1292c57.hires.jpg
media.spokesman.com/photos/2022/12/05/ 2 MB
2 MB 65ms
15ms Image
image/jpeg 2600:9000:2250:8600:18:730a:3f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.spokesman.com/photos/2022/12/05/63879a1292c57.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:8600:18:730a:3f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9e7def328adf929a00e7b4e4e2efff635850ee80110756f82924c75a4fc77393

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: BYIyo8UMuD.I2UJwet0.7GsdKZY5RcEq
date: Thu, 08 Dec 2022 14:48:02 GMT
via: 1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
last-modified: Mon, 05 Dec 2022 18:16:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 652
etag: "d11be288f0f8de924e806fbe9f3a00c4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 1805116
x-amz-cf-id: exRpgx_RApgN0Zj-HiPZuKxhh8nJ7TPuINtEb8wOgHqexCawvukh3w==

GET
H2 200 638d48b5f0a25.hires.jpg
media.spokesman.com/photos/2022/12/04/ 5 MB
5 MB 65ms
15ms Image
image/jpeg 2600:9000:2250:8600:18:730a:3f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.spokesman.com/photos/2022/12/04/638d48b5f0a25.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:8600:18:730a:3f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7645b6975525c1d68eaf5af383b3041880590b1690206376799151c659639674

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: 7iWoSY5oOyTMAy4sPIjTgbTWKiX.xhUO
date: Thu, 08 Dec 2022 14:58:53 GMT
via: 1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
last-modified: Mon, 05 Dec 2022 01:48:56 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 652
etag: "ef96579623596daac642d335ff1cf475"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 4727328
x-amz-cf-id: 4RuJWtPma48_RP_pS2dSI2ySLCYZv_eKGSQt-gzKsEv1qou5QE3Awg==

GET
H2 200 638e3e3d197d1.hires.jpg
media.spokesman.com/photos/2022/12/05/ 2 MB
2 MB 176ms
126ms Image
image/jpeg 2600:9000:2250:8600:18:730a:3f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.spokesman.com/photos/2022/12/05/638e3e3d197d1.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:8600:18:730a:3f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 60c7e6d31c1080b0da38c4a95915fc9e80f765f0ad2b7d3fd9874807a197b2e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: wTRC1R9AcKV1hKgajogvgJ2IzlAZ._eA
date: Thu, 08 Dec 2022 14:48:02 GMT
via: 1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
last-modified: Mon, 05 Dec 2022 18:57:53 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 652
etag: "10c32860330f61d4d4a9ce3762a9a7ed"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 1729604
x-amz-cf-id: hjojDy_W81spVErHuJemeebr706p1HNPsEPGdU_n4pEIG6700-vKDw==

GET
DATA 200
OK truncated
/ 172 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44c448205f15c4f82a4dfe267d5a2efac45224543d44a7c073b167813d449fce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 MercuryTextG3-Italic-Pro.edfe4723e09e.otf
static.spokesman.com/sv3/fonts/mercury/ 97 KB
97 KB 41ms
18ms Font
binary/octet-stream 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/fonts/mercury/MercuryTextG3-Italic-Pro.edfe4723e09e.otf
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sv3/css/style.min.d9865cc8780e.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6dfc02a8e6f295102871d721f23120a13077e491345a93614fcbb43867de3301

Request headers

Referer: https://static.spokesman.com/sv3/css/style.min.d9865cc8780e.css
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 01:01:21 GMT
via: 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 2037453
x-cache: Hit from cloudfront
content-length: 98936
last-modified: Mon, 14 Nov 2022 17:03:19 GMT
server: AmazonS3
etag: "edfe4723e09ee8d5e8b042a82c5a2ef2"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=31536000,public
access-control-allow-credentials: true
vary: Origin
accept-ranges: bytes
x-amz-cf-id: mSEXSS5j49MrgUAXXY14eOgLCdBCOvLlR143UNVtbwjWli9xnILUVg==

GET
H2 200 pubads_impl_2022120101.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
130 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0b59c362ae740c391e742fa4517d90b9461b416b9bec855d14c04603dbaf71c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 13:45:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4406
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133241
x-xss-protection: 0
last-modified: Thu, 01 Dec 2022 09:36:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 08 Dec 2023 13:45:27 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 95 B
93 B 84ms
49ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e15f20e9ef9afb2d807e387e719bf1e183ac72a1ff378d2b28f79cc33efd9ae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:53 GMT

GET
H2 200 noncritical.min.21be32a1957d.js Show response
static.spokesman.com/sv3/js/ 1 MB
376 KB 12ms
12ms Script
application/javascript 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/sv3/js/noncritical.min.21be32a1957d.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a2aee262821f014d61d9949b24dd6e194a702ae23c9e3661824e512e550ec09

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Tue, 18 Oct 2022 02:16:23 GMT
content-encoding: gzip
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
last-modified: Thu, 13 Oct 2022 20:22:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C2
age: 4452151
etag: W/"21be32a1957dfe9740992b69551e2dbc"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000,public
x-amz-cf-id: PxU-pbAuNeAM2GDRqR2b5Ypwc7IlV0g7r7rsnHMICNPWmpqKPQT_rg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 54ms
15ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 13:15:46 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 6187
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Thu, 08 Dec 2022 15:15:46 GMT

GET
H3

200

ml.br.js Show response
js.matheranalytics.com/static/ltm/ma20153/575681700/20/
Redirect Chain

https://js.matheranalytics.com/s/ma20153/575681700/ml.js?cb3=1611
https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js

148 KB
43 KB

45ms
14ms

Script
application/x-javascript

107.178.250.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H3
Server: 107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: a77ccf47a61b8eb1d83a4101826726c3b2b0e5b34eb9f2601785b4d1e513932c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 20:58:49 GMT
content-encoding: br
via: 1.1 google
last-modified: Fri, 05 Aug 2022 08:39:28 GMT
server: nginx
age: 64804
etag: "0033e6720ea8d009cad21d1cffea7a41"
vary: Accept-Encoding
x-cache: HIT Fri, 05 Aug 2022 08:49:46 GMT
content-type: application/x-javascript
cache-control: public,max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43903

Redirect headers

date: Thu, 08 Dec 2022 14:58:53 GMT
via: 1.1 google
server: nginx
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/ltm/ma20153/575681700/20/ml.br.js
cache-control: public, max-age=269200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by: 1-gc-euw1-10923

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 215 KB
75 KB 34ms
33ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0142ef55c5af25d3f3d64d82452dd49d65607fb2af864499dacbc13723f6cd25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 76806
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Dec 2022 14:58:53 GMT

GET
H2 200 63913b3cc3988.hires.jpg
thumb.spokesman.com/p0JCjD4M_aqK-N21Qr5jltI7kbU=/1170x658/smart/media.spokesman.com/photos/2022/12/07/ 64 KB
65 KB 16ms
13ms Image
image/webp 2600:9000:2057:ba00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/p0JCjD4M_aqK-N21Qr5jltI7kbU=/1170x658/smart/media.spokesman.com/photos/2022/12/07/63913b3cc3988.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:ba00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: 4fadae71f3c2f14c2cd88ec732d986d60eff7fd57262407a045444a31536e688

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:38:23 GMT
via: 1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
x-amz-cf-pop: FRA6-C1
age: 12030
etag: "4789f5a216fbc030e000d9a1d8fba8d1e156f17a"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
content-length: 65880
x-amz-cf-id: N_AKFA9aORUvdzaSX0tKMJm0jAoS5amVoBZgbMaLQu1GYdFJ7NpOBw==
expires: Sun, 03 Dec 2023 11:38:23 GMT

GET
H2 200 63911f42c7e2f.hires.jpg
thumb.spokesman.com/Bwlj7Ky61b-HtsbEP14y-QNGKaM=/530x298/smart/media.spokesman.com/photos/2022/12/07/ 23 KB
24 KB 16ms
14ms Image
image/webp 2600:9000:2057:ba00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/Bwlj7Ky61b-HtsbEP14y-QNGKaM=/530x298/smart/media.spokesman.com/photos/2022/12/07/63911f42c7e2f.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:ba00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: 8c1a344926bccb4d4e452226a49165959e6498a9bb0eedcd99597db6218feeeb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:03:54 GMT
via: 1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
x-amz-cf-pop: FRA6-C1
age: 10499
etag: "7906a947840e6b16ec19b44554f2f3e7fb67439d"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
content-length: 23692
x-amz-cf-id: LoeQaDqQFXt8UGvh-HPiRIkxF7iM3LZSF8xB3rqJay3VhtymXj9EGA==
expires: Sun, 03 Dec 2023 12:03:54 GMT

GET
H2 200 6391152e08046.hires.jpg
thumb.spokesman.com/Nq2yXIOM9rcAxd9_a-Y7iyck2eE=/530x298/smart/media.spokesman.com/photos/2022/12/07/ 26 KB
26 KB 17ms
15ms Image
image/webp 2600:9000:2057:ba00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/Nq2yXIOM9rcAxd9_a-Y7iyck2eE=/530x298/smart/media.spokesman.com/photos/2022/12/07/6391152e08046.hires.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:ba00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: 106d2473e20f19c11c7b0657f3c199fefff0e4a9607082794f2a595ec0828e53

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:18:05 GMT
via: 1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
x-amz-cf-pop: FRA6-C1
age: 13248
etag: "0c74740a4c26845790341d55f3a1105f4353e85c"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
content-length: 26736
x-amz-cf-id: ZRtzWZC92kt3gczmUVF2Jg08_t1JnjzOLLwbJUE3OZaapqIkdkzNJg==
expires: Sun, 03 Dec 2023 11:18:05 GMT

GET
H2 200 6391320ed0567.image.jpg
thumb.spokesman.com/1XR5I93INfVCZdDBodRbcHERyVY=/530x298/smart/media.spokesman.com/photos/2022/12/07/ 29 KB
29 KB 34ms
33ms Image
image/webp 2600:9000:2057:ba00:2:4597:5e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thumb.spokesman.com/1XR5I93INfVCZdDBodRbcHERyVY=/530x298/smart/media.spokesman.com/photos/2022/12/07/6391320ed0567.image.jpg
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:ba00:2:4597:5e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Thumbor/6.7.5 /
Resource Hash: 81094275f0be20d938a47ebde3ad55e55c156cfc9415413ab5ddcaf1adad9976

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:38:24 GMT
via: 1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
server: Thumbor/6.7.5
x-amz-cf-pop: FRA6-C1
age: 12029
etag: "fff3f2f4ae73835da1a204edd33d4c65e815b67c"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31104000,public
content-length: 29686
x-amz-cf-id: -FmumeeVEDNzEy8EijjxRs0cfdwxQ_rq5RIxquX9z0khFj9cZ51Vfw==
expires: Sun, 03 Dec 2023 11:38:24 GMT

GET
H2 200 loader.min.js Show response
loader-cdn.azureedge.net/prod/spokesman/ 43 KB
12 KB 94ms
8ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/sv3/js/noncritical.min.21be32a1957d.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CA5) /
Resource Hash: 81ca9adc11006f012270a2cc65f40126d00eb6489d0c6aed6c57497988ddde8f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: gzip
content-md5: 8sE5dEsj47Pu6bUYU92hTA==
age: 21132
x-cache: HIT
content-length: 12052
x-ms-lease-status: unlocked
last-modified: Wed, 30 Nov 2022 08:16:02 GMT
server: ECAcc (frc/4CA5)
etag: 0x8DAD2AB1E8BD269
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 18dc5582-a01e-0065-58e4-0a59fa000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 homepage.ba1889af7be1.json Show response
static.spokesman.com/ads/spokesman/ 5 KB
1 KB 11ms
11ms XHR
application/json 2600:9000:211e:8800:1e:dc88:cb00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.spokesman.com/ads/spokesman/homepage.ba1889af7be1.json
Requested by: Host: static.spokesman.com
URL: https://static.spokesman.com/ads/spokesman/base_ads.b6d5845dec51.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:8800:1e:dc88:cb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 79fc30a3a4b255c915bba01c0691a5653ec71151821aedb5147898821927e362

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 10:03:28 GMT
content-encoding: gzip
via: 1.1 aff6ac5c98fa897349204752e5877c80.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 104126
x-cache: Hit from cloudfront
last-modified: Wed, 07 Dec 2022 02:26:25 GMT
server: AmazonS3
etag: W/"ba1889af7be1a2a7e8f93d1af49b39ef"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: https://www.spokesman.com
cache-control: max-age=31536000,public
access-control-allow-credentials: true
vary: Accept-Encoding,Origin
x-amz-cf-id: TwkKd1Fk90YzqGbFUMeu_hrF8_2xTCeViGMg_ECjxCi9Z5zRib5mgA==

POST
H2 204 beacons
p.flipp.com/ 0
0 255ms
197ms Fetch 13.224.189.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.flipp.com/beacons
Requested by: Host: cdn-gateflipp.flippback.com
URL: https://cdn-gateflipp.flippback.com/tag/js/flipptag.js?site_id=1194406
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-14.fra2.r.cloudfront.net
Software: /
Resource Hash

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
vary: Origin
x-cache: Miss from cloudfront
access-control-allow-origin: https://www.spokesman.com
access-control-allow-credentials: true
x-amz-cf-id: bJhcYYuh1S3U1yB6OYRnL3zVK4_jz7rVzOLegOKx4sgBQKpg4iwy1w==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
349 B 48ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-G3BY0LGVDL&gtm=2oebu0&_p=1987337483&cid=458713268.1670511533&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sid=1670511533&sct=1&seg=0&dl=https%3A%2F%2Fwww.spokesman.com%2F&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_type=homepage
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G3BY0LGVDL&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:53 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 85ms
25ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 63ms
23ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.spokesman.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 299 KB
55 KB 2671ms
2670ms XHR
text/plain 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3401458178297251&correlator=3526786634562865&eid=31070945%2C31071147&output=ldjh&gdfp_req=1&vrg=2022120101&ptt=17&impl=fifs&iu_parts=1009641%2CSpokesmanDesktop_SuperLeaderBoard_HomePage_1280x100%2CSpokesmanDesktop_Homepage_Anchor_729x90%2CSpokesman_homepage_top_300x250%2CSpokesmanDesktop_Homepage_Dashboard_300x250%2CSpokesman_homepage_728x90%2CSpokesmanDesktop_homepage_1_728x90%2CSpokesmanDesktop_homepage_2_728x90%2CSpokesmanDesktop_homepage_3_728x90&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8&prev_iu_szs=1280x100%2C728x90%2C300x600%7C300x250%2C300x250%2C728x90%2C728x90%2C728x90%2C728x90&ifi=1&adks=2404035854%2C1337061979%2C3725654123%2C811898262%2C883754903%2C3635373852%2C2447737946%2C2531107668&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1670511533299&lmt=1670511533&dlt=1670511532938&idt=295&adxs=160%2C436%2C1220%2C1151%2C436%2C244%2C244%2C244&adys=223%2C1110%2C356%2C1813%2C7403%2C4613%2C5950%2C6628&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C2%7C3%7C4%7C5&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.spokesman.com%2F&frm=20&vis=1&psz=1600x101%7C1600x-1%7C300x0%7C300x0%7C1600x0%7C1088x0%7C1088x0%7C1088x0&msz=1600x101%7C1600x-1%7C300x0%7C300x0%7C1600x0%7C1088x0%7C1088x0%7C1088x0&fws=4%2C516%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&ga_vid=458713268.1670511533&ga_sid=1670511533&ga_hid=1987337483&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e15f46414b61320359c479eb44c53a8e7fe70449496f1ccb9c333110446384d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:55 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56724
x-xss-protection: 0
google-lineitem-id: 4994623904,6117983702,5776101826,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138346926686,138357754248,138415171218,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.spokesman.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame AF0F 6 KB
3 KB 135ms
24ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:53 GMT
expires: Fri, 08 Dec 2023 14:58:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
444 B 59ms
20ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-230256-14&cid=458713268.1670511533&jid=786539122&gjid=233209525&_gid=1940115392.1670511533&_u=YCDAiEABBAAAAEACI~&z=459875441

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 08 Dec 2022 14:58:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 46ms
16ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1987337483&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2F&ul=en-us&de=UTF-8&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAAAACI~&jid=786539122&gjid=233209525&cid=458713268.1670511533&tid=UA-230256-14&_gid=1940115392.1670511533&gtm=2wgbu05P9SH6&cd7=Homepage&cd9=homepage&z=1561246730

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 23:43:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54913
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 439ms
96ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&page=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&hier=Homepage&ptype=homepage&pubname=The%20Spokesman-Review&sec=Homepage&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=2257d2cd-9036-4a96-bd2c-807c9722ee7c&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511533360&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=1600x9629&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY3MDUxMTUzMTgxNCIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxMi43bWIiLCJoZWFwVCI6IjE1LjJtYiIsImZzdFBhaW50IjoiMTIyOSIsImZldGNoUyI6IjEwNjQiLCJkb21haW5TIjoiMTA2NSIsImRvbWFpbkUiOiIxMDg3IiwiY29ublMiOiIxMDg3IiwiY29ubkUiOiIxMTEwIiwic3NsUyI6IjEwOTUiLCJyZXF1UyI6IjExMTAiLCJyZXNwUyI6IjExMjEiLCJyZXNwRSI6IjExMjgiLCJkb21Mb2FkIjoiMTEyNCIsImRvbUludGVyIjoiMTI5NCIsImRvbUxvYWRTIjoiMTMzOCIsImRvbUxvYWRFIjoiMTMzOCJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjQ1ODcxMzI2OCIsInJlZlRpbWUiOiIxNjcwNTExNTMzMzYwIn1dfQ
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:53 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 77ms
40ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-230256-14&cid=458713268.1670511533&jid=786539122&_u=YCDAiEABBAAAAEACI~&z=209869876

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 76ms
38ms Image
image/gif 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-230256-14&cid=458713268.1670511533&jid=786539122&_u=YCDAiEABBAAAAEACI~&z=209869876

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 polyfill.min.js Show response
polyfill.io/v3/ 101 B
571 B 491ms
163ms Script
text/javascript 2a04:4e42:800::282
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2CString.prototype.endsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL

Requested by

Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:800::282 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 14:58:54 GMT
age: 1897258
detected-user-agent: Chrome/108.0.0
server-timing: HIT, fastly;desc="Edge time";dur=0, HIT, fastly;desc="Edge time";dur=1
content-length: 94
referrer-policy: origin-when-cross-origin
last-modified: Wed, 16 Nov 2022 04:33:12 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
content-type: text/javascript; charset=utf-8
normalized-user-agent: chrome/108.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 loader-config.json Show response
cdn.wgchrrammzv.com/prod/spokesman/ 4 KB
2 KB 48ms
8ms Fetch
application/json 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.wgchrrammzv.com/prod/spokesman/loader-config.json
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CAE) /
Resource Hash: 428b19348f218a44e36bd16a007cc9a5b16598f3575812a81a715a6c04ff1112

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
content-md5: lk8uT/FaJ5kjp9h7g1oAvw==
age: 21132
x-cache: HIT
content-length: 1280
x-ms-lease-status: unlocked
last-modified: Wed, 30 Nov 2022 08:20:57 GMT
server: ECAcc (frc/4CAE)
etag: 0x8DAD2ABCEAA5D7A
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 92cf7532-b01e-00b2-2ce4-0a08cf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 133ms
63ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022120101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70b6ebae8045d591c0eb83c422f733af18f29d583d470c2f92bb3d4a993bf5a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11201
x-xss-protection: 0

GET
H/1.1 200
OK atrk.js Show response
d31qbv1cthcecs.cloudfront.net/ 4 KB
2 KB 38ms
7ms Script
application/javascript 13.32.27.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-65.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Sep 2022 02:09:54 GMT
Content-Encoding: gzip
Via: 1.1 13140684c599ca32163cf7ec1871cebc.cloudfront.net (CloudFront)
Last-Modified: Tue, 27 Apr 2021 18:03:54 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-C2
Age: 7908541
ETag: W/"d89453438fbf10dcf4c13265c40d5160"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
X-Cache: Hit from cloudfront
Cache-Control: max-age=26920000
Connection: keep-alive
X-Amz-Cf-Id: mwMX9Eh6pAFx6go_2Bm012v17r3pixYa7LM_L9WYl_XBDtXp7ltszw==

GET
H2 200 aam.js Show response
aamcftag.aamsitecertifier.com/ 79 KB
27 KB 40ms
8ms Script
application/javascript 2600:9000:206f:8e00:14:c3e7:6780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aamcftag.aamsitecertifier.com/aam.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8e00:14:c3e7:6780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9ef65f1d4b3ddf07c3960a578d532f8aecd6b9d551631b2611596fb652480a9b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 03:33:18 GMT
content-encoding: gzip
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
last-modified: Thu, 17 Nov 2022 12:12:37 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 41290
etag: "866e5e2d2bbc029b03dd3a94440e09f2"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 27410
x-amz-cf-id: piTu0Ic0NR8VVtoRvFnpdweE6qiIUJG95_t7pYLlnGFao1g90-QtBw==
x-amz-meta-s3b-last-modified: 20221117T120833Z

GET
H2 200 load_tags.js Show response
pymx5.com/scripts/ 9 KB
9 KB 68ms
15ms Script
application/javascript 35.227.203.93
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pymx5.com/scripts/load_tags.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5P9SH6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.203.93 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 93.203.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:31:27 GMT
age: 1647
x-guploader-uploadid: ADPycdulf3d60Ux0QHdCOEedC_ryJ12VvlHrCdO5k1l4fd75_bCb58COcA0P01Jqsy1B4L-BPvcoJTJWNPtvX7wHcamKzQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8946
last-modified: Fri, 15 Jul 2022 06:19:11 GMT
server: UploadServer
etag: "f6b06694767e707999eecbe9538b403a"
x-goog-generation: 1657865951655064
x-goog-hash: crc32c=xz4nKQ==, md5=9rBmlHZ+cHmZ7svpU4tAOg==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=3600
x-goog-stored-content-length: 8946
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 tr
www.facebook.com/ 0
185 B 79ms
23ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=260139058256176&ev=PageView

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 08 Dec 2022 14:58:54 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
13ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1987337483&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2F&ul=en-us&de=UTF-8&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2F&el=10%25&_u=aCDAiEABBAAAAEACI~&jid=&gjid=&cid=458713268.1670511533&tid=UA-230256-14&_gid=1940115392.1670511533&gtm=2wgbu05P9SH6&cd7=Homepage&cd9=homepage&z=1798665418

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 23:43:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54914
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET atrk.gif
certify.alexametrics.com/ 0
0

GET
H2 204 x.png
redirect.prod.experiment.routing.cloudfront.aws.a2z.com/ 0
48 B 421ms
120ms Image
text/plain 3.134.45.248
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redirect.prod.experiment.routing.cloudfront.aws.a2z.com/x.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.134.45.248 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-134-45-248.us-east-2.compute.amazonaws.com
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
server: Server

GET
H2 200 init-1003q1exso0bwjopt7yf.js Show response
api.aamapiv2.com/api/ 472 B
876 B 336ms
287ms Script
text/javascript 2606:4700:e2::ac40:8a04
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.aamapiv2.com/api/init-1003q1exso0bwjopt7yf.js
Requested by: Host: aamcftag.aamsitecertifier.com
URL: https://aamcftag.aamsitecertifier.com/aam.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a04 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24e40e41c0e6fe3bd70a4250ff3295ee60f5f37aa51be1a27ac65ef6c520a091

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aDjTySxUrtlLqE7FgQ6rdCrzoY8zMtsvv%2F6Q0naxr1inYlgKcNfXz6npzY62pajltLuv%2F8DuQ1kT%2F81QsD9eUmzJ%2B1DUwffZFsoinaZLNzifLXUvCAnuc4nsA4rQsWxtiOi8TPw5gQuMYZqzYQLi"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 77665ca18b8cb395-MUC
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: 0

GET
H/1.1 200 i
aamcf.aamsitecertifier.com/ 43 B
461 B 1113ms
225ms Image
image/gif 44.239.110.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aamcf.aamsitecertifier.com/i?stm=1670511534292&e=pv&url=https%3A%2F%2Fwww.spokesman.com%2F&page=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&tv=js-2.9.2-SNAPSHOT&tna=cf&aid=210&p=web&tz=UTC&lang=en-US&cs=UTF-8&f_pdf=1&f_qt=0&f_realp=0&f_wma=0&f_dir=0&f_fla=0&f_java=0&f_gears=0&f_ag=0&f_inpriv=0&f_abd=0&res=1600x1200&cd=24&cookie=1&eid=bc65cd68-c9d3-44c4-8e3d-a85eb0b60422&dtm=1670511534291&vp=1600x1200&ds=1600x9629&vid=1&sid=17c5ae3a-7877-4335-a45a-91df477d7291&duid=f0f565ee-c31a-4c43-b934-196e6a932802&fp=2337573746&cx=eyJzY2hlbWEiOiJpZ2x1OmNvbS5zbm93cGxvd2FuYWx5dGljcy5zbm93cGxvdy9jb250ZXh0cy9qc29uc2NoZW1hLzEtMC0wIiwiZGF0YSI6W3sic2NoZW1hIjoiaWdsdTpjb20uZ29vZ2xlLmFuYWx5dGljcy9jb29raWVzL2pzb25zY2hlbWEvMS0wLTAiLCJkYXRhIjp7Il9nYSI6IkdBMS4yLjQ1ODcxMzI2OC4xNjcwNTExNTMzIn19XX0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.239.110.109 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-239-110-109.us-west-2.compute.amazonaws.com
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:54 GMT
Server: Apache/2.4.51 () OpenSSL/1.0.2k-fips
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 31ms
7ms Script
application/x-javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD6) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 1051
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/4CD6)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: b41f2c52-e01e-00b8-2613-0bb6de000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Thu, 08 Dec 2022 15:28:54 GMT

GET
H2 200 fp.min.js Show response
cdn.mircheigeshoa.com/prod/spokesman/ 65 KB
23 KB 116ms
8ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mircheigeshoa.com/prod/spokesman/fp.min.js?2022118
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CA7) /
Resource Hash: 633a42d7b9a7d6be4093abd56ea850f09a93ae5c252f6b9b8e405b0802dae6ed

Request headers

Referer
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
content-md5: 4y8k5QJ0SN1qBGV87ymFcA==
age: 21132
x-cache: HIT
content-length: 23424
x-ms-lease-status: unlocked
last-modified: Wed, 30 Nov 2022 08:13:46 GMT
server: ECAcc (frc/4CA7)
etag: 0x8DAD2AACDEFBC5D
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 73ab5adb-c01e-0073-78e4-0aaf2d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 g2i.min.js Show response
cdn.godiciardstia.com/prod/spokesman/ 219 KB
48 KB 99ms
9ms Script
application/x-javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.godiciardstia.com/prod/spokesman/g2i.min.js?2022118
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C8D) /
Resource Hash: 6c93730733907482175a577286c9085cbd3bb91de98bfbdf7e01d5aba2f90e57

Request headers

Referer
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
content-md5: JBg6+SpvyRKXwndI4mtR7A==
age: 21759
x-cache: HIT
content-length: 48979
x-ms-lease-status: unlocked
last-modified: Wed, 30 Nov 2022 08:15:30 GMT
server: ECAcc (frc/4C8D)
etag: 0x8DAD2AB0BACA2D4
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 64da1cda-201e-00a0-46e2-0a731f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.js Show response
cdn.pranmcpkx.com/prod/spokesman/ 865 KB
203 KB 92ms
8ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4C86) /
Resource Hash: 71180ea527bbbc698fefdd43b4cfab76568f1a8683eb5ffca1bb19bd874e0e5f

Request headers

Referer
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
content-md5: LJ0Ef1EnJXf6667+/j7UYg==
age: 13718
x-cache: HIT
content-length: 207842
x-ms-lease-status: unlocked
last-modified: Wed, 30 Nov 2022 08:10:29 GMT
server: ECAcc (frc/4C86)
etag: 0x8DAD2AA5816E926
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d43420cb-b01e-009d-29f5-0a0504000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 t8y9347t.min.css
cdn.pranmcpkx.com/prod/spokesman/ 386 KB
54 KB 136ms
53ms Stylesheet
text/css 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.css?2022118
Requested by: Host: loader-cdn.azureedge.net
URL: https://loader-cdn.azureedge.net/prod/spokesman/loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD1) /
Resource Hash: 6653d2cca03c490c0032cd74205c6c37a494ea31ac1c46aec8e55c7017c1b3f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
content-md5: MrVpkxJID7vFEqfm9gnQOQ==
age: 13718
x-cache: HIT
content-length: 54497
x-ms-lease-status: unlocked
last-modified: Wed, 30 Nov 2022 08:10:29 GMT
server: ECAcc (frc/4CD1)
etag: 0x8DAD2AA5812A403
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 0e053537-c01e-00a8-34f5-0a6910000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 load_optional_tags Show response
api.pymx5.com/v1/sites/ 0
749 B 173ms
118ms Script
text/html 34.96.74.203
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pymx5.com/v1/sites/load_optional_tags

Requested by

Host: pymx5.com
URL: https://pymx5.com/scripts/load_tags.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.74.203 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

203.74.96.34.bc.googleusercontent.com

Software

nginx/1.13.7 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
via: 1.1 google
server: nginx/1.13.7
allow: GET, HEAD, OPTIONS
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 77ms
25ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:54 GMT

GET
H2 200 self Show response
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 551 B
799 B 255ms
221ms XHR
application/json 172.67.75.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1670511534466
Requested by: Host: cdn.mircheigeshoa.com
URL: https://cdn.mircheigeshoa.com/prod/spokesman/fp.min.js?2022118
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.75.166 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b77e3040e4042c61767c86102e6f357df41b4ce53f74ebbc9dc242dad5cd873a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 08 Dec 2022 14:58:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OwNDMKJ%2FVuAi1h%2FTp256DdFQO5sbtSi50uBdTCAJWnAQLo1d%2F8KODw%2FaeLiXJpbF%2FY0qkhDIkuus%2FvU6Tv4oqpa%2BfMwXyKv63HuTJbweMnaQydNpQ57fLxd1%2FurXWJgHpcpV"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800
cf-ray: 77665ca29f219159-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A7F6 13 KB
5 KB 45ms
13ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 847
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:44:47 GMT
expires: Fri, 08 Dec 2023 14:44:47 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4716 783 B
534 B 53ms
23ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9dac1d36fc662c8e423e957e22ec91373848e205b95d1b848a9b8a665396932d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-khnmQpMVnOqgk8qtC6ivgg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-khnmQpMVnOqgk8qtC6ivgg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:54 GMT
expires: Thu, 08 Dec 2022 14:58:54 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 81_xgzAtA3K6BUSvxlviYRqiKRYqPH3jXMkg3rbk2fc.js Show response
pagead2.googlesyndication.com/bg/ Frame A7F6 36 KB
16 KB 43ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/81_xgzAtA3K6BUSvxlviYRqiKRYqPH3jXMkg3rbk2fc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f35ff183302d0372ba0544afc65be2611aa229162a3c7de35cc920deb6e4d9f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 10:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14829
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15897
x-xss-protection: 0
last-modified: Mon, 21 Nov 2022 11:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 10:51:45 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 4716 0
0 177ms
155ms Image
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022120101&jk=3401458178297251&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H3 200 pp.js Show response
api.aamapiv2.com/s/ 15 KB
6 KB 55ms
30ms Script
text/javascript 2606:4700:e2::ac40:8a04
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.aamapiv2.com/s/pp.js
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a04 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a9f3c83892833387d92f857563b6f3cfdee0277cbc648a932a2718e000e9e42

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 18 Oct 2022 14:09:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5703
etag: W/"634eb38a-3bc0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MwdTCH3rsc1kLdiGQpOSrv1t2AHyaUF%2FBeyTwEBFtoEXnKXBdU2gEJw02nx0gcCxrpM2KfXADgCgzJrzyIkaPq2ig1pyBcLiuYA6lnSiXuH5%2BW0CiZVeEFhlUXg44iK8ilnj6t3Imr%2Fx3zpa4gQh"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cf-ray: 77665ca36a8e906d-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame A7F6 0
10 B 13ms
12ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?a0dN2w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 157 KB
53 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WQTQTTW&l=MG2DL

Requested by

Host: cdn.godiciardstia.com
URL: https://cdn.godiciardstia.com/prod/spokesman/g2i.min.js?2022118

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d8dbbae580c58c196ffc607e708cdc72551544526793f0ef43deae8c75ac07b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53978
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 14:58:54 GMT

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 17ms
17ms Script
application/x-javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD6) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 1051
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/4CD6)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: b41f2c52-e01e-00b8-2613-0bb6de000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Thu, 08 Dec 2022 15:28:54 GMT

GET
H2 200 index.js Show response
cdn.czx5eyk0exbhwp43ya.biz/ 7 KB
3 KB 138ms
11ms Script
text/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.czx5eyk0exbhwp43ya.biz/index.js
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CBD) /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
content-encoding: gzip
content-md5: nynBpfvYghYqzIzsvfssRw==
age: 98049
x-cache: HIT
content-length: 2382
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jun 2022 17:08:13 GMT
server: ECAcc (frc/4CBD)
etag: 0x8DA5083F65AD9E0
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
x-ms-request-id: b7dd90ad-d01e-00b4-0731-0a3b70000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19

GET
H2 200 SR__SPOKESMAN.json Show response
cdn.pranmcpkx.com/prod/data/spokesman/ 2 MB
2 MB 364ms
364ms Fetch
application/octet-stream 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pranmcpkx.com/prod/data/spokesman/SR__SPOKESMAN.json?_=1670511534832
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 92e134fc5f7b95ecae60d856975d7c01b4fb512dba2d55d38cbbebcf549cdf96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: AppendBlob
date: Thu, 08 Dec 2022 14:58:54 GMT
last-modified: Wed, 07 Dec 2022 23:10:54 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count: 1
etag: 0x8DAD8A84A6ED1E3
content-type: application/octet-stream
access-control-allow-origin: *
x-ms-request-id: 0e8cc260-c01e-00a8-6715-0b6910000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control: no-cache
x-ms-version: 2009-09-19
content-length: 1573046

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 851ms
134ms Image
image/jpeg 52.216.20.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.20.40 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:56 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: YNB18SZW4SHF68SW
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: ui93gU7Uqqwi9x14UrqT7FudESMBlzsGzlDLgMnWSJF+rWaFjaZJatWvy4xx1Gffc58Sq6nRUe4=
x-amz-meta-s3b-last-modified: 20191015T134358Z

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 20ms
20ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1987337483&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2F&ul=en-us&de=UTF-8&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDACEABBAAAAGACI~&jid=1188020831&gjid=1865630696&cid=458713268.1670511533&tid=UA-230256-42&_gid=1940115392.1670511533&_r=1&gtm=2wgbu0WQTQTTW&cd1=1670511534875.4fgfy3el&cd2=Not%20Set&cd5=Not%20Set&cd6=Not%20Set&cd7=Not%20Set&cd8=Not%20Set&cd9=Not%20Set&cd3=Not%20Set&cd4=Not%20Set&cd10=Not%20Set&cd11=Not%20Set&cd12=Not%20Set&cd13=Not%20Set&cd14=Not%20Set&cd15=Not%20Set&cd16=homepage&cd17=Not%20Set&cd18=Default&z=115932683

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WQTQTTW&l=MG2DL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Dec 2022 13:15:46 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 6188
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Thu, 08 Dec 2022 15:15:46 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 14ms
13ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 23:43:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54914
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 x Show response
api.aamapiv2.com/api/ 0
447 B 405ms
385ms XHR
text/plain 2606:4700:e2::ac40:8a04
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.aamapiv2.com/api/x?86d9rbPaVFy744YN$dXJsJDAkaHR0cHM6Ly93d3cuc3Bva2VzbWFuLmNvbS8iLCJyZWZlcnJlciQwJCIsImFuY2VzdG9yT3JpZ2lucyQwJCIsInZpZGVvJDAkMTYwMHgxMjAweDI0IiwiZnJhbWUkMCQwIiwiaGlkZGVuJDAkMCIsInZpc2liaWxpdHlTdGF0ZSQwJHZpc2libGUiLCJoYXNGb2N1cyQwJDEiLCJ3aW5kb3ckMCQxNjAweDEyMDAiLCJwaXhlbHJhdGlvJDAkMSIsImlubmVyJDAkMTYwMHgxMjAwIiwib3V0ZXIkMCQxNjAweDEyMDAiLCJsb2NhbFN0b3JhZ2UkMCQxIiwic2Vzc2lvblN0b3JhZ2UkMCQxIiwiYXBwQ29kZU5hbWUkMCRNb3ppbGxhIiwiYXBwTmFtZSQwJE5ldHNjYXBlIiwiYXBwVmVyc2lvbiQwJDUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA4LjAuNTM1OS45OCBTYWZhcmkvNTM3LjM2IiwiY29va2llRW5hYmxlZCQxJHRydWUiLCJkZXZpY2VNZW1vcnkkMSQ4IiwiZG9Ob3RUcmFjayQxJCIsImhhcmR3YXJlQ29uY3VycmVuY3kkMSQ0IiwibGFuZ3VhZ2UkMSRlbi1VUyIsInBsYXRmb3JtJDEkV2luMzIiLCJwcm9kdWN0JDEkR2Vja28iLCJwcm9kdWN0U3ViJDEkMjAwMzAxMDciLCJ1c2VyQWdlbnQkMSRNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA4LjAuNTM1OS45OCBTYWZhcmkvNTM3LjM2IiwidmVuZG9yJDEkR29vZ2xlIEluYy4iLCJ2ZW5kb3JTdWIkMSQiLCJ3ZWJkcml2ZXIkMSRmYWxzZSIsIm5hdmlnYXRvci1oYXNoJDUkMjllNDE4NmQiLCJuYXZpZ2F0b3ItdGltZSQ1JDQiLCJzZW5kQmVhY29uJDUkMSIsImZvbnRyZW5kZXIkNSQxIiwidGltZSQ1JDE2NzA1MTE1MzQ2NjkiLCJ0aW1lem9uZSQ1JDAiLCJwbHVnaW5zLXRpbWUkNiQwLjEiLCJwbHVnaW5zJDYkYjZkMDU1NTgiLCJtZW0tdG90YWxKU0hlYXBTaXplJDYkMTUuMiIsIm1lbS11c2VkSlNIZWFwU2l6ZSQ2JDEyLjciLCJtZW0tanNIZWFwU2l6ZUxpbWl0JDYkMzc2MCIsInRpbWUtZmlyc3RQYWludCQ2JDEyMjkiLCJ0aW1lLWZldGNoU3RhcnQkNiQxMDY0IiwidGltZS1kb21haW5Mb29rdXBTdGFydCQ2JDEwNjUiLCJ0aW1lLWRvbWFpbkxvb2t1cEVuZCQ2JDEwODciLCJ0aW1lLWNvbm5lY3RTdGFydCQ2JDEwODciLCJ0aW1lLWNvbm5lY3RFbmQkNiQxMTEwIiwidGltZS1zZWN1cmVDb25uZWN0aW9uU3RhcnQkNiQxMDk1IiwidGltZS1yZXF1ZXN0U3RhcnQkNiQxMTEwIiwidGltZS1yZXNwb25zZVN0YXJ0JDYkMTEyMSIsInRpbWUtcmVzcG9uc2VFbmQkNiQxMTI4IiwidGltZS1kb21Mb2FkaW5nJDYkMTEyNCIsInRpbWUtZG9tSW50ZXJhY3RpdmUkNiQxMjk0IiwidGltZS1kb21Db250ZW50TG9hZGVkRXZlbnRTdGFydCQ2JDEzMzgiLCJ0aW1lLWRvbUNvbnRlbnRMb2FkZWRFdmVudEVuZCQ2JDEzMzgiLCJ0aW1lLWRvbUNvbXBsZXRlJDYkMjQwMiIsInRpbWUtbG9hZEV2ZW50U3RhcnQkNiQyNDAyIiwidGltZS1sb2FkRXZlbnRFbmQkNiQyNDAzIiwibmF2aWdhdGlvbi1yZWRpcmVjdENvdW50JDYkMCIsIm5hdmlnYXRpb24tdHlwZSQ2JG5hdmlnYXRlIiwiZ2xvYmFscy10aW1lJDE0JDAuMSIsImdsb2JhbHMkMTQkNzM1ZjEwYzgiLCJkb2N1bWVudC10aW1lJDIwJDAuMSIsImRvY3VtZW50JDIwJDQ3YzA3NDRkIiwiY29ubmVjdGlvbiQyMSQiLCJkb3dubGlua01heCQyMSQiLCJnZXRVc2VyTWVkaWEkMjEkMiIsInBhZ2UtZnJhbWUtY291bnQkMjEkMyIsInBhZ2UtZnJhbWUtbGlzdCQyMSQweDAjZWZlODcwNjFlZDcxZDg0ZmJjYzY5ZTU2ZmE4OTUzOWQuc2FmZWZyYW1lLmdvb2dsZXN5bmRpY2F0aW9uLmNvbSAweDAjdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbSAweDAjd3d3Lmdvb2dsZS5jb20iLCJwYWdlLWhhc2gtdGltZSQyNCQyLjciLCJwYWdlLWhhc2gkMjQkYzI3ZDllN2YiLCJmb250JDI3JDEwMDAwMDAiLCJzdHlsZS1oYXNoJDI4JDhjYjZiMmNjIiwic3R5bGUtdGltZSQyOCQwLjUiLCJhdWRpby1jb2RlYyQyOCQyMjIxMiIsInZpZGVvLWNvZGVjJDI4JDIyMjAwMCIsImNsb2NrJDMzJDU4MTYiLCJzb3J0JDQyJDguOCIsInN0YWNrJDQzJDEzOTU4Iiwic3RhY2stZXJyb3IkNDMkUmFuZ2VFcnJvcjogTWF4aW11bSBjYWxsIHN0YWNrIHNpemUgZXhjZWVkZWQiLCJzdGFjay10aW1lJDQzJDAuOSIsIndlYmdsJDcwJDEiLCJ3ZWJnbDIkNzAkMSIsIndlYmdsLXZlbmRvciQ3MCRJbnRlbCBJbmMuIiwid2ViZ2wtcmVuZGVyZXIkNzAkSW50ZWwgSXJpcyBPcGVuR0wgRW5naW5lIiwid2ViZ2wtZXh0ZW5zaW9ucyQ3MCQ0NDk1Mzk2NSIsIndlYmdsLXRpbWUkNzAkMjcuMSIsInBlcm1pc3Npb24tZ2VvbG9jYXRpb24kNzMkcHJvbXB0IiwiYmF0dGVyeSQ3MyQxIDEgMCBJbmZpbml0eSIsImF1ZGlvY29udGV4dCQ3NSRmN2U3MTJkOSIsImF1ZGlvY29udGV4dC10aW1lJDc1JDQ1LjUiLCJpbnRlcnNlY3Rpb24tc2l6ZSQ3OCQxNjAweDEyMDAiLCJpbnRlcnNlY3Rpb24kNzgkMTIiLCJwZXJtaXNzaW9uLW5vdGlmaWNhdGlvbnMkNzgkcHJvbXB0IiwicGVybWlzc2lvbi1jYW1lcmEkNzgkcHJvbXB0IiwicGVybWlzc2lvbi1taWNyb3Bob25lJDc4JHByb21wdCIsInBlcm1pc3Npb24tcGVyc2lzdGVudC1zdG9yYWdlJDc4JHByb21wdCIsImZyYW1lcmF0ZSQxMzAkNTAiLCJhZGJsb2NrJDEzMSQw
Requested by: Host: api.aamapiv2.com
URL: https://api.aamapiv2.com/s/pp.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8a04 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:55 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
access-control-allow-methods: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jLOxiAPiDxjawK5FlesWgv68PyPnGdy6NhwMKcfrOUXsqm4v0xm4EWbOUP15ALfnWqHqkWDN87cEAUJ%2Bv6trHAs73fbX8QW2M%2Bn3FlzdnD%2BM8i5lrZO3hB%2FBHkXqHBamqKuc8OiQIpamMbrC7fJ2"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 77665ca569606d7f-MUC
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
22 B 58ms
19ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-230256-42&cid=458713268.1670511533&jid=1188020831&gjid=1865630696&_gid=1940115392.1670511533&_u=aCDACEABBAAAAGACI~&z=208638795

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 08 Dec 2022 14:58:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.spokesman.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 206 track Show response
dc.services.visualstudio.com/v2/ 223 B
408 B 50ms
50ms XHR
application/json 13.69.106.211
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.211 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-type: application/json

Response headers

x-ms-session-id: 3F105B3D-B641-442E-9534-3B9303E8D062
strict-transport-security: max-age=31536000
date: Thu, 08 Dec 2022 14:58:55 GMT
x-content-type-options: nosniff
access-control-max-age: 3600
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length: 223

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 163ms
162ms Image
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022120101&jk=3401458178297251&bg=!ISKlImbNAAa7eOFIm3g7ACkAdvg8Wtn9fDOo1JexWgrCwMEWJMxk71dykc7br9sD_MWwrCrY4p-MtgIAAABDUgAAAAJoAQeZAqKD_rzg2Izh2qVDQ1iiF6tV1xm29_ACTzwrzurZKb9-19VzMqZDjEShHB3sMzIjSPvP96CA89yT0NT33MHIcT328vgq7UeI4gn9NEN1hwftyLafHNWW9g47qLzjtk__r03-4_sAZ9hbnqbkogq1jqeY6jNa-XBPU41pDFGiWYnzFkEVwe2kCMOD3-ycXePFua8m6DNYSDIsbnGFuK_HiN1NDFGdWKTMB5qkAtA3mACDOaL9kkp4fiPSJtFyh44UtqdHfEgF1YLDbsSHjE2ZdXN3X-P9LVNX6o-fI2taepasH_C_JulHrFEnAtmfd4Q-WV_F0xYhc3LWAXSGo8EppZlPLPf2HMrCnvp-wilATFx4Yi0U1TliN6oSX9qlq6mr6XCIDIsSsicL9LjxAxqeKqNv4ycArjtwSkHjpdky8xVSscgulg79T2Gq9chDYVoQUi3VsbXRUQp088ImpFLUuWEF5T69zNx6fllzWVjwiybPIJVT-tfPXd1l4EeuuqCZ_p2uMa7oxLuwm3HDKEsyO_UEKyIrONG0GS3BfRaFgfbVt4M_EoldL1qouXGLaNB6zMdDy3umAPb8AEV9HsnI9dteabpGcRqS4cetGbsjTWvPCQ7d_5g-JpqBlYY8pqqDHOljaoAlXRMDL8fEzqxQhVbk8ZXYYOa_VQ49sv0Y49QlxTeir9qaShmO2PvbvUXcdG0rWzkiPHG960TD71QFwP0Fw6BW8DZd3hds7_qxHTFrIKrQMxUq73DazX0lbRhIv7QW5FhZvciGABdGcUMOOAvzNHS8NwPon9T6ONWMkXwqO-eeekw4zB58rR0kg807Oa7eF2nAW-FsguAI6NLTZHgi68rVmYAGAlajjpQh-PbgOwVqq5LAj8r5f3df4x6d9gxW3Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

OPTIONS
H2 200 track
dc.services.visualstudio.com/v2/ Frame 0
0 505ms
17ms Preflight 13.69.106.211
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.69.106.211 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://www.spokesman.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
content-length: 0
date: Thu, 08 Dec 2022 14:58:55 GMT
x-content-type-options: nosniff

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B924 0
0 51ms
51ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLQ1nb4LgUGwoMIBzyH5evDbTWY7Q1MsM-BVYF6d5g9YeJJ0g8xldNgXzQGvKXpLUyvZ5UxM2D2EjJfsOLk8EOI2sumnYy-2MXPHI7Ztj7ua8La4QTSMAZiXhaub5Zx6eAh9vI61ycNJpxEMYUn2thMatL_UPX5V1bEoRTYUbdPXPyZQj5BIAx9bKN6WuHzlTLGRHr6gowyWXLRErHk2XYaN9c0IdOsa0lbvQEbI0_Q64GUD2BnAYQ6Z0T_J1-HdAsWNtGkhZwba0ZI_OYEHq7gZaArrKDmjL5V8x-7gVPFQ9LWrhU8wE6skSUOTcg0R7LRu_aRhCuUG71hgI20l0-sayuf-JCk9A6DmVOVdFXekiF_N0duHBR&sai=AMfl-YT0G5XrMqqOhbm8plZhPelM-N9iA0imx1ihWUQ9Kx-2X2pMSkaVMDEtSD3ZbwMUF43mGhaTA81hO7XQh9SxPI8yHRB4vYpJyYb91x5kXVJeOPXdsECZRPedqlZlOId0bDcBUdLVaIRRDiWsrS4Mxg&sig=Cg0ArKJSzD0JP5lTzi5KEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame B924 23 KB
9 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame B924 3 KB
1 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B924 153 KB
47 KB 78ms
24ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 10798137461613137031
tpc.googlesyndication.com/simgad/ Frame B924 44 KB
44 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10798137461613137031

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92aae892248a7997424fb418031fcb8eefa9cbe7bb00e9e96b6148450d7744b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:48:03 GMT
x-content-type-options: nosniff
age: 653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45279
x-xss-protection: 0
last-modified: Tue, 20 Apr 2021 16:47:38 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 08 Dec 2023 14:48:03 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A736 0
0 51ms
51ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv-pf1t5o1H3CqocLZtC9mE5LkBIMsxviK5xmV5whqoKw0BuO3fJM77q9h2mBVYMQkUmG6ilt_tb9IuCIVF_absSwWTgcvk3Otl9Y3WJA27pSPNLHU-ROBbaNU_09EeNjBvPhYnW9tije4WhV01keFiUBMY-ray1bwpUCXuEdE-34BGCzxwzKbRXXlBu5icBNe5pBLbCHQpsOXe1mfWexXhoq89pqh_inp9vspdwhwDQ09IYbgtnSsuX_44m7MTsoL91r7s_MxFe_GqrqQgfO1BPMbu2hbtKkArFiiiYHGGf18Eae9cf73LAFBZGwfOtFGyktFuvYJJ6RRM9qhOvQLGXJpci6rDp3K9aQiu&sai=AMfl-YTNgd5BFzD_TZJj3ML04GesQoYRSH7oQj6ZMyTsGAGUgnLwP2CgA9meCNlnWzGNJRgvfo8ztSbyjxqbYRA9aUSl0wzakDuQ1MQ0efp5GXK-4kGwfvz77waDuKnPuS0id7Ow_5zLaKfkqXGuKqDKlA&sig=Cg0ArKJSzHHHJBh_Vz2vEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame A736 23 KB
9 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame A736 3 KB
1 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A736 153 KB
47 KB 87ms
41ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 13020529618344307898
tpc.googlesyndication.com/simgad/ Frame A736 74 KB
74 KB 25ms
25ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13020529618344307898

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a1ec2afd03d9367f5f65faaa6aab1c544f8e3c7aad498b83c9a449f8c04a000c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 08:05:59 GMT
x-content-type-options: nosniff
age: 24777
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75378
x-xss-protection: 0
last-modified: Wed, 28 Jul 2021 19:13:16 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 08 Dec 2023 08:05:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5C58 0
0 53ms
53ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuzdQOH0V_JOBGYf0y9zHf-2vtp9vODVk1qO_D4lFXzwm8neE0gK_KnUfGQAR6Hvqkhz1ni2ogL-olXq9zIXIRDu5XW0BZ_BP8IQdD71G5TI0t8d4Rl3XBgHdKNAJccQir64z5eKVNCWnsm9pw6R6RuT0EX-C_Fe3xTKi8NBFk4T0P7u_sAl_huSXpnYZjozH-W86Qj9LkkCFfEkBb7T6Fhlrb7KVu5eti62x5xGby0WlGLu535VYwQvTUBbhe2mLjOj1iXHmNgX1BKjW41JlQgqvi7kic_8KDPAWDeexsbb1zbvUiZCh6llM_p1bkhpVxEDNFvZc1MpnDS4Qq44OqSJ-tY&sai=AMfl-YSiYUDiLFRUgypf0Exu6QV_JD3kT-dEyYQV84OEYgxcVUNL0cLOAhA2w-jfHzv6B7la8QKV0sqFhdl0xSsDkdSs0nN2EO1NpWdVM_3oL4BezI9irUVu_pXlkbb7wowSu_j2N_XoDWyqGY_C_ottJw&sig=Cg0ArKJSzJK9dxvFteCgEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame 5C58 23 KB
9 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 5C58 3 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5C58 153 KB
47 KB 79ms
42ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 9803209670202400671
tpc.googlesyndication.com/simgad/ Frame 5C58 281 KB
281 KB 21ms
21ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9803209670202400671

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14b1ccee1733f555c9ef4d552ec5c1062355e6249e7ec3158f7b3675b76c45f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 08:16:02 GMT
x-content-type-options: nosniff
age: 24174
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 287301
x-xss-protection: 0
last-modified: Fri, 02 Dec 2022 21:20:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 08 Dec 2023 08:16:02 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012211060024000/ Frame 2C46 221 KB
61 KB 80ms
13ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 09:52:43 GMT
age: 277573
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61592
x-xss-protection: 0
server: sffe
etag: "a2fca7132416d151"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 09:52:43 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 2C46 14 KB
5 KB 101ms
35ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 09:52:42 GMT
age: 277574
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5218
x-xss-protection: 0
server: sffe
etag: "abd4378f71571d78"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 09:52:42 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 2C46 94 KB
28 KB 102ms
36ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 09:52:43 GMT
age: 277573
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28809
x-xss-protection: 0
server: sffe
etag: "dd6615029de85e23"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 09:52:43 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 2C46 5 KB
2 KB 107ms
41ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 09:52:43 GMT
age: 277573
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
etag: "403438c4d550ee88"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 09:52:43 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012211060024000/v0/ Frame 2C46 40 KB
13 KB 107ms
42ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211060024000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 05 Dec 2022 09:52:42 GMT
age: 277574
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12946
x-xss-protection: 0
server: sffe
etag: "0bacd3f1ce38a7db"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Dec 2023 09:52:42 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 2C46 6 KB
1 KB 88ms
23ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0be1d222e2e367ac5106f4aee4830c3de18af1d266f8cde53915e11e8b01bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 14:55:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 container.html Show response
efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C3CF 6 KB
3 KB 47ms
18ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:53 GMT
expires: Fri, 08 Dec 2023 14:58:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame CDAB 6 KB
3 KB 43ms
20ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:53 GMT
expires: Fri, 08 Dec 2023 14:58:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0853 6 KB
3 KB 34ms
15ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:53 GMT
expires: Fri, 08 Dec 2023 14:58:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FB48 6 KB
3 KB 33ms
17ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022120101.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:53 GMT
expires: Fri, 08 Dec 2023 14:58:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2C46 2 KB
2 KB 16ms
15ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 09:39:53 GMT
x-content-type-options: nosniff
server: cafe
age: 19143
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Fri, 09 Dec 2022 09:39:53 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2C46 295 B
319 B 16ms
16ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 11:55:19 GMT
x-content-type-options: nosniff
server: cafe
age: 11017
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 09 Dec 2022 11:55:19 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2C46 0
0 59ms
58ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cij_OrfuRY-30GaCR7_UP9bi76AnZ2pSbXq6BmYHdC4Ptpv_2GhABIMOg_AFglcKmgrAHoAHY0d7ZA8gBCakCw9Vs_GamsT7gAgCoAwHIAwqqBMICT9DYhfIqFrRAaEnFYTWJAoM3E4wiucTQEvONYy3TSnRlOAksA7hfeGr57TaR1IGmJSzI5lpw6-wcFTNUWxn6zgHefY3XcVfqKmZZzbWBYD9VJ7TYxapxZVbTJ-A_4MGJBzgPyOIoPLRjR6dQNHNAuyZ8Z0IKyISDRSaFUWyG6tbCm188mZFfqzgsG8Gwu90C-vtlWt2KmEl9Hezv-VhpOoDzDrfplYuejwQuw9JW0PomRFzH1HCWPIKQHoCNxE8eNyLiJ72nCbIz667i29IPzQB0z8P45y801TGFEBvlorMeP6ZAulmGC73s1xdNuSxswQlRjJYbBFTQ384l0e6seGqySOHeMzTXEwPdjGeQ3X9l8UXvp9LZ2-jaDkcLjl0aaHJCUp0gTH3Cd-yTGKlJJPP3js1ySiU6TBq-gnIDxUD4wMAExL_wxKED4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB5CuoSaoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDG0xXSCBEIgOGAEBABGB0yAqoCOgKAQIAKAcgLAbgT5APYEw6IFAjQFQGAFwGyFx4KHAgAEhRwdWItOTc3OTY1MjEyMjAxNDcyOBi5igY&sigh=Edysgsoia8Q&uach_m=[UACH]&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&template_id=484
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 96ms
96ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNDk5NDYyMzkwNCIsImVidXkiOiIzODU2NTMwMTEiLCJlYWR2IjoiNDQzMDUzMjExIiwiZWNpZCI6IjEzODM0NjkyNjY4NiIsImVlbnYiOiJqIiwiZXBpZCI6Ii8xMDA5NjQxL1Nwb2tlc21hbkRlc2t0b3BfU3VwZXJMZWFkZXJCb2FyZF9Ib21lUGFnZV8xMjgweDEwMCIsImVzaWQiOm51bGwsInNpemUiOiIxMjgweDEwMCIsInJlbmRlcmVkIjoiMSJ9&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=a3b634f5-569f-4241-a038-c1948e995003&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536245&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:56 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 2076313506083323656
tpc.googlesyndication.com/simgad/9792639194664857595/ Frame 2C46 13 KB
13 KB 20ms
18ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9792639194664857595/2076313506083323656

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74689bad3b4f480bc6f076adb9927c63e872f5a1b9c675a92be9a13f9d3cf349

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 23:37:35 GMT
x-content-type-options: nosniff
age: 487281
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13576
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 10:45:27 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 02 Dec 2023 23:37:35 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/7318911655314552233/ Frame 2C46 2 KB
2 KB 23ms
22ms Image
image/jpeg 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7318911655314552233/downsize_200k_v1?w=100&h=100

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56fb89289ef2a4f7155b1ba99dbe7610be9d7b14c028c388a91d3f79fda97948

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.spokesman.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Sat, 03 Dec 2022 01:29:54 GMT
x-content-type-options: nosniff
age: 480542
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2162
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 10:28:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 03 Dec 2023 01:29:54 GMT

GET
DATA 200
OK truncated
/ Frame 2C46 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 2C46 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef251f34101684f464a829da3b73f211bd0e7aa009685d7a9e8baa8d4ee1de16

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B924 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50f940612dc804e5128485a7ffc8376a0f72c2eefd5b67652c983a984244c3a5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A736 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6b337e169cd1e85e4eec5a27ae0d3248af7229cdaa03459d174373eea2affa8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 5C58 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0446b3d21c708650eabdbf78880d18f828bd8b25fa401ad0af1af18357887c65

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3A31 624 B
307 B 98ms
55ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVjLm_GItDL2HQqbIWD9DYQwENw1gXQx-gkHCWG8uZT1pQF5S7VlWCGsx3IB2iFZKyOh9GD7RbclYa33SIUCDWnCCGwD1JFLeelOuhglnYPSkJw5k1oXfRg_4DNuRpViJFqB96wCtByksiK9U4BrqgOqjcM_lzlZS6lSzoARHzDo1O1GVE

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0853 15 KB
11 KB 109ms
67ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DQrE9tko_Vc5632q99StBgkAn5YCrxV0iIu7UlE-NfarYymSiWVE3G-kcu5CzA27xL8nugdMJ-7Md_Mm3e8vWbMGzstvGhScoKC0HTdT3DLKhsBt7omx5m9G0NUSFYHVxKDKOsbWkB2UpqoFwqTYOzZdwwYvJp8d2bNM_qAOcJHYKE1Gk&cry=1&dbm_d=AKAmf-CIdqHBDV-GKA8_X_6CsZRTAXF98sDiUMV-bA4MUp-cyXEhUFEmSNCBiiELc34xk_Cs3WCLk8mnYwsICPnIDPwvBm41ncVJHqOEmBcU8n3QDKFSceg2YMIoXFVX-pg8ss2vlQ4j4zMNyjZFjHMEMcjSXuNkCJg0dL_1YCXeNx7ptVbar-ImxZV6wpp4fmdSEV3A_r58fcNvMf-QAjqNNZCMIpu_BY7ALFML05soCAAa8OBtCNua2XSm2ZEkZS7lJ2uGiXTl0oAAVpOOjQmzL_OaNnO8GtWThAcmW9QcvwtF2xGdYusuxUn6x46bkSbRxoxAs9vUbVt7UQznONR6DLe9m4omB0gvfFkBry7Sjb3ljnKUsno4BdV19wjaAGt8YWWFgC8XGSAkN59A_KQbn_yBtVKd4gcNMUYMapnekcu3mLy9dMJsj6AsgMTF1G_jLreFUpyGOaMDurdjmXK7632s5d1aOl8JbV1KGfe3j77Ib0JKvtjtJqQG91h8OYC6L-BzQN1Zbkofx0RWzpd5e2efBELCjTmih16y0hN8eysdt0ijyLIwzHF7ZSEjYbhHc3mX8mOYpo9Qf1CkUVXNc6FnserarVH_sKh0L_V_Yf38udwoAvVGm_CsCj_t42_O3BDT42SkT9nrCQB5U3cF0MNh8n9UYsADe9YnBni_ZwUAw_ikjh57-stQeTUqp85mP2U4FGIbVk3g2v5oc1p5-QlBuBXB8MnjwOCwXze0G8C-wxI37MEUC9aP0W1L2C7gHfFZ-93ppxBafb9jYp4s4sUHbbNrRvRagaVbVD0qirKoRG3diKdfTeBdEwxIhymoFn_2rqykkBrWB7mp1HuOPxqpE7hS0dirV02fZ7h1di7z-VcRQfSih4fjK_EfAlJr0ApWiqn1D3JwiE6OGI3qLA2SIwFX6rc_Mu0ub-UAtxuAe7oihCEUCehCNERV-QkMyGfR8g-bGAUx28OoF_G8tVZPjyd_0Lz0uYIjC2Tep0c_Scms_AtCNS1YhuAuXtn-PqrhFPaQhe-hdQzaq0Zd0JYsPLuUvyU5FxIqJxPakcYD0SVKXreyh80C6aErajtXSzmzAT3aH7bhIazt2egTzdQWjUoqKANqOLGCtlKvfynyNN_tZrqOUmLPjOKkvAjclbZ2VMO_v9b-QWZe7Hlb_kbxyPCpqzj3iVhcNYj1HFkxmO4yahLKSURkgfxJn7jNjVLogsNZB-wLL4mNv90CHsqffuyDeuYiAWxNXDk6rMxrB8U9e3ZXkxU29cg9Yzn1ZQ9wKYcRi7JYX6egdGuanwof7TEfrWsxbbGIJ6tKpRbQkb4SEnUu8cpvc4yDGeMBloo8RfVgMTHjrS-FtTaCqHhBQZGPOvS6ZPCM05sqN57Tvc2mUCKTVo4D-E3OM0Sr7P0Hcatv1rd0eYfwQl8i1aoYHGQXb7jkxj3BLxLDEUrV1aOjArx0KftatQmB9U7PC8liWUBVLWWPtZ620fpAt1m35Ww7Zr2KRtd8_9kQ7ZYtZteEIAET5wASMZeLo5X6nrh7DVZKtLN_N1-bgWmaqntVR7NU2mc8en98-iEjNyWrlikP0t5XG_fchO1506FDzhwn4mmDu51WdX3Xye3vCz665q5Ks-7JXm01i-dZ9d4BoXO8TS7Otq0SncHUKErC7Jew4CFkZQouTRdniGM4sAM6dwaLW63itS2LPRZZ4-WpmXckt8y2Rp1kdhCHz3E7nFHRHe-uRIFxiicak8LMdswRaz-KF8VcocjUhJBymdUXnMF9kO7sva9cJL_RJD4Wy-e61vCQhUGYLszCfiGgmaXRO0G2s9ltjIfYGG2Y9_LtCog-1MO5Nsy8wwBKS9Ql5k0bdFprjRvCDiQBJmrqO22SlmYB0Po-Zdo1Pdp8ctKcAyHYUXLab9ZJgM8AVwZZo-81qOq0TfZJtaRe68_4Oca8QnQoQ1X7SefCaV6qarI1sKHa2d1QNW3LiA9GFqBLSU6gsmeyeT2BAitHTU4pW1v8SSJ0VX-5DoKTQPtXIXPPEX_J08X6pLPjGtBQC3wsC9mYOocKS1nNvAiOobkYrr3glYNsdczZfLt9CB3zURVrKyL6__cNWi2Qrkc7ECiuVlCzYoZO_S1NguUORXMs7PwyF8syTR2zoY7C6k3IySl8bnP2BaVIkusIZsn-lOy38cSsN1Uspu2sX5WmcsOVSX8fjx7GHG9E_Nw50v0eMjzHpr0uEBVXVvOOxCjLhnADvEXPLKO-NvdpILQVrA2MeTXDCeNoP0Zb61hfwnT054lIfDxHDbE8vgx0lZ4CALZlNQXY9l0WQxojhAysLvCsNP8B3xaw5ICcGbQuSM9b3Jotp8zAP7iNQQEM2-1Id4MvT8-RTuToFAnFZt4UIWpeuNbi0WBlEuvnqNoNBaKplNiR6gL_940_RRtoN80eqCKWmWTuhtBsT1eouhU4uv6T0pRvj5n9m4QSyek33LAzkMZKP5SrZW4Duq8_cCoHXcaIUMNKByfrpwM6WABjO3Y3DRwzFL9E2bZB0eIfHJ513-8GioODel3xiPeAYSvQboXwHPxxcM2rp8GH-ERYq-EV6R9g_MbF0C5BO2Cqpw-AfGw5cd3GrxTMO1J1KIWgKN2oOo3ymBGIQAoCf4dlXqlRKJS8dr2qVBSEDLmM2dTvzuJdGoNr0vhLgU-rfsP2UQQj96mOVOKehXdGazoTDrD6sV_x8oI7LfIYAfhyvOsNym6IxNXDpnWsF_kQdH9jkREhM-qizaAWfsrNi6KkD4lGEKXQWgMP2hJI_VMOIquUJ-LKR2jHWVAeqOeA-D6T3XGdUgRjiFih85mQQgBFjRZ0oI5jSAN-glA6SDqWrixhnrfzcPhgE116BJ6Fa5PMYPj5pdyIDi4wrgM5g0BwDS32yS_Y-nMuHTeNOBoJKimGPosauHOLia37G8ZRqkkRvcpXuy2kCADOd8DiJfW7r1DaRgyS48Z-OOQDkzytNb1SZmaISjsRSeaow0mSrtRsJ98o7KSLzU8WuBoqPhiHkNfaZwHSEk4vD59ywTpSpBw6YWBBkwtIuRZAzf7wTINAXJ3R_Do8nPd4V8yMaisjYBq-cF3EvN1YtwjyukZAYHb2LO6hNj1k-0DuODH8pBB8NfNx4lfZkVbNiaH3N-p3sCc7xrD0taxQZGOBuPnKG8cQyAPfSCdDjzdA-u26plHYAd1euq_fcZIYPn3V5yJIv-pnz9TtxHYZPJdB_5VbqhZC3ONOXDjRXEtsWjoynfKeUWkZVmkYIIbwP9WD5lC-_0kURIVquYGh7MwHsXJ-CPsx9cTedIc7v9bwKBkcGY31crij6pkLdNmkkUKaJ8HTmpkcr6gynSidcJ8rhb74V2sHiJranBKD0oPILAULloR-iLEmBzc_7om-_cADhtY2OUPoodW8lsMso06KGiOJlFOAm5koIDapFVG7siAVsl5anKxbK3TUp9SrPkA1oMM1kRSjd7zYwAboi7IKYD_86aEU1tlIjOgpGqbAQRqH8EGxpZ1eXuU1dAVVL8kGbUEc2YWSaEV14OueFQvu8Ilr9rcpUxBDzMj55cbKLD_HMis5au6g_fzLim-Q&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

30834c905f6c208cb431997f0f2ba7d2a931cce8ed852be18fc891bcf18533c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11385
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0853 42 B
63 B 158ms
156ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DDCXygxy9eSf5FAcx4KdIood3J9NXr6HCWEJjKUyuHpP79dQFlT6d55Wo58l4ElGA1aCph4XSZYF9qePOMFyLFZf3OcLUA-iIMrP01IvHeZEypWEc

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 0853 3 KB
1 KB 17ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame 0853 18 KB
7 KB 18ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0853 153 KB
47 KB 112ms
58ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame 0853 23 KB
9 KB 19ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F630 624 B
285 B 100ms
62ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXN97CXtb6oTY8hIm_ABa32l0_pEfMxi76_TXCaOV9HmfTjwLM4wYx2HDHO29E-it9iJHWZ81nJfnVoHEJ2ofAqc3JZo9qLHYlDBOK3QUJTnEQNdI95DCBhEynxdf_s2CL-QjU9Sxp63f685jFa2HeCTxThQhb-wSFdhW31SN8o_r2UKMU

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FB48 15 KB
12 KB 87ms
50ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Auyz7QHAQwePStvdbJ3BprgJe2iNeHxYrUnqdP-KbjyR29cLjHiEDFlAptpB9V5iWDVRgaqSLoqo_jJk3gudazjpcK28QXwYv56RNcV6KhGb3374g8MlOUbwusPDaDDQHwuMYOJOQULYfGiX-eO4tqp5Kd3hRf4HPREPFV6ipKIwxkB3g&cry=1&dbm_d=AKAmf-D43NB69w2qRBaG5hn-nM5vfto285iGOm2m5YVjBTWcI5Hb96qMeaO-YBT1rIccPwgYryonKjXOJMLAcfUT_Yeve2v0eG8lZ6zcTnqEsRcF_UOmiXGEmCLjBRz6_aIann14r0Bw3D5qyhM1f2xdcf8XT98s9qDEF0lVB9Dpe2tnDpFSlgcIUpSUmLHsg8LOyL-MFImeVX5ZbKOtoTpknSM8NpPDcumRqPZL6WA9T8wKXYIMlhcIYG3O3lKZJgI5UMAWouBJ1aSXK5KwuEIBHYhcpUGm_3PaUKmcNha_2SgPk8HiIBMDHyZd1RqHsL-THoO6FHoN4p0IsyCXnLJYUuP5CAFNHh7LotekR_N93rNHwXGgW_earWkDxw51Q59F6o8uFm7STOxbs97LxxwWGIu-udFXHu3OMRR5p-Vli4Sa5P1Dqt1xvT9jc6iPJEkCrfxfrQ3KTluiUJ2zxprZVTNd3W84ciMqUMNBmUUB_d4NzPIGpRPvjjV5ppV16vJog3r5rJnB_ZZ03S-T2bIZ7RGWmoTp7gYppNwe9pdWg6MJn4QTZQ_WgNffq3yhUcjqkmix7Evo2VRs5FkBYSCXjsp7VZvGF4uMw5zNR-37ljoNe5MkftnxPnBcpgI8pG5fE-cFEHpWm4vB9ZfRfzjd5J3MZMVPH3E02H8AKgSCaXgE2DmFgblRUL9WbR4hUVAMu90uYJ_GAB-XOysEn2wz-HRTHIB98qEVJJ1li-Z1UClsPPCTwp7irJ_xJv1JLmTYmBtSIikaV2g9k0bq1SRf8nRId1f-9YcszkzN6BdN5kavoCTRqf4-h3i07ioce6ro3-VJ-igb-9VzLJOVE2abR9rhZ19zxPdSUd0KRj_sMrF_rfMgH27Vz2-VflgiqJtsqEeZWOM9RhL2Pbl6RQQ0IeIu-tBCuJNzmkLKAYBgV0GBKwXo-XfhAI2sD554b_DtDgdkQ81Dl1FUsMu-R2vZts3RxOImG3Q3S0_gtY_YKrseqX5SBj79p5NUlrwfHw1n_EjV-ugRR_4g3TFxuzQXcJpN7f6LwZIlxSligxB5d8WLZyEiOm88s1Gq3Meuv8OqJnFItnw1u9fnySNZAfTtTuInYCJLk2lvWRIr1dghdJS6Qr1xnRw_Nbe4SE1AG3SO6ZdA0vc7IaRN5kFPrcvuGmiJyi03KyCkNuXb5QuaPsTCA8eJwcuGua1ufdHvyIa43DeeeFm4bd4EK7K-5fLt-Y9UR3zhJ-9rSf6NnfSZxNeC8Kk5-nNt-IxB7etcPf51l8bDGZ3t3ROv7TpNi-Q1WRsjtmrfydM3Sep5TTXcwclm2Tk4ra0auqjVz7JRQ3gVzDRfxiaCNgzEL50Nysvq3jhalnDysGjQv9sj1RROhMOGmgCODUXlD5tNlxqVfCwTpZeh7DOrNMVIrs8mu2ZTvtOnYUaOXjs5vKEGo9j3jSI8lFd5qh6oM7ynfnybPi_IN90bGa04m6oT6SR7fwz8scqn2D_7EexThGVKCGxGwmlQLQ8vB1eYFWohWAfwPVNkhsk6VIGkgqt8Z6dkeS3rAsox1KjHjwzd9HCUFFVOs7KAFDLIUZ1rsZRJBN3RoStR8glQFzI5IGMs6tCp8IhRSmc6GxAYEQEW82M61Znw1dhJ3hRGs76NlIVpd72nnEjrInVDGApTMP4y85FuUYr1ozFeSezxkFHd5EmdD1Eh4WKBe94UelQWYaqoq8wiPc20dJjYGqJu7yxp4VA3O0G-nzw2zTyMhzntKwH0dewb6V9Za5RYs6e55Lv-ak9FRPpfsbGFxcqLCW7Vxc_ny8IF_1rcUiDz_8VY_NFw5sJ0pZShYaU53cC-ZPZnYhdCKRjpqxQGpuufjOu-Tusbu04-fIU7nO5816ko0OXMv102zWY4_lktgo1Ogv5qlBlIZVmf0XBqks-lZFsq9YyIM_Dphp85BiW0rTonyaBgu1cJpRZCW1clwXRke3DyOUT7TZMZQx5_68ZdGzXYTthxyYJGr14YC3Fvp3UDsxXuH5T8OljtpA4_snO0TTVXYaj7qvZFgz9KuqjFQUoSR3lUUel13ElIEwEegkCYOnLtLXG7hTUqx3Pfz2HI8osVWbbMGGuWxuDkxycqSlpm3YAyZRA1JzaIgSCPbvChQrZAhrmDcHMjdnVotQ02Fr-vEzimt6kBY3xodAvm1lKN1ZV3G8duO6rO2CDe65z0gm0n5CYn6tcITD8bJoZKWphdSuqabG_fufw2rWK5pifj3oUvjZqv_atYa-MS81CaUAURFFb5ggMj4-3XuuvgnpvjyzuhUsdiU1lrGyFqc7kluzGIQ-Ucr0EBa_hxPP5C2bTkoTyfw12lTO2nB8AhUCGTYMfeTwA8PFaN2Tkz63TuM_zC7w4cdBqksecyCuQNm2OYAncSTYrH5N5ZyelsfbKkqLB-Z6PcMM6Mmy_tYbzzZeolzOHtlvKexFBbQf9tVcDUsR6HCe_oA55gPisGIIn9uOVwf-tcBLExn1UazS-0P4qQxmj7OX1yJs11JzopVV-ndg5M0y6tiCik3b5heymAmDHUi5PPEi9PGTyrxEW0JE6elYAukz77osjoP7qtr-y0hv-C56Hfn7lCtLc61uSNJC5rPM6JJdkTyTV9cg6DFDzO4L2qr3uHirysKnmddXJ49n5j6I-5d1hGF2LSGSTbqGtBytOAXZbv5rch_qW93sAV6g1z_8G22Q8PIMizyKyBAqu2HAamzz7FhvZ4tSF1s4G5h4uCZ7boDKxU5zHOlP3dIkS23itecw8wRly0BY2Dad1UlwQCDFWm2iEOM9zYRDCN-3-LRFGnCeEXio-IbNY4IAztc4aHzwsW2YOxT2BU83InXYLW-_tcaEKXkbgvWJ4CMJ3guc3NisGHnztD0FngTZzvj77vIxkXFimOSqAILONtQzIOxdgAG_2Hv5PvUBHDl2oV0ZzOb471OdPwwPwBMrZd-51BwviUMw5UXloBQFUXIojHrsXXaKzJhzz9dXGdsnWyWRd24dtLDlMWlmzmp7tfn3EupVovYmG_1gp5zBIVhGHEZo2iMlf5QV1lrSKjEYcWLgro8tTySTM4C7dARXcgX4YPbH52yxsNYHx8_WUmF1d4qCu9r_SLIupg_r4W0z0obYTeMKj0AKR9JKohfI5GI0G2-Ock8mQlxBpG3NcyzlYjHVzoVIJziGBT935nXIfRPH3IJeQ8nLkQ6R8vQLe6w6dg2LeW-iAZYIDNzIfDQPvmILynZ2iGWywMW-sAawQts9bcvpkXhHrv35CZBXd_0Cee8W2uNKCrx-gbnSTbGrKMPSj5_hswCNFbgcCDX7Kt5CxczVD3hLLgnl2zefbbHPYQYFfzVvGajsM7PVR9_eMOIosBU0uwmBfuWLc97bnvDV6GZuqNA2E3bzkga1Ff__YbL-2h8FWEt7HR4bcjSW6dxv55kix3zuGlIxZDeasU8h8WThb0E2yhh2PgDq03pIRQB69FtXFUjHkJPq-QTzJkh8hxjgnf4F_pIxMZ_3_pRWzud27zs0p-srYjoFgxjZ83BGRb3BVB9tl-Ld41PHvXbOzog2B-qD8FT5-p_htpvtrpW1Rf&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb0029d2c2174b61e565a3d3882cd758e09254301bd9291c82c46cb23d928195

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11525
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB48 42 B
63 B 158ms
156ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DQ01lyDBVMsd57Rw3JeOT_2Bp0PsQ_hdEuQ1a5kaa2aBAZ3yv2BTdn5KhYUEWnaGFSHFZr5saZ8BSjBjRGwseo-mYliSLy-0fgjrKgXg2Vd3NPOzk

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame FB48 3 KB
1 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame FB48 18 KB
7 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FB48 153 KB
47 KB 101ms
53ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame FB48 23 KB
9 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 022A 640 B
308 B 93ms
64ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX1Y2tkmiD9GkwSovXRWho4Y7OEVK1SCLz7RKZxxHZJ4nNpa5XZRQAg0f2J-cFnpTGeOdSnssbvMfPVqryjIY2MXGFk3ZS9630sxbU_HX4HX-uT9hQLrhP5cIi3sOgEMmUyr7WfAdKWmoGCckwDQakc9XT5wKy7EaswiD9lTPCQ2HAVIdY

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C3CF 15 KB
11 KB 81ms
52ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AwuAeLl0m6L9W30laBN33fT8wYHiJ5YAQj_AvHHBI42g3DUvwVZkmfJQvoBH0hTomiPxb-5QqbIK10cnhOTghpShNbr3yKef6Kp0yKfvd2MutzOqJIBF0WswRkZx41ySvs79lLjLBu6vVFcx-oUinl4by5ZhmYW-VAy194Ru5CJPAvLkQ&cry=1&dbm_d=AKAmf-CI6hFlbSpN-BeWF42R9kH-sWuFlwSEZbhb0FjKn16MtYh3-U-Y0lFsnbLX9FuBGNgHhkfk9N_Mvadb-d5UV7f5RKrrZXyr1FdxEoxHKyIYARwj56AXE-xXBP_ZFKY3dhYZ75u6XcTR14lRQSSGrH3X67UNCthsVrZ2EYrceuRvOsdCQZGLAkAVERTmavrcbhidM7doFGt1kL-wfH-UvPXYNp4OHZ8w9kM1AVJXdEIvwHulF2USDPVSRJsXFGa7i45eYXq9jQKOZO5gYhykSxNhpv4wE1QGlNvHJaTNoiR-toUS1OXinEW65fu13vpSgzcsaYc0hSCKazjneHk94voPht9U6X3eiQ5BxlHO3r-rY-XL_xAyNzqmIA-aZjLYi0U3cm609uA0mDE7hMyJuoyDnsh9pat0GCS_J8f410U03ajYl2h9ZlxKEZAnnB4Et9SrrX0_ZgvFbdI0BmjvVCadXXw66Tos3LSJtVEqBRH_T-qg_aM_nW59kTo9dfA4qzBNWQplySwUAbI10YfneBntzRc2PD3GdHznV623opIHTVNZZM_UuF5VKZY3wYX6in3t2590_UdRY6_qzFyPs1-oHlxiHV_ioTTxFuNZsyuF2tg4RKisbLQuUx7SoHf9EFjLUwfOtWyGdIr7l-7lBtz3yoSe46tmikJ89BqSP_1cSWcyZXwV8j1G6Cgtfgo-EUbc8K1LoUZ7dOa7BoUyhdklA25t9ZRe5WWYSaaVP0omlto4gn835RbOBWJVtj0HU3tUB8t0qvXE8YuT6IPGan44oZh8tZtSVgd4rwoxqlLC2baOgQjjZqqmjihNj9gWMUUexSNFGmd6Uao9rgIjoX_Mmx8QviIY5O62B9OS22ZUTmXum4eN-64FYi0h5HeBXJ_kPZSUBa5ueJT4Ke1JG5AUswMQhYprytiFHRL_6uUwSt5o-Rv8EshtHG3jGLTT_bxLdpwasCJAjb-ZohLZktTbNeS9m313CowbjewXaFQbD3KBKoRGPq0NSR4OcORNmUC8_GSCYVgcODgcS8rrRzxB1auKfPbTzQ-FGxfazvNDZ5v1v9f5B0fwD2bWAAFn3UCix4kP2gX0AqB_MwJi7vnuFxXr4FSp0sN_XBF3HxAE5uPX_8Ob-9csuXCV6kpHQBuPUdqqb0pekaG5M8DW5R1I8iTcIkd9yDZ45p-tui1JeZgikUpkxfodrORyPwC9NDBXVDVvpGsdqVJ7ICPQM1fovTg32NEC-88x8UqxqmE-id8KsA-dgvDo24iHH2RpVqiwnZvPYWY67YlPNbMY_Y8wMH06SkUmRF2Qpd60m2u3GKXBGhqXE9FVDDsS8k90Lh-BGubLVamSdE9umWWgPYWtdI7DQnp7Sn7e8gxd9Ks4wm4OJveU8hqdnh5uYH3mU_DiHQ0uZIkn8RlmUpLsslS1gEGQ_PV9MncmEKlLha5LGoE43I-7jaqTQtPHbS6hi8BN5rYUehmIFpYUXnmJRY6MDn4XynxApEzyb4sPvZmTTZwwhmIk8stqJMltT2ITMdZ1g26v6kE7nYshH8328mcRpAqiXYcOrQ9USFHyD44mU7Gof29u9Tr_u2m0JPZF90KEsI-GxU84fvgJNsataUuBPuQ4Cd58qncrrnKKEzYMeaYXisfMv5Y2VqK04uBdFbBDDlA-dx9Z9L6KTDXvFNUeJFclOubf1zfmlazonvGGvL1H4k38LJxq-6LG8sZMk2GU2HPbfWdiy7OKf1hPY_zsrNUwkNwHwTposmR4fLJnCA2Q0NebUTMaqZ8uY4M86mbKbTj68qUT2H8PTOMiOiCoVUnDsMhRvnkvn_nbbA81UXQu37jx6pi3KIfFwJjLN_VFVp0Vr7i3RDpvNzkLLbbD-TbmskVgNaPPCVRL4shdrnxDdnZc7xl3MXjksO7WXdGX0ex-XC8jF0oHvVV-tTqgwePZqqOx6YUdFMdskIwbpWgWSG6VpY9pKwMJtIuU9T1SCLTQ2bhuIiVyMkr-vQZ8h3hFWrTkuozQ3lyMlRjTzD9_-yMTmSHtWxYitNXAKqvu-RuuR47XT5GcCbz7FTDZuLKDXz8Xs7p2r9a2q1rgnMc7s8ib8UkHaP0sZ1Uaaq4DKCHSc66MI3g7eEUTm0kKnKhIIZua7TbJ0xfrb9rlGTE05dhNbW1QZAQ2q819f5K2orj9x4OPy8rDiZq87PPCamdItCgzkq-2Nv7nZrxeWWGJ6MCvs5Yc-mW3hPB7zS842y5UIYqxOxO3dypgQa0cXHdXBPesWScSmejE-C9MVQrka_aH97fUt5_ND2IGm4D5TtKu5Ino651scMJsn3Z2z-RIipVOc1QHBTe-AX2xksizBTABNFHXmH-OihwfTLd48UejoyyMhJdEg-1w22_MTot16nSD8Q8beZAsGBpZg6gZ_bOxkcCw62pI4dBKN-_OQJq2jRJXScgT0_NaMP0iS7qSYTNDRp3a5e8V1bIHMlfl5axuw0aGlDfvookrExMGffpC4k6eFQ8DdACc3IVDkqXMOHxwRxATwRrIPnwAm46-68WZmWrIr247KRBpwlVjmgB5osrnzhdo4JSwzkd5cLqgEh7s2G4NTt3LZydOMalOmSZguozCiSPaJXmt_-d3XMq1v_snp5TwJXyKhw4JXJs27ipSk7q72luD_WDlOC3Rhetl4hFvVjX6-2V4g0loL4xPKKJGALzYrU-pHI8K8WHYChShxjUEwJfVgbsmcojA4jAnPnZQY11SGFF0OnT-48VrpLScrk_OdRFLkyKNPkFDzmtEbN4NwgIKn98ewgMw7Hrgh9RFyVR4d6uaS9PE2yF8bBe1PGeyT__5Gvsyq1bwIpdjRQrRxjHYn7bViEV9HnyQJEjraXFohuntnHU4ovWCLo_qVxyM5tX0UTzq58fdxDCDcdQvzh0XHsN2T2NYYmrj6TPGnERJ7v0TL1u-c_qv0VXel4zAueFeGTLiJ2myIAv-wdJGO_MlSP5ty_R2DzFaqcURmSCdWQ12IJTLm_-ZMyZbjTXOnC6Zy-zMfZXrSRu1dpMVirDU4OODNEiuNQaTfoOlEhrVGosIGYdSYWRKtvzDiZ82MPfkh-T1CSSqjFJluZYuitgxvhNoqNn52rDWr4H4AScWrlY3aAtCyiNMRNFQ6AVvcL3bXdUCk0hQEPq-j8aRVufny7BBSjnOIwgDCI4m2D1mSZPfhhQJYcRmVDuAveh84Zx-_s8O74INCdkf2WKruM2SQvg6nIfWb1NO1D7VB5rLLpurIKF77MBNARDy40UvDubtCqh8SYMk27eqC7vFybFQjTvF1CFebUGymz6YSBYJU9vyKUULFG3xrAbsM-91MvFG7Cmg5b-fvdk2t9YflZegd3rfQz7uaHj2NokmBncBJrhZTRd0GEcJhUlhiZ7kLps7SO5KGjPE-0oZ3Gr0bxllI2hByGe9PCvD77aAZL0OlUNx4E7pXvgoVMSoerMF5faOBBe7alIYEjSvh6DQ92wZ62PZM8ZAxU_hl9k9NSKTHfqjYb6yhd6TkXvkHTA2rn45ILuceJqH0ejJIdYJPQqd76MKIi_2pUsFHV8FWbQYqyIZYD-jfAvU&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

559ec07592f3e0a895f5c551f2a7dd4a3f3f186c2f55a9e18018aea530715f0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11456
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3CF 42 B
63 B 157ms
156ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B4A0tiWLTlrDtfoCcU1vdUxkTqUF4Uj2g47pl6vD8jlMkJQvRqGVvGFL0pYZJZhGM3y0OPi0VQPFodTRFcBJ2LmwnItbSDFEDOnf740z1u1e4oGAE

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame C3CF 3 KB
1 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame C3CF 18 KB
7 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C3CF 153 KB
47 KB 69ms
28ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame C3CF 23 KB
9 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B924 0
0 51ms
51ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQfmRq7PzE2hIDBW1BVRnCJ-E1HfxZkOtwX9wMtDvx7o9IDZH5q2E3V0jXTLBwKcdVCff2LhmkNkNuAojS7lrZk5fk-MhsaryJ-Vd2p2qe9dh_CMJtE0s9M6NNODXijl2MT99wYYFdM9FaJ-zMiZbPCCqplm_h_9fWRdYeH6dwhLj-6sGvSTsGD3Jm7Lwz3IObHKeOGWP9hOEmRY5KHRsGjz0LJEZ--2n09AwfVUMLDnx3Zz2o9A3VXDc3sYrJhLoItHd8ZxJRAqKiiJgnM3EcADBIGAtEi1exNLaq0bSZi-1sn5jWQ1xnq7ktLH0Br789gFLGOMEDK8ipsDstGi7o-TjlQ1wxUuSNUQ7fcA5kxeJz9b1v4HsD-xo&sai=AMfl-YTJ53ChhYp7oZzQFb19GHK2TCvwSF-aJH2sN7X-g7lOnQxHGniQ0TGYxdo1ojJn1QR2JgVejiQX6kUQ1gmszXOe98kVfM8kvw0nT3GbW07uKDQV8itHG2gJQ4jgSUofSozoRfyz9DU7vIFGbNnk_w&sig=Cg0ArKJSzFmFsbyTjH1REAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EC1F 640 B
305 B 58ms
56ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUmL3-BADyZmgeEWFo4FgwBg0vKXS1Txl8NObXEI-XXkZY5RzR-1hQPL779GTThiVFvw8o4m7CL7efEJwCqU8JIciuL7EukxohKVAwKeKRIQ9Czf87aVcztaDWIcYkJZvJ9BY7U9YRf9x5J42w7KzY1mjwx6DC3hIWMGwHFvvJd51GxsSM

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CDAB 15 KB
11 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Byvb7qL0xt-f1Xdz_QxpgMbI0krkeulX6R6HwCDOgG5jzwcowsptq0Sa46asWdZtz1YuKnJ3e2UuCHeAPLhryr_ihZvikW3XELldf4wV-4OS52JOn1jFnNt5NVz3Gof63PiKLFdJy5OaMlkDQ-s-nUoyU8MmAeU25v_VTI56cNnUsZO4Q&cry=1&dbm_d=AKAmf-A7i0ivJ8B4ndsxmnaBBm5xuHgoo6L2mUEIJYNEbL0LlEXo4BETCsKZyd3QtLUAaK9WHe4JeO0HZtp87iXgHQqRF2loRElFweLyp76RNRzAQ6GdBALRsnYqqfs80Stl69SH2tkwgBp1GZiEY0rD5ON8ev1bVqAP8XIIZeec14sd8SlgIW8gdFGrEjhprDs1rAjgKX-Cozb0rcbHWSojDu-S9RApXvcvErd1yf0LeTdlRB0_vBwHyePHoPdSoBOqtw94dNLqarZJFj9rLnjDqpuM0es8dGGYDtGBkEEwjVB11X3FNNM04QRX__hQYru9nyiTXEt9VjUfC8Wrh01C-aojZdCci_Kg2ryqPo1-t3V1VUlqXoO44X_8XXKKvrjtkiIc4qC0DsZwIntvZ_bXnMWdvckShT6xzW5yht02TzoLyCUBCNr0UR3j_ZjUnVmErsVgmgdfK4jDkq84kqDs-rjRaoLQXnJG9PJwO-SDT6Hcy7lzG_Z-tXb5Ml8wWZaSw991UngHqrf7T9zcgztDhcTbPgpdCjF6G6IfaObnFD3qyPg3gdhFW5GFElV4nv9Yf53RaZcXzKb-q9wQTJubizL1_NjfRmojr-nSicb4qzrlkRXLxIRYd33zDE9jbAHZYxqWU73BTQqAbuXVsC5yOuPQ2GLVkD9awWkOBKK6WclPyR1O_94MgCBsMQEmnSXxxmcD9LZcZyznUqluksOt7CvXDfwmO-BdBQmb2BotknRvM9dbfSOfG-CQoxE_BOwWdRuJ1NwhsKJCEHnisjC_roDZc4f67Re_jcniUkXxKv_Yxcz8M_68ciMmBorzfsWFIeVizglf308FX6XQGpTFLPDS7sB9rVhbsEeUce8zLtORNDXojWT24ISLeXeUcHGKbe8TZGR4yXBNT4DCriOyP5ox1rkOR-xAdg35rW-q2pmrLFKILGa_NKz0FP5PTRYJLHs0qdIcN3fMZrLoVHSNz-AEdhSPxO3QvEyAblWSaAwG3y9OOH1oABzac04XLzQPQJrtQprCTIiUeq4rFGXC3a0v3IEfibXT7BpJu3fdpwZk1q-73Sya2Yt6Mv-qIm53rVUkfAWHoOxe0ipDCEopVyskr7AtxO_G5_FoTRnyIzHQIEXlyF6M7tP1XyHRLuCBGLFQO6ETLdTvEkxApF6Ae5CyPrHsIqbayTVuNVWibAnR3p67-HSnJ9wZvHx94u8SGEHO6Kc1eTsgV8NxGmsfhhbj7JOgtLuQB5Pxm9nn6p6GhYD30nszasMjUaNI0XvyOpa_TYs4iYLkeQC65G3RC7JXspgYXvGaPwzqLnRnSZWg3_TEqU9XZ93MjJhhQw8qnyi41U6dsK64vK1L0sW7PDwziDxdHV3iJQJaRfzOdue87BMRSigbrkOEyYm3ZGEedZW9H2BI4kZY87On0gtAlUSgORiAfCanSz1Ec6uzzy5Ujpzj-wGYOMqxHoXvryOfZvj_W3zV5MhSqsMpAiq9oeaJB_vdjbffx0a9pgu3jEP2ItPQiTbgngHSyE39-Uq50mQBw7MrsxAq5B48uDMjy_Rz-XX1j7Xj-2XSqIF_ewnW_KSA2b2yaShmw0ky5S80BEpPFQYDaDpqUWa4iEWUKL-pxfW_bazpxqalDos4ycYoiGNMvJx4XkkqV1DT9-Jr35uwThreKRylY5a6W6nrDGkLfPuv4addazAjIAxN7XvFc3wuFDaP0gauTyWi753y5Nw8jOglHoFFkOKM_lYiAnRkL7IFJPxjkzrG6RVHKp6_ZDXOuvc3OF198wyZHyfaXAz9YJHzffZfhiZO3fKFEOJvJRp39ys7UZjJ2qjXys6H9y2CsDGNIAoSJYc5cebxwkggzx2aUClN59gdglKaDD-5shTfKUsVNX9ukGhgP62SNm0APxBvDHB-9Ih-vT3FZxVsa2lBHgWHx9saB2gVXK3rnrJqvMLD2afIUpVsktU-sOfwgBTxih6eqCe-bdv7Ix2hKB4bhT-AYndhze-AYEWJH9lRWbyi2gNgBrtT4Ek4AaKGs_WINEGWVyTCjPM5GJqfcoF5v8G_ntHqTFY3XTNktgKFjccHVnBSZKEv_-A7RvB0OvbVGfGILuLInNUogIwANKgC9-B-2F8a9hjzy6libom-Ha0xJyAz8aCTbvtpOOnUTdqR-h5ZCv9YY9RztgqYpbO8oJqEKNY_8wvnJVPCCqRcl6OBpYivCLcH-GakiBlBTzubrQp-Lvuk-cl__b6nn6l2MTgte_wIKKp095dekzLZknk_FPzZLL9VzDniT_-jAEMnu-d2-9Yb2tBk65MMKMkutqH8haN2zAZh8In8-lNwtC5fcN8XpFF_O3K6zOuawpoHdwX2M7iAlsfWBsM5z9G_HWw4fJFo0gOMZ3xO0kpvXSQEnDCpUvnt1NmJ-xt1VnNU2dszVpCMjjocSwMTOfY9g-h2TbOH2gLwhwC8IHugGKx55sb9_D9MXcS_YzgNHP1srOuXSk9Uh5r6NWKJfqAVJTq-SJhNEK3N7Prp58-i-O0rDxJ0pY9zwLm40pgVMhlu-ixMYf3Y4H5moEL-VpMRMY3RI0UgkDKzKlP6AXkQv1rHg_B2OKc6kgEbA1pGMQ6951ntm4S3csG9UxQZCpneGP0JOS8NRoWSgm_Bu-2GYEkMzCTJO6MoNisqTSLuk9sCIjseGtBYUVQIfsEN5tZc4B6v5B6D78XxQ_jhN-m82sX7oOpmXKsPnoTPKGeG_tbPcLA3FxZ9RTGknT7b1q6gw4KHPHSYhIHnmM7GN0s5GX2CEeEOcG7Dlzkhu1igZupoL3sHAEg763yOooW0pQYdHFCw4lEBFXXMQ0NdhfQAxq2FYTWR3FcFJ1NSGCVghRN8GPRqI64slbk9hr0Hr9cYNd37G50C5eqFf-inex3bBST7KC8SoqCwizedtfdrg7rZdPzHlwiaO3qu84O8_IX0eeQBc3GMjL5aT8ThT2C3MUI4A58-4eAOSjgPmstSdNkM1YlTmUDA3uIVMFwLZ2QfBs_XnXthZ-qz4ZWhDFiBttknjIyCjWJm_38c_gkdvaXzAPZcpSGlIjuxPDXo6VmXDtd6v_24Bysu_LtBGAXSAizdRViH3-fOprTV9rXWPh1XaVKgJ6iESJsFOI2XJ3S3Uz1yesErWqOSZOJm6tkSty73SYPnEMOpGvC9juMGx5fS5083Zm831by0PCLIRd6xq0w0fsepcRyifxJOCPH-kNgpRFueuciVM9L0tPvS_5guQTCKyBmQZ5XaH319IqAuIAKNChCVlRfy-ew6skUyVg3ouDykb8f-eR2qwhD5U46V00XncwGvpdh17-vCIzMENWGnH3ZdS3T06Ovcxm8R7bZxqvK47BFkX3XLDbx6xFHgpaTSHaqs3UVDWZdNgF7W2e6RsvAU8OTebFp7Fj8TWf4gNLpX5OcRHuNw-wNCOtHIVOhH_jLspSp_65VS-qG5QjSOfUIzzyFkN8SGmPaXyibCI8W1lmQ9CcpyuAfSUNt4vP47HY8T14FBtigX2KT0ot2QcgSz1vIhhFL4Ne3SJktZVFQ0wIQoFdN15B_TpCB27jugHMRbIkqPJGEXTlj6&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73ab848de7be32a42e9b6b3b9cc34115e15f89c4b9ab8e4ccfdfcc2d80935728

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11421
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CDAB 42 B
63 B 156ms
156ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DF8uQMdmceAUJxsNNX1LyOdiWcukoVlqaRpB2pfzgq3kWL0M9blDtjaoEjdYgbwS2cGyv2X4Y7zLMdMz5xY5uE2tuRSq2AQyXZGT3cYUxabWlUEQ0

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame CDAB 3 KB
1 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/window_focus_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:43:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 931
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 14:43:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/ Frame CDAB 18 KB
7 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7480
x-xss-protection: 0
server: cafe
etag: 15631949847000551034
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CDAB 153 KB
47 KB 48ms
44ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47725
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1670417373259609"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221206/r20110914/ Frame CDAB 23 KB
9 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221206/r20110914/abg_lite_fy2021.js

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10107
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9443
x-xss-protection: 0
server: cafe
etag: 9828741834572772835
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Dec 2022 12:10:29 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A736 0
0 53ms
51ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvU4Vz0H6N8kUH8x3bWDXqV0uA9L3Qzjf2DK_u8MCWOpTrBKwf4tdDsLVUAQaX4cx443RKWzf8YjPJsn1ShMzrvViye3gzRq8N3AcGHKIq2YQCvVDOEBiaqg8wTatcrEu6TBJormLYOZ6wVmVdgdzBHM2aIj7plykcS7tl94IP1mze6FtIwfLo-PrLOkkuFfJnIKUENaII3gELk5ttSEJ9LoIuxH3G6MJjlpbpicblDVHniW4oZf4eM6iHYQDj28Y4zTCRh-4Fj9-ocPj9F0hR-O7fJCgVVc_5nGRtqHPUQrLQr-tvmbBy3Dnj8mvHuJtvnS_DWavvi0A3MshEMHqZKV6Lw6UHAed1iwAe36tQ&sai=AMfl-YSpBf91lmSfMaq8woF0Vc7QJyHLa-A5D9Im0vxdBVnx9FUuR36g69TdHno01DpPG72L9HCuq1nmRScl2_HxzkXPv9BddIawiu9M5ulUKjJ-ZGxufeLpfqlmqUEiMHkr1XxZgndscpqvkYXaoCf6oA&sig=Cg0ArKJSzANPj2ZjOR_-EAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5C58 0
0 52ms
52ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssoOJ1NiYZ95lHySTV8Fb2pisahlSK5l17wmh24bBrfqWFay8_jWUp2o5M_nycDHCHP_AD9ovr1wsLeUA_H5p7Rk11LG-56i_dTlZaGifBiErqYtnr9TZvlWaZiWf590C5ZLu9lWrb8wfYFrOIoM_MexxLQ4UWkI7OkHysPiQrEnE5pRRud29C-Ceh6b14QiW5RtM7PDof3Yz3yttnRJteRaXByFKuD5jtf5Meqrwni4AfMhzQkfh7hsBhV8ngXwndmyRGac7n27aRNS2Y2F2mLGOp0ppl-6kfpfJ9dZbmuS-eRSebZaN57OANOGfzMi5TT7IA22G5-Imhhaj5Y_OOwQpAihTQ&sai=AMfl-YTWchwKKW81zBLaeVS-8CnS8DUn9sYc-yAGTiHg7i7N7w9omaElDJOFk1kYZ0nPrrZ2ePVBD3moDpR_mSlnNIKQ5YbL4GMRtx67iIY-fiCMPJ4y2QLOwQW7KaBpGRT_t_71Csu3-JcNTzJF2CvxhQ&sig=Cg0ArKJSzIifJ7gd3ApdEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 08 Dec 2022 14:58:56 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 2C46 15 KB
16 KB 51ms
14ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 05:09:29 GMT
x-content-type-options: nosniff
age: 553767
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 05:09:29 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 2C46 15 KB
15 KB 54ms
20ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.spokesman.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 20:22:20 GMT
x-content-type-options: nosniff
age: 498996
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 20:22:20 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 96ms
96ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjExNzk4MzcwMiIsImVidXkiOiIzMDg1NTcxNDEwIiwiZWFkdiI6IjQ2ODY0MzEyMTEiLCJlY2lkIjoiMTM4MzU3NzU0MjQ4IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9Ib21lcGFnZV9BbmNob3JfNzI5eDkwIiwiZXNpZCI6bnVsbCwic2l6ZSI6IjcyOHg5MCIsInJlbmRlcmVkIjoiMSJ9&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=d8083226-1ab7-4d0a-b8ec-530c304e665b&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536249&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:56 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3A31
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVjLm_GItDL2HQqbIWD9DYQwENw1gXQx-gkHCWG8uZT1pQF5S7VlWCGsx3IB2iFZKyOh9GD7RbclYa33SIUCDWnCCGwD1JFLeelOuhglnYPSkJw5k1oXfRg_4DNuRpViJFqB96wCtByksiK9U4BrqgOqjcM_lzlZS6lSzoARHzDo1O1GVE
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3A31
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5H7sNtQpiPLe0qWjhIl1AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

43 B
894 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVjLm_GItDL2HQqbIWD9DYQwENw1gXQx-gkHCWG8uZT1pQF5S7VlWCGsx3IB2iFZKyOh9GD7RbclYa33SIUCDWnCCGwD1JFLeelOuhglnYPSkJw5k1oXfRg_4DNuRpViJFqB96wCtByksiK9U4BrqgOqjcM_lzlZS6lSzoARHzDo1O1GVE
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 3A31
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIrA_FrkFlNxKfX3eGcUafg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1

43 B
1 KB

14ms
14ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVjLm_GItDL2HQqbIWD9DYQwENw1gXQx-gkHCWG8uZT1pQF5S7VlWCGsx3IB2iFZKyOh9GD7RbclYa33SIUCDWnCCGwD1JFLeelOuhglnYPSkJw5k1oXfRg_4DNuRpViJFqB96wCtByksiK9U4BrqgOqjcM_lzlZS6lSzoARHzDo1O1GVE

Protocol

HTTP/1.1

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
AN-X-Request-Uuid: 57ca91c3-b626-4711-a933-52c6aa19e34d
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 178.162.209.135; 178.162.209.135; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
AN-X-Request-Uuid: 2a95a5f7-4abe-4d4e-8ed4-508dcdd7faf9
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.135; 178.162.209.135; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3A31
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3Mjg0ODk0MDUwOTQ3NzQ0Ng%3D%3D

170 B
188 B

27ms
25ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3Mjg0ODk0MDUwOTQ3NzQ0Ng%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
AN-X-Request-Uuid: a4ab5865-305a-475a-b553-5a763b133f78
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA3Mjg0ODk0MDUwOTQ3NzQ0Ng%3D%3D
Connection: keep-alive
X-Proxy-Origin: 178.162.209.135; 178.162.209.135; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F630
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXN97CXtb6oTY8hIm_ABa32l0_pEfMxi76_TXCaOV9HmfTjwLM4wYx2HDHO29E-it9iJHWZ81nJfnVoHEJ2ofAqc3JZo9qLHYlDBOK3QUJTnEQNdI95DCBhEynxdf_s2CL-QjU9Sxp63f685jFa2HeCTxThQhb-wSFdhW31SN8o_r2UKMU
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F630
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y5H7sNtQpiPLe0qWjhIl1AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXN97CXtb6oTY8hIm_ABa32l0_pEfMxi76_TXCaOV9HmfTjwLM4wYx2HDHO29E-it9iJHWZ81nJfnVoHEJ2ofAqc3JZo9qLHYlDBOK3QUJTnEQNdI95DCBhEynxdf_s2CL-QjU9Sxp63f685jFa2HeCTxThQhb-wSFdhW31SN8o_r2UKMU
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBHC8oPxuCmQgiqbgmtVCN0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame F630
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIrA_FrkFlNxKfX3eGcUafg&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1

43 B
1 KB

13ms
13ms

Image
image/gif

185.89.210.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNXN97CXtb6oTY8hIm_ABa32l0_pEfMxi76_TXCaOV9HmfTjwLM4wYx2HDHO29E-it9iJHWZ81nJfnVoHEJ2ofAqc3JZo9qLHYlDBOK3QUJTnEQNdI95DCBhEynxdf_s2CL-QjU9Sxp63f685jFa2HeCTxThQhb-wSFdhW31SN8o_r2UKMU

Protocol

HTTP/1.1

Server

185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
AN-X-Request-Uuid: 84216296-9fdf-4d02-a3fa-ef72d5f35373
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 178.162.209.135; 178.162.209.135; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
AN-X-Request-Uuid: cab29235-f0ef-4888-8e11-a47fbb6f9f2c
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEIrA_FrkFlNxKfX3eGcUafg%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.135; 178.162.209.135; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F630
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMTU2OTg4MTQ5NzU5MzExMg%3D%3D

170 B
188 B

35ms
35ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMTU2OTg4MTQ5NzU5MzExMg%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
AN-X-Request-Uuid: cf10ecbe-f09d-4d56-a36c-86dfa296761d
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMTU2OTg4MTQ5NzU5MzExMg%3D%3D
Connection: keep-alive
X-Proxy-Origin: 178.162.209.135; 178.162.209.135; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 022A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1

43 B
61 B

102ms
69ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX1Y2tkmiD9GkwSovXRWho4Y7OEVK1SCLz7RKZxxHZJ4nNpa5XZRQAg0f2J-cFnpTGeOdSnssbvMfPVqryjIY2MXGFk3ZS9630sxbU_HX4HX-uT9hQLrhP5cIi3sOgEMmUyr7WfAdKWmoGCckwDQakc9XT5wKy7EaswiD9lTPCQ2HAVIdY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 022A 43 B
304 B 69ms
20ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX1Y2tkmiD9GkwSovXRWho4Y7OEVK1SCLz7RKZxxHZJ4nNpa5XZRQAg0f2J-cFnpTGeOdSnssbvMfPVqryjIY2MXGFk3ZS9630sxbU_HX4HX-uT9hQLrhP5cIi3sOgEMmUyr7WfAdKWmoGCckwDQakc9XT5wKy7EaswiD9lTPCQ2HAVIdY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 022A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1

23 B
172 B

37ms
36ms

Image
image/gif

104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX1Y2tkmiD9GkwSovXRWho4Y7OEVK1SCLz7RKZxxHZJ4nNpa5XZRQAg0f2J-cFnpTGeOdSnssbvMfPVqryjIY2MXGFk3ZS9630sxbU_HX4HX-uT9hQLrhP5cIi3sOgEMmUyr7WfAdKWmoGCckwDQakc9XT5wKy7EaswiD9lTPCQ2HAVIdY
Protocol: H2
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

expires: Thu, 08 Dec 2022 14:58:56 GMT
pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 022A 23 B
172 B 91ms
54ms Image
image/gif 104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNX1Y2tkmiD9GkwSovXRWho4Y7OEVK1SCLz7RKZxxHZJ4nNpa5XZRQAg0f2J-cFnpTGeOdSnssbvMfPVqryjIY2MXGFk3ZS9630sxbU_HX4HX-uT9hQLrhP5cIi3sOgEMmUyr7WfAdKWmoGCckwDQakc9XT5wKy7EaswiD9lTPCQ2HAVIdY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

expires: Thu, 08 Dec 2022 14:58:56 GMT
pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame EC1F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1

43 B
61 B

101ms
69ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUmL3-BADyZmgeEWFo4FgwBg0vKXS1Txl8NObXEI-XXkZY5RzR-1hQPL779GTThiVFvw8o4m7CL7efEJwCqU8JIciuL7EukxohKVAwKeKRIQ9Czf87aVcztaDWIcYkJZvJ9BY7U9YRf9x5J42w7KzY1mjwx6DC3hIWMGwHFvvJd51GxsSM
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAzwgD1TY3Mh9uNjSynV__Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame EC1F 43 B
120 B 64ms
21ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUmL3-BADyZmgeEWFo4FgwBg0vKXS1Txl8NObXEI-XXkZY5RzR-1hQPL779GTThiVFvw8o4m7CL7efEJwCqU8JIciuL7EukxohKVAwKeKRIQ9Czf87aVcztaDWIcYkJZvJ9BY7U9YRf9x5J42w7KzY1mjwx6DC3hIWMGwHFvvJd51GxsSM
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame EC1F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1

23 B
172 B

40ms
40ms

Image
image/gif

104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUmL3-BADyZmgeEWFo4FgwBg0vKXS1Txl8NObXEI-XXkZY5RzR-1hQPL779GTThiVFvw8o4m7CL7efEJwCqU8JIciuL7EukxohKVAwKeKRIQ9Czf87aVcztaDWIcYkJZvJ9BY7U9YRf9x5J42w7KzY1mjwx6DC3hIWMGwHFvvJd51GxsSM
Protocol: H2
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

expires: Thu, 08 Dec 2022 14:58:56 GMT
pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEATVadwI209D3bjKt8aPHWQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame EC1F 23 B
172 B 85ms
49ms Image
image/gif 104.75.89.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNUmL3-BADyZmgeEWFo4FgwBg0vKXS1Txl8NObXEI-XXkZY5RzR-1hQPL779GTThiVFvw8o4m7CL7efEJwCqU8JIciuL7EukxohKVAwKeKRIQ9Czf87aVcztaDWIcYkJZvJ9BY7U9YRf9x5J42w7KzY1mjwx6DC3hIWMGwHFvvJd51GxsSM
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.89.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-75.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

expires: Thu, 08 Dec 2022 14:58:56 GMT
pragma: no-cache
date: Thu, 08 Dec 2022 14:58:56 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FB48 41 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Auyz7QHAQwePStvdbJ3BprgJe2iNeHxYrUnqdP-KbjyR29cLjHiEDFlAptpB9V5iWDVRgaqSLoqo_jJk3gudazjpcK28QXwYv56RNcV6KhGb3374g8MlOUbwusPDaDDQHwuMYOJOQULYfGiX-eO4tqp5Kd3hRf4HPREPFV6ipKIwxkB3g&cry=1&dbm_d=AKAmf-D43NB69w2qRBaG5hn-nM5vfto285iGOm2m5YVjBTWcI5Hb96qMeaO-YBT1rIccPwgYryonKjXOJMLAcfUT_Yeve2v0eG8lZ6zcTnqEsRcF_UOmiXGEmCLjBRz6_aIann14r0Bw3D5qyhM1f2xdcf8XT98s9qDEF0lVB9Dpe2tnDpFSlgcIUpSUmLHsg8LOyL-MFImeVX5ZbKOtoTpknSM8NpPDcumRqPZL6WA9T8wKXYIMlhcIYG3O3lKZJgI5UMAWouBJ1aSXK5KwuEIBHYhcpUGm_3PaUKmcNha_2SgPk8HiIBMDHyZd1RqHsL-THoO6FHoN4p0IsyCXnLJYUuP5CAFNHh7LotekR_N93rNHwXGgW_earWkDxw51Q59F6o8uFm7STOxbs97LxxwWGIu-udFXHu3OMRR5p-Vli4Sa5P1Dqt1xvT9jc6iPJEkCrfxfrQ3KTluiUJ2zxprZVTNd3W84ciMqUMNBmUUB_d4NzPIGpRPvjjV5ppV16vJog3r5rJnB_ZZ03S-T2bIZ7RGWmoTp7gYppNwe9pdWg6MJn4QTZQ_WgNffq3yhUcjqkmix7Evo2VRs5FkBYSCXjsp7VZvGF4uMw5zNR-37ljoNe5MkftnxPnBcpgI8pG5fE-cFEHpWm4vB9ZfRfzjd5J3MZMVPH3E02H8AKgSCaXgE2DmFgblRUL9WbR4hUVAMu90uYJ_GAB-XOysEn2wz-HRTHIB98qEVJJ1li-Z1UClsPPCTwp7irJ_xJv1JLmTYmBtSIikaV2g9k0bq1SRf8nRId1f-9YcszkzN6BdN5kavoCTRqf4-h3i07ioce6ro3-VJ-igb-9VzLJOVE2abR9rhZ19zxPdSUd0KRj_sMrF_rfMgH27Vz2-VflgiqJtsqEeZWOM9RhL2Pbl6RQQ0IeIu-tBCuJNzmkLKAYBgV0GBKwXo-XfhAI2sD554b_DtDgdkQ81Dl1FUsMu-R2vZts3RxOImG3Q3S0_gtY_YKrseqX5SBj79p5NUlrwfHw1n_EjV-ugRR_4g3TFxuzQXcJpN7f6LwZIlxSligxB5d8WLZyEiOm88s1Gq3Meuv8OqJnFItnw1u9fnySNZAfTtTuInYCJLk2lvWRIr1dghdJS6Qr1xnRw_Nbe4SE1AG3SO6ZdA0vc7IaRN5kFPrcvuGmiJyi03KyCkNuXb5QuaPsTCA8eJwcuGua1ufdHvyIa43DeeeFm4bd4EK7K-5fLt-Y9UR3zhJ-9rSf6NnfSZxNeC8Kk5-nNt-IxB7etcPf51l8bDGZ3t3ROv7TpNi-Q1WRsjtmrfydM3Sep5TTXcwclm2Tk4ra0auqjVz7JRQ3gVzDRfxiaCNgzEL50Nysvq3jhalnDysGjQv9sj1RROhMOGmgCODUXlD5tNlxqVfCwTpZeh7DOrNMVIrs8mu2ZTvtOnYUaOXjs5vKEGo9j3jSI8lFd5qh6oM7ynfnybPi_IN90bGa04m6oT6SR7fwz8scqn2D_7EexThGVKCGxGwmlQLQ8vB1eYFWohWAfwPVNkhsk6VIGkgqt8Z6dkeS3rAsox1KjHjwzd9HCUFFVOs7KAFDLIUZ1rsZRJBN3RoStR8glQFzI5IGMs6tCp8IhRSmc6GxAYEQEW82M61Znw1dhJ3hRGs76NlIVpd72nnEjrInVDGApTMP4y85FuUYr1ozFeSezxkFHd5EmdD1Eh4WKBe94UelQWYaqoq8wiPc20dJjYGqJu7yxp4VA3O0G-nzw2zTyMhzntKwH0dewb6V9Za5RYs6e55Lv-ak9FRPpfsbGFxcqLCW7Vxc_ny8IF_1rcUiDz_8VY_NFw5sJ0pZShYaU53cC-ZPZnYhdCKRjpqxQGpuufjOu-Tusbu04-fIU7nO5816ko0OXMv102zWY4_lktgo1Ogv5qlBlIZVmf0XBqks-lZFsq9YyIM_Dphp85BiW0rTonyaBgu1cJpRZCW1clwXRke3DyOUT7TZMZQx5_68ZdGzXYTthxyYJGr14YC3Fvp3UDsxXuH5T8OljtpA4_snO0TTVXYaj7qvZFgz9KuqjFQUoSR3lUUel13ElIEwEegkCYOnLtLXG7hTUqx3Pfz2HI8osVWbbMGGuWxuDkxycqSlpm3YAyZRA1JzaIgSCPbvChQrZAhrmDcHMjdnVotQ02Fr-vEzimt6kBY3xodAvm1lKN1ZV3G8duO6rO2CDe65z0gm0n5CYn6tcITD8bJoZKWphdSuqabG_fufw2rWK5pifj3oUvjZqv_atYa-MS81CaUAURFFb5ggMj4-3XuuvgnpvjyzuhUsdiU1lrGyFqc7kluzGIQ-Ucr0EBa_hxPP5C2bTkoTyfw12lTO2nB8AhUCGTYMfeTwA8PFaN2Tkz63TuM_zC7w4cdBqksecyCuQNm2OYAncSTYrH5N5ZyelsfbKkqLB-Z6PcMM6Mmy_tYbzzZeolzOHtlvKexFBbQf9tVcDUsR6HCe_oA55gPisGIIn9uOVwf-tcBLExn1UazS-0P4qQxmj7OX1yJs11JzopVV-ndg5M0y6tiCik3b5heymAmDHUi5PPEi9PGTyrxEW0JE6elYAukz77osjoP7qtr-y0hv-C56Hfn7lCtLc61uSNJC5rPM6JJdkTyTV9cg6DFDzO4L2qr3uHirysKnmddXJ49n5j6I-5d1hGF2LSGSTbqGtBytOAXZbv5rch_qW93sAV6g1z_8G22Q8PIMizyKyBAqu2HAamzz7FhvZ4tSF1s4G5h4uCZ7boDKxU5zHOlP3dIkS23itecw8wRly0BY2Dad1UlwQCDFWm2iEOM9zYRDCN-3-LRFGnCeEXio-IbNY4IAztc4aHzwsW2YOxT2BU83InXYLW-_tcaEKXkbgvWJ4CMJ3guc3NisGHnztD0FngTZzvj77vIxkXFimOSqAILONtQzIOxdgAG_2Hv5PvUBHDl2oV0ZzOb471OdPwwPwBMrZd-51BwviUMw5UXloBQFUXIojHrsXXaKzJhzz9dXGdsnWyWRd24dtLDlMWlmzmp7tfn3EupVovYmG_1gp5zBIVhGHEZo2iMlf5QV1lrSKjEYcWLgro8tTySTM4C7dARXcgX4YPbH52yxsNYHx8_WUmF1d4qCu9r_SLIupg_r4W0z0obYTeMKj0AKR9JKohfI5GI0G2-Ock8mQlxBpG3NcyzlYjHVzoVIJziGBT935nXIfRPH3IJeQ8nLkQ6R8vQLe6w6dg2LeW-iAZYIDNzIfDQPvmILynZ2iGWywMW-sAawQts9bcvpkXhHrv35CZBXd_0Cee8W2uNKCrx-gbnSTbGrKMPSj5_hswCNFbgcCDX7Kt5CxczVD3hLLgnl2zefbbHPYQYFfzVvGajsM7PVR9_eMOIosBU0uwmBfuWLc97bnvDV6GZuqNA2E3bzkga1Ff__YbL-2h8FWEt7HR4bcjSW6dxv55kix3zuGlIxZDeasU8h8WThb0E2yhh2PgDq03pIRQB69FtXFUjHkJPq-QTzJkh8hxjgnf4F_pIxMZ_3_pRWzud27zs0p-srYjoFgxjZ83BGRb3BVB9tl-Ld41PHvXbOzog2B-qD8FT5-p_htpvtrpW1Rf&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 07:06:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C3CF 41 KB
15 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AwuAeLl0m6L9W30laBN33fT8wYHiJ5YAQj_AvHHBI42g3DUvwVZkmfJQvoBH0hTomiPxb-5QqbIK10cnhOTghpShNbr3yKef6Kp0yKfvd2MutzOqJIBF0WswRkZx41ySvs79lLjLBu6vVFcx-oUinl4by5ZhmYW-VAy194Ru5CJPAvLkQ&cry=1&dbm_d=AKAmf-CI6hFlbSpN-BeWF42R9kH-sWuFlwSEZbhb0FjKn16MtYh3-U-Y0lFsnbLX9FuBGNgHhkfk9N_Mvadb-d5UV7f5RKrrZXyr1FdxEoxHKyIYARwj56AXE-xXBP_ZFKY3dhYZ75u6XcTR14lRQSSGrH3X67UNCthsVrZ2EYrceuRvOsdCQZGLAkAVERTmavrcbhidM7doFGt1kL-wfH-UvPXYNp4OHZ8w9kM1AVJXdEIvwHulF2USDPVSRJsXFGa7i45eYXq9jQKOZO5gYhykSxNhpv4wE1QGlNvHJaTNoiR-toUS1OXinEW65fu13vpSgzcsaYc0hSCKazjneHk94voPht9U6X3eiQ5BxlHO3r-rY-XL_xAyNzqmIA-aZjLYi0U3cm609uA0mDE7hMyJuoyDnsh9pat0GCS_J8f410U03ajYl2h9ZlxKEZAnnB4Et9SrrX0_ZgvFbdI0BmjvVCadXXw66Tos3LSJtVEqBRH_T-qg_aM_nW59kTo9dfA4qzBNWQplySwUAbI10YfneBntzRc2PD3GdHznV623opIHTVNZZM_UuF5VKZY3wYX6in3t2590_UdRY6_qzFyPs1-oHlxiHV_ioTTxFuNZsyuF2tg4RKisbLQuUx7SoHf9EFjLUwfOtWyGdIr7l-7lBtz3yoSe46tmikJ89BqSP_1cSWcyZXwV8j1G6Cgtfgo-EUbc8K1LoUZ7dOa7BoUyhdklA25t9ZRe5WWYSaaVP0omlto4gn835RbOBWJVtj0HU3tUB8t0qvXE8YuT6IPGan44oZh8tZtSVgd4rwoxqlLC2baOgQjjZqqmjihNj9gWMUUexSNFGmd6Uao9rgIjoX_Mmx8QviIY5O62B9OS22ZUTmXum4eN-64FYi0h5HeBXJ_kPZSUBa5ueJT4Ke1JG5AUswMQhYprytiFHRL_6uUwSt5o-Rv8EshtHG3jGLTT_bxLdpwasCJAjb-ZohLZktTbNeS9m313CowbjewXaFQbD3KBKoRGPq0NSR4OcORNmUC8_GSCYVgcODgcS8rrRzxB1auKfPbTzQ-FGxfazvNDZ5v1v9f5B0fwD2bWAAFn3UCix4kP2gX0AqB_MwJi7vnuFxXr4FSp0sN_XBF3HxAE5uPX_8Ob-9csuXCV6kpHQBuPUdqqb0pekaG5M8DW5R1I8iTcIkd9yDZ45p-tui1JeZgikUpkxfodrORyPwC9NDBXVDVvpGsdqVJ7ICPQM1fovTg32NEC-88x8UqxqmE-id8KsA-dgvDo24iHH2RpVqiwnZvPYWY67YlPNbMY_Y8wMH06SkUmRF2Qpd60m2u3GKXBGhqXE9FVDDsS8k90Lh-BGubLVamSdE9umWWgPYWtdI7DQnp7Sn7e8gxd9Ks4wm4OJveU8hqdnh5uYH3mU_DiHQ0uZIkn8RlmUpLsslS1gEGQ_PV9MncmEKlLha5LGoE43I-7jaqTQtPHbS6hi8BN5rYUehmIFpYUXnmJRY6MDn4XynxApEzyb4sPvZmTTZwwhmIk8stqJMltT2ITMdZ1g26v6kE7nYshH8328mcRpAqiXYcOrQ9USFHyD44mU7Gof29u9Tr_u2m0JPZF90KEsI-GxU84fvgJNsataUuBPuQ4Cd58qncrrnKKEzYMeaYXisfMv5Y2VqK04uBdFbBDDlA-dx9Z9L6KTDXvFNUeJFclOubf1zfmlazonvGGvL1H4k38LJxq-6LG8sZMk2GU2HPbfWdiy7OKf1hPY_zsrNUwkNwHwTposmR4fLJnCA2Q0NebUTMaqZ8uY4M86mbKbTj68qUT2H8PTOMiOiCoVUnDsMhRvnkvn_nbbA81UXQu37jx6pi3KIfFwJjLN_VFVp0Vr7i3RDpvNzkLLbbD-TbmskVgNaPPCVRL4shdrnxDdnZc7xl3MXjksO7WXdGX0ex-XC8jF0oHvVV-tTqgwePZqqOx6YUdFMdskIwbpWgWSG6VpY9pKwMJtIuU9T1SCLTQ2bhuIiVyMkr-vQZ8h3hFWrTkuozQ3lyMlRjTzD9_-yMTmSHtWxYitNXAKqvu-RuuR47XT5GcCbz7FTDZuLKDXz8Xs7p2r9a2q1rgnMc7s8ib8UkHaP0sZ1Uaaq4DKCHSc66MI3g7eEUTm0kKnKhIIZua7TbJ0xfrb9rlGTE05dhNbW1QZAQ2q819f5K2orj9x4OPy8rDiZq87PPCamdItCgzkq-2Nv7nZrxeWWGJ6MCvs5Yc-mW3hPB7zS842y5UIYqxOxO3dypgQa0cXHdXBPesWScSmejE-C9MVQrka_aH97fUt5_ND2IGm4D5TtKu5Ino651scMJsn3Z2z-RIipVOc1QHBTe-AX2xksizBTABNFHXmH-OihwfTLd48UejoyyMhJdEg-1w22_MTot16nSD8Q8beZAsGBpZg6gZ_bOxkcCw62pI4dBKN-_OQJq2jRJXScgT0_NaMP0iS7qSYTNDRp3a5e8V1bIHMlfl5axuw0aGlDfvookrExMGffpC4k6eFQ8DdACc3IVDkqXMOHxwRxATwRrIPnwAm46-68WZmWrIr247KRBpwlVjmgB5osrnzhdo4JSwzkd5cLqgEh7s2G4NTt3LZydOMalOmSZguozCiSPaJXmt_-d3XMq1v_snp5TwJXyKhw4JXJs27ipSk7q72luD_WDlOC3Rhetl4hFvVjX6-2V4g0loL4xPKKJGALzYrU-pHI8K8WHYChShxjUEwJfVgbsmcojA4jAnPnZQY11SGFF0OnT-48VrpLScrk_OdRFLkyKNPkFDzmtEbN4NwgIKn98ewgMw7Hrgh9RFyVR4d6uaS9PE2yF8bBe1PGeyT__5Gvsyq1bwIpdjRQrRxjHYn7bViEV9HnyQJEjraXFohuntnHU4ovWCLo_qVxyM5tX0UTzq58fdxDCDcdQvzh0XHsN2T2NYYmrj6TPGnERJ7v0TL1u-c_qv0VXel4zAueFeGTLiJ2myIAv-wdJGO_MlSP5ty_R2DzFaqcURmSCdWQ12IJTLm_-ZMyZbjTXOnC6Zy-zMfZXrSRu1dpMVirDU4OODNEiuNQaTfoOlEhrVGosIGYdSYWRKtvzDiZ82MPfkh-T1CSSqjFJluZYuitgxvhNoqNn52rDWr4H4AScWrlY3aAtCyiNMRNFQ6AVvcL3bXdUCk0hQEPq-j8aRVufny7BBSjnOIwgDCI4m2D1mSZPfhhQJYcRmVDuAveh84Zx-_s8O74INCdkf2WKruM2SQvg6nIfWb1NO1D7VB5rLLpurIKF77MBNARDy40UvDubtCqh8SYMk27eqC7vFybFQjTvF1CFebUGymz6YSBYJU9vyKUULFG3xrAbsM-91MvFG7Cmg5b-fvdk2t9YflZegd3rfQz7uaHj2NokmBncBJrhZTRd0GEcJhUlhiZ7kLps7SO5KGjPE-0oZ3Gr0bxllI2hByGe9PCvD77aAZL0OlUNx4E7pXvgoVMSoerMF5faOBBe7alIYEjSvh6DQ92wZ62PZM8ZAxU_hl9k9NSKTHfqjYb6yhd6TkXvkHTA2rn45ILuceJqH0ejJIdYJPQqd76MKIi_2pUsFHV8FWbQYqyIZYD-jfAvU&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 07:06:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0853 41 KB
15 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DQrE9tko_Vc5632q99StBgkAn5YCrxV0iIu7UlE-NfarYymSiWVE3G-kcu5CzA27xL8nugdMJ-7Md_Mm3e8vWbMGzstvGhScoKC0HTdT3DLKhsBt7omx5m9G0NUSFYHVxKDKOsbWkB2UpqoFwqTYOzZdwwYvJp8d2bNM_qAOcJHYKE1Gk&cry=1&dbm_d=AKAmf-CIdqHBDV-GKA8_X_6CsZRTAXF98sDiUMV-bA4MUp-cyXEhUFEmSNCBiiELc34xk_Cs3WCLk8mnYwsICPnIDPwvBm41ncVJHqOEmBcU8n3QDKFSceg2YMIoXFVX-pg8ss2vlQ4j4zMNyjZFjHMEMcjSXuNkCJg0dL_1YCXeNx7ptVbar-ImxZV6wpp4fmdSEV3A_r58fcNvMf-QAjqNNZCMIpu_BY7ALFML05soCAAa8OBtCNua2XSm2ZEkZS7lJ2uGiXTl0oAAVpOOjQmzL_OaNnO8GtWThAcmW9QcvwtF2xGdYusuxUn6x46bkSbRxoxAs9vUbVt7UQznONR6DLe9m4omB0gvfFkBry7Sjb3ljnKUsno4BdV19wjaAGt8YWWFgC8XGSAkN59A_KQbn_yBtVKd4gcNMUYMapnekcu3mLy9dMJsj6AsgMTF1G_jLreFUpyGOaMDurdjmXK7632s5d1aOl8JbV1KGfe3j77Ib0JKvtjtJqQG91h8OYC6L-BzQN1Zbkofx0RWzpd5e2efBELCjTmih16y0hN8eysdt0ijyLIwzHF7ZSEjYbhHc3mX8mOYpo9Qf1CkUVXNc6FnserarVH_sKh0L_V_Yf38udwoAvVGm_CsCj_t42_O3BDT42SkT9nrCQB5U3cF0MNh8n9UYsADe9YnBni_ZwUAw_ikjh57-stQeTUqp85mP2U4FGIbVk3g2v5oc1p5-QlBuBXB8MnjwOCwXze0G8C-wxI37MEUC9aP0W1L2C7gHfFZ-93ppxBafb9jYp4s4sUHbbNrRvRagaVbVD0qirKoRG3diKdfTeBdEwxIhymoFn_2rqykkBrWB7mp1HuOPxqpE7hS0dirV02fZ7h1di7z-VcRQfSih4fjK_EfAlJr0ApWiqn1D3JwiE6OGI3qLA2SIwFX6rc_Mu0ub-UAtxuAe7oihCEUCehCNERV-QkMyGfR8g-bGAUx28OoF_G8tVZPjyd_0Lz0uYIjC2Tep0c_Scms_AtCNS1YhuAuXtn-PqrhFPaQhe-hdQzaq0Zd0JYsPLuUvyU5FxIqJxPakcYD0SVKXreyh80C6aErajtXSzmzAT3aH7bhIazt2egTzdQWjUoqKANqOLGCtlKvfynyNN_tZrqOUmLPjOKkvAjclbZ2VMO_v9b-QWZe7Hlb_kbxyPCpqzj3iVhcNYj1HFkxmO4yahLKSURkgfxJn7jNjVLogsNZB-wLL4mNv90CHsqffuyDeuYiAWxNXDk6rMxrB8U9e3ZXkxU29cg9Yzn1ZQ9wKYcRi7JYX6egdGuanwof7TEfrWsxbbGIJ6tKpRbQkb4SEnUu8cpvc4yDGeMBloo8RfVgMTHjrS-FtTaCqHhBQZGPOvS6ZPCM05sqN57Tvc2mUCKTVo4D-E3OM0Sr7P0Hcatv1rd0eYfwQl8i1aoYHGQXb7jkxj3BLxLDEUrV1aOjArx0KftatQmB9U7PC8liWUBVLWWPtZ620fpAt1m35Ww7Zr2KRtd8_9kQ7ZYtZteEIAET5wASMZeLo5X6nrh7DVZKtLN_N1-bgWmaqntVR7NU2mc8en98-iEjNyWrlikP0t5XG_fchO1506FDzhwn4mmDu51WdX3Xye3vCz665q5Ks-7JXm01i-dZ9d4BoXO8TS7Otq0SncHUKErC7Jew4CFkZQouTRdniGM4sAM6dwaLW63itS2LPRZZ4-WpmXckt8y2Rp1kdhCHz3E7nFHRHe-uRIFxiicak8LMdswRaz-KF8VcocjUhJBymdUXnMF9kO7sva9cJL_RJD4Wy-e61vCQhUGYLszCfiGgmaXRO0G2s9ltjIfYGG2Y9_LtCog-1MO5Nsy8wwBKS9Ql5k0bdFprjRvCDiQBJmrqO22SlmYB0Po-Zdo1Pdp8ctKcAyHYUXLab9ZJgM8AVwZZo-81qOq0TfZJtaRe68_4Oca8QnQoQ1X7SefCaV6qarI1sKHa2d1QNW3LiA9GFqBLSU6gsmeyeT2BAitHTU4pW1v8SSJ0VX-5DoKTQPtXIXPPEX_J08X6pLPjGtBQC3wsC9mYOocKS1nNvAiOobkYrr3glYNsdczZfLt9CB3zURVrKyL6__cNWi2Qrkc7ECiuVlCzYoZO_S1NguUORXMs7PwyF8syTR2zoY7C6k3IySl8bnP2BaVIkusIZsn-lOy38cSsN1Uspu2sX5WmcsOVSX8fjx7GHG9E_Nw50v0eMjzHpr0uEBVXVvOOxCjLhnADvEXPLKO-NvdpILQVrA2MeTXDCeNoP0Zb61hfwnT054lIfDxHDbE8vgx0lZ4CALZlNQXY9l0WQxojhAysLvCsNP8B3xaw5ICcGbQuSM9b3Jotp8zAP7iNQQEM2-1Id4MvT8-RTuToFAnFZt4UIWpeuNbi0WBlEuvnqNoNBaKplNiR6gL_940_RRtoN80eqCKWmWTuhtBsT1eouhU4uv6T0pRvj5n9m4QSyek33LAzkMZKP5SrZW4Duq8_cCoHXcaIUMNKByfrpwM6WABjO3Y3DRwzFL9E2bZB0eIfHJ513-8GioODel3xiPeAYSvQboXwHPxxcM2rp8GH-ERYq-EV6R9g_MbF0C5BO2Cqpw-AfGw5cd3GrxTMO1J1KIWgKN2oOo3ymBGIQAoCf4dlXqlRKJS8dr2qVBSEDLmM2dTvzuJdGoNr0vhLgU-rfsP2UQQj96mOVOKehXdGazoTDrD6sV_x8oI7LfIYAfhyvOsNym6IxNXDpnWsF_kQdH9jkREhM-qizaAWfsrNi6KkD4lGEKXQWgMP2hJI_VMOIquUJ-LKR2jHWVAeqOeA-D6T3XGdUgRjiFih85mQQgBFjRZ0oI5jSAN-glA6SDqWrixhnrfzcPhgE116BJ6Fa5PMYPj5pdyIDi4wrgM5g0BwDS32yS_Y-nMuHTeNOBoJKimGPosauHOLia37G8ZRqkkRvcpXuy2kCADOd8DiJfW7r1DaRgyS48Z-OOQDkzytNb1SZmaISjsRSeaow0mSrtRsJ98o7KSLzU8WuBoqPhiHkNfaZwHSEk4vD59ywTpSpBw6YWBBkwtIuRZAzf7wTINAXJ3R_Do8nPd4V8yMaisjYBq-cF3EvN1YtwjyukZAYHb2LO6hNj1k-0DuODH8pBB8NfNx4lfZkVbNiaH3N-p3sCc7xrD0taxQZGOBuPnKG8cQyAPfSCdDjzdA-u26plHYAd1euq_fcZIYPn3V5yJIv-pnz9TtxHYZPJdB_5VbqhZC3ONOXDjRXEtsWjoynfKeUWkZVmkYIIbwP9WD5lC-_0kURIVquYGh7MwHsXJ-CPsx9cTedIc7v9bwKBkcGY31crij6pkLdNmkkUKaJ8HTmpkcr6gynSidcJ8rhb74V2sHiJranBKD0oPILAULloR-iLEmBzc_7om-_cADhtY2OUPoodW8lsMso06KGiOJlFOAm5koIDapFVG7siAVsl5anKxbK3TUp9SrPkA1oMM1kRSjd7zYwAboi7IKYD_86aEU1tlIjOgpGqbAQRqH8EGxpZ1eXuU1dAVVL8kGbUEc2YWSaEV14OueFQvu8Ilr9rcpUxBDzMj55cbKLD_HMis5au6g_fzLim-Q&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 07:06:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame CDAB 41 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Byvb7qL0xt-f1Xdz_QxpgMbI0krkeulX6R6HwCDOgG5jzwcowsptq0Sa46asWdZtz1YuKnJ3e2UuCHeAPLhryr_ihZvikW3XELldf4wV-4OS52JOn1jFnNt5NVz3Gof63PiKLFdJy5OaMlkDQ-s-nUoyU8MmAeU25v_VTI56cNnUsZO4Q&cry=1&dbm_d=AKAmf-A7i0ivJ8B4ndsxmnaBBm5xuHgoo6L2mUEIJYNEbL0LlEXo4BETCsKZyd3QtLUAaK9WHe4JeO0HZtp87iXgHQqRF2loRElFweLyp76RNRzAQ6GdBALRsnYqqfs80Stl69SH2tkwgBp1GZiEY0rD5ON8ev1bVqAP8XIIZeec14sd8SlgIW8gdFGrEjhprDs1rAjgKX-Cozb0rcbHWSojDu-S9RApXvcvErd1yf0LeTdlRB0_vBwHyePHoPdSoBOqtw94dNLqarZJFj9rLnjDqpuM0es8dGGYDtGBkEEwjVB11X3FNNM04QRX__hQYru9nyiTXEt9VjUfC8Wrh01C-aojZdCci_Kg2ryqPo1-t3V1VUlqXoO44X_8XXKKvrjtkiIc4qC0DsZwIntvZ_bXnMWdvckShT6xzW5yht02TzoLyCUBCNr0UR3j_ZjUnVmErsVgmgdfK4jDkq84kqDs-rjRaoLQXnJG9PJwO-SDT6Hcy7lzG_Z-tXb5Ml8wWZaSw991UngHqrf7T9zcgztDhcTbPgpdCjF6G6IfaObnFD3qyPg3gdhFW5GFElV4nv9Yf53RaZcXzKb-q9wQTJubizL1_NjfRmojr-nSicb4qzrlkRXLxIRYd33zDE9jbAHZYxqWU73BTQqAbuXVsC5yOuPQ2GLVkD9awWkOBKK6WclPyR1O_94MgCBsMQEmnSXxxmcD9LZcZyznUqluksOt7CvXDfwmO-BdBQmb2BotknRvM9dbfSOfG-CQoxE_BOwWdRuJ1NwhsKJCEHnisjC_roDZc4f67Re_jcniUkXxKv_Yxcz8M_68ciMmBorzfsWFIeVizglf308FX6XQGpTFLPDS7sB9rVhbsEeUce8zLtORNDXojWT24ISLeXeUcHGKbe8TZGR4yXBNT4DCriOyP5ox1rkOR-xAdg35rW-q2pmrLFKILGa_NKz0FP5PTRYJLHs0qdIcN3fMZrLoVHSNz-AEdhSPxO3QvEyAblWSaAwG3y9OOH1oABzac04XLzQPQJrtQprCTIiUeq4rFGXC3a0v3IEfibXT7BpJu3fdpwZk1q-73Sya2Yt6Mv-qIm53rVUkfAWHoOxe0ipDCEopVyskr7AtxO_G5_FoTRnyIzHQIEXlyF6M7tP1XyHRLuCBGLFQO6ETLdTvEkxApF6Ae5CyPrHsIqbayTVuNVWibAnR3p67-HSnJ9wZvHx94u8SGEHO6Kc1eTsgV8NxGmsfhhbj7JOgtLuQB5Pxm9nn6p6GhYD30nszasMjUaNI0XvyOpa_TYs4iYLkeQC65G3RC7JXspgYXvGaPwzqLnRnSZWg3_TEqU9XZ93MjJhhQw8qnyi41U6dsK64vK1L0sW7PDwziDxdHV3iJQJaRfzOdue87BMRSigbrkOEyYm3ZGEedZW9H2BI4kZY87On0gtAlUSgORiAfCanSz1Ec6uzzy5Ujpzj-wGYOMqxHoXvryOfZvj_W3zV5MhSqsMpAiq9oeaJB_vdjbffx0a9pgu3jEP2ItPQiTbgngHSyE39-Uq50mQBw7MrsxAq5B48uDMjy_Rz-XX1j7Xj-2XSqIF_ewnW_KSA2b2yaShmw0ky5S80BEpPFQYDaDpqUWa4iEWUKL-pxfW_bazpxqalDos4ycYoiGNMvJx4XkkqV1DT9-Jr35uwThreKRylY5a6W6nrDGkLfPuv4addazAjIAxN7XvFc3wuFDaP0gauTyWi753y5Nw8jOglHoFFkOKM_lYiAnRkL7IFJPxjkzrG6RVHKp6_ZDXOuvc3OF198wyZHyfaXAz9YJHzffZfhiZO3fKFEOJvJRp39ys7UZjJ2qjXys6H9y2CsDGNIAoSJYc5cebxwkggzx2aUClN59gdglKaDD-5shTfKUsVNX9ukGhgP62SNm0APxBvDHB-9Ih-vT3FZxVsa2lBHgWHx9saB2gVXK3rnrJqvMLD2afIUpVsktU-sOfwgBTxih6eqCe-bdv7Ix2hKB4bhT-AYndhze-AYEWJH9lRWbyi2gNgBrtT4Ek4AaKGs_WINEGWVyTCjPM5GJqfcoF5v8G_ntHqTFY3XTNktgKFjccHVnBSZKEv_-A7RvB0OvbVGfGILuLInNUogIwANKgC9-B-2F8a9hjzy6libom-Ha0xJyAz8aCTbvtpOOnUTdqR-h5ZCv9YY9RztgqYpbO8oJqEKNY_8wvnJVPCCqRcl6OBpYivCLcH-GakiBlBTzubrQp-Lvuk-cl__b6nn6l2MTgte_wIKKp095dekzLZknk_FPzZLL9VzDniT_-jAEMnu-d2-9Yb2tBk65MMKMkutqH8haN2zAZh8In8-lNwtC5fcN8XpFF_O3K6zOuawpoHdwX2M7iAlsfWBsM5z9G_HWw4fJFo0gOMZ3xO0kpvXSQEnDCpUvnt1NmJ-xt1VnNU2dszVpCMjjocSwMTOfY9g-h2TbOH2gLwhwC8IHugGKx55sb9_D9MXcS_YzgNHP1srOuXSk9Uh5r6NWKJfqAVJTq-SJhNEK3N7Prp58-i-O0rDxJ0pY9zwLm40pgVMhlu-ixMYf3Y4H5moEL-VpMRMY3RI0UgkDKzKlP6AXkQv1rHg_B2OKc6kgEbA1pGMQ6951ntm4S3csG9UxQZCpneGP0JOS8NRoWSgm_Bu-2GYEkMzCTJO6MoNisqTSLuk9sCIjseGtBYUVQIfsEN5tZc4B6v5B6D78XxQ_jhN-m82sX7oOpmXKsPnoTPKGeG_tbPcLA3FxZ9RTGknT7b1q6gw4KHPHSYhIHnmM7GN0s5GX2CEeEOcG7Dlzkhu1igZupoL3sHAEg763yOooW0pQYdHFCw4lEBFXXMQ0NdhfQAxq2FYTWR3FcFJ1NSGCVghRN8GPRqI64slbk9hr0Hr9cYNd37G50C5eqFf-inex3bBST7KC8SoqCwizedtfdrg7rZdPzHlwiaO3qu84O8_IX0eeQBc3GMjL5aT8ThT2C3MUI4A58-4eAOSjgPmstSdNkM1YlTmUDA3uIVMFwLZ2QfBs_XnXthZ-qz4ZWhDFiBttknjIyCjWJm_38c_gkdvaXzAPZcpSGlIjuxPDXo6VmXDtd6v_24Bysu_LtBGAXSAizdRViH3-fOprTV9rXWPh1XaVKgJ6iESJsFOI2XJ3S3Uz1yesErWqOSZOJm6tkSty73SYPnEMOpGvC9juMGx5fS5083Zm831by0PCLIRd6xq0w0fsepcRyifxJOCPH-kNgpRFueuciVM9L0tPvS_5guQTCKyBmQZ5XaH319IqAuIAKNChCVlRfy-ew6skUyVg3ouDykb8f-eR2qwhD5U46V00XncwGvpdh17-vCIzMENWGnH3ZdS3T06Ovcxm8R7bZxqvK47BFkX3XLDbx6xFHgpaTSHaqs3UVDWZdNgF7W2e6RsvAU8OTebFp7Fj8TWf4gNLpX5OcRHuNw-wNCOtHIVOhH_jLspSp_65VS-qG5QjSOfUIzzyFkN8SGmPaXyibCI8W1lmQ9CcpyuAfSUNt4vP47HY8T14FBtigX2KT0ot2QcgSz1vIhhFL4Ne3SJktZVFQ0wIQoFdN15B_TpCB27jugHMRbIkqPJGEXTlj6&cid=CAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM&rfl=1%2Chttps%253A%252F%252Fwww.spokesman.com%242%2Chttps%253A%252F%252Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%252Fsafeframe%252F1-0-40%252Fhtml%252Fcontainer.html%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Fri, 02 Dec 2022 07:06:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 07:06:25 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame FB48 11 KB
4 KB 49ms
13ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 1783c21d09580495b853644256cdf0f0adb07b6aec1fedaa5a809d6a06aadc5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4144
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame C3CF 11 KB
4 KB 43ms
14ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: d1e7e4e9ed74c9a5a3c21805b22991284865f4838e177ac98aed7e29a010c0cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4143
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame 0853 11 KB
4 KB 42ms
14ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 7a5c7ff2f4ae40d88ee374e1decd327561cee25a66129a6f1540c79125d677ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4140
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame CDAB 11 KB
4 KB 41ms
17ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: c6ad017e60e5457c8f57a13482678e6b8ed1e1c36e9273b0723ebe392c91260a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4139
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 96ms
95ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNTc3NjEwMTgyNiIsImVidXkiOiIyMzEzNzk1NzgxIiwiZWFkdiI6IjQ1NzEwODI5NDAiLCJlY2lkIjoiMTM4NDE1MTcxMjE4IiwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuX2hvbWVwYWdlX3RvcF8zMDB4MjUwIiwiZXNpZCI6bnVsbCwic2l6ZSI6IjMwMHg2MDAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=fe316ce5-410a-49b7-96b8-905857f0f0d8&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536250&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:56 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B510 22 KB
8 KB 19ms
17ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 415174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 19:39:22 GMT
expires: Sun, 03 Dec 2023 19:39:22 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C603 22 KB
8 KB 17ms
13ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 415174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 19:39:22 GMT
expires: Sun, 03 Dec 2023 19:39:22 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9FC3 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 415174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 19:39:22 GMT
expires: Sun, 03 Dec 2023 19:39:22 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5CF4 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 415174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 03 Dec 2022 19:39:22 GMT
expires: Sun, 03 Dec 2023 19:39:22 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal90006.redintelligence.net/ Frame C3CF
Redirect Chain

https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

108ms
85ms

Script
application/x-javascript

138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: abdcb145a2887ae3ec7e3e0b7d08ba09765dd13726b30ee4ce61e58ab27f01b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 22540900075928304444550012167006
Connection: close
Content-Length: 1310
Expires: Thu, 08 Dec 2022 14:58:56 +0100

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Thu, 08 Dec 2022 14:58:56 +0100

GET
H/1.1

200
OK

request.php Show response
hal900011.redintelligence.net/ Frame FB48
Redirect Chain

https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

163ms
139ms

Script
application/x-javascript

138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8ad594d812eca6e5bbcdad531345aadb1684dd8ab8aecd260a1bc58999884640

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 64530200074707104444550012167011
Connection: close
Content-Length: 1311
Expires: Thu, 08 Dec 2022 14:58:56 +0100

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Thu, 08 Dec 2022 14:58:56 +0100

GET
H/1.1

200
OK

request.php Show response
hal90001.redintelligence.net/ Frame 0853
Redirect Chain

https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

107ms
84ms

Script
application/x-javascript

46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 24d3090452af3e8fd0a0202d5d813a8357bed1ad6ddd5083f542b7c057264cdb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 68509000082440504444550012167001
Connection: close
Content-Length: 1309
Expires: Thu, 08 Dec 2022 14:58:56 +0100

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Thu, 08 Dec 2022 14:58:56 +0100

GET
H/1.1

200
OK

request.php Show response
hal900025.redintelligence.net/ Frame CDAB
Redirect Chain

https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

102ms
78ms

Script
application/x-javascript

138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.84.245 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 84002ed8cf6047a2da48dbc9497b3922d7e255a9032919f2592f8fefdd473d11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 33732700075051904444550012167025
Connection: close
Content-Length: 1312
Expires: Thu, 08 Dec 2022 14:58:56 +0100

Redirect headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Thu, 08 Dec 2022 14:58:56 +0100

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame B510 36 KB
16 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 12:10:48 GMT

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame C603 36 KB
16 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 12:10:48 GMT

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 9FC3 36 KB
16 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 12:10:48 GMT

GET
H3 200 z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 5CF4 36 KB
16 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7cUAtzL1u1d_2AGWF4wFgnTveRSMJLcB1xcawACHJQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 12:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16132
x-xss-protection: 0
last-modified: Mon, 05 Dec 2022 17:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Dec 2023 12:10:48 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 98ms
98ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjpudWxsLCJlYnV5IjoiMCIsImVhZHYiOiIwIiwiZWNpZCI6bnVsbCwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9Ib21lcGFnZV9EYXNoYm9hcmRfMzAweDI1MCIsImVzaWQiOm51bGwsInNpemUiOiIzMDB4MjUwIiwicmVuZGVyZWQiOiIxIn0&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=9ddc4e93-e643-4ef7-b924-a8a9ce28b3f3&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536251&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:56 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 96ms
95ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjpudWxsLCJlYnV5IjoiMCIsImVhZHYiOiIwIiwiZWNpZCI6bnVsbCwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuX2hvbWVwYWdlXzcyOHg5MCIsImVzaWQiOm51bGwsInNpemUiOiI3Mjh4OTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=87bba661-e398-48f7-9327-7521d72a2693&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536252&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:56 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 / Show response
adv.office-partner.de/ Frame 6A6A 930 B
931 B 64ms
6ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Thu, 08 Dec 2022 14:58:56 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Thu, 15 Dec 2022 14:58:56 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 085F
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=22540900075928304444550012167006&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22540900075928304444550012167006&actionid=981741&produktid=&dt_url=

0
201 B

76ms
39ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22540900075928304444550012167006&actionid=981741&produktid=&dt_url=

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 08 Dec 2022 03:58:56 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Thu, 08 Dec 2022 14:58:57 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=22540900075928304444550012167006&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: B2A2D187:C572_91EFC182:01BB_6391FBB0_10500992:491E

GET
H2 200 link.html Show response
track.webgains.com/ Frame C3CF 2 KB
2 KB 135ms
62ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=22540900075928304444550012167006&nw=1
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: ad7fe7adf473cba7fb74cfe1dd50e5c9b2f3ead007d809da70a19014db0b90c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
last-modified: Thu, 08 Dec 2022 14:58:56 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Thu, 08 Dec 2022 14:59:56 GMT

GET
H3

200

activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757 Show response
5994599.fls.doubleclick.net/ Frame BC46
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757?

391 B
238 B

187ms
130ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757?

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

e609e4bf99fce48f0afcd69ab90064980af5990b02c6bcf4cd3f66723762c5bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:57 GMT
expires: Thu, 08 Dec 2022 14:58:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90006.redintelligence.net/ Frame 65EB 7 KB
2 KB 39ms
13ms Document
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=b167694eb8&subid=&uid=e70ddff351f2cdc9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCz_rqrfuRY-_0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Qb74A_CZKUGDBlOss3Q4j9n9j__l6tKDgCwvcEJ-89MAbqiofQU2w2NS9zZYTB1TvKaELggnUSz7TBT2prNksebTLVI6W_qXiN8lulCqTU9x9v9LPwyGlaEHZ0l8qd22GmSeX5Yk_aBiYQCSmXg1O536VX23Lsj7cyAvoqWZp9OGfoj2oW296VZQ5WNI9Ljp00UZ11_hd9M2Zluf6shQFdCCrIffVmP-uFlk8avwHqx4Fqz8MVH9rylX8n2nD4lqT8U5Hai38XIzd5SlqGH-vG7Gf17QmBEmEIuwIdMIgufrrSoYkE9zu5AGU28tAe1WLcOg-Rrew2fWpul2Y2I2f5DF-738mvFxTzQvUAFZHUQRxY3-XjL7ABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_1fNyFTnvk6TVzHi5OwEKjIYBVlaw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-B-SXq6CpbHgLH7c_Zqd3AmQ1Q0OMrpakOkkwUageKpAwi_LeZ4GOH2SACcrQJsyK_e2Z25QWjtwMd7LLJjOVMhJmsbjuyvLmFIwBTsb23o_127FydjEuW6K2qrtdGXut0QlYJ1adZ2wa2LguiwGKY_vTULLuLr4-THuQZDU_bZTqmmztY%26cry%3D1%26dbm_d%3DAKAmf-BG-VvKgkwxwPYoEO7Hdgq78qosYZIubIAaONbHCHDvwUJeXmvtk23t5xyS5ElkJI8YQWHTECT8XmP_IfoOo3a76ZhP8kqVaDYopnxBOXWk7NHUtKhKMko8Tqpdr4uGnjGRI-6mtqbkGV20xJLNao2_UO0wVGlGa_wJxDMqhwukAXGpMPJb7I5zTIHn7fkfbUYS2zRk1djryOHjZ390I2guAV6Oh3YhSEPjiDd8QjPoTyU-FPRSqABgv__MdOmKQsOjDsTVh2wQvcj55tuu4oiDDjskhn5X35xDVhEO4OQaw3dAevpIR7JqPT_bGsTyIm2YHy8u8OEPda4a_0lQWwFXnTnu46wu6y01a8UXc1nszeBGuH314B15H1PTLtnFW9J7fGfAJsOKUpn4m5sEtCCt7Lsk78CXsbgr1AAMbUzSscxJutIKnshmelN-y0ZfO-xKwHM3vI33QNXiRvk7lE7oozJh_7Euj81CU6pWMYLeTTy6KQrYzX1hRtivre30iUEvKjLg7Hpj-DZH4p-QtJPjPhFb3maPyAvT1GssBUhdf5ZToTk%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5178156891651&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c8e95eb5d7416051a371f694ac92ec53d148a6718f7768a69871c7b13518d651

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2065
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Dec 2022 14:58:56 GMT
Expires: Thu, 08 Dec 2022 14:58:56 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame C3CF
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22540900075928304444550012167006
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=22540900075928304444550012167006
https://ad-server.eu/wm/pb/native.png

68 B
312 B

173ms
29ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 15:02:17 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: B2A2D187:C572_91EFC182:01BB_6391FBB1_1050099C:491E
X-IPLB-Instance: 40027
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame C3CF 43 B
702 B 137ms
105ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=22540900075928304444550012167006&pv=1

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2 200 / Show response
adv.office-partner.de/ Frame 8D89 930 B
930 B 43ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Thu, 08 Dec 2022 14:58:56 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Thu, 15 Dec 2022 14:58:56 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame DD96
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=33732700075051904444550012167025&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=33732700075051904444550012167025&actionid=981741&produktid=&dt_url=

0
628 B

54ms
29ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=33732700075051904444550012167025&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 08 Dec 2022 03:58:56 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Thu, 08 Dec 2022 14:58:57 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=33732700075051904444550012167025&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: B2A2D187:C57E_91EFC182:01BB_6391FBB0_51F5CF9:4674

GET
H2 200 link.html Show response
track.webgains.com/ Frame CDAB 2 KB
2 KB 130ms
78ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=33732700075051904444550012167025&nw=1
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 3920cb18e8eefa95f33b5ccf2a841aa011c04f0359be68499b71c488e3d0df63

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
last-modified: Thu, 08 Dec 2022 14:58:56 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Thu, 08 Dec 2022 14:59:56 GMT

GET
H3

200

activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463 Show response
5994599.fls.doubleclick.net/ Frame A729
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463?

391 B
240 B

186ms
130ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463?

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

51133865c7110b85a32f163c87c7be46ae7e54299e1b58480f1f5d05f0e773da

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:57 GMT
expires: Thu, 08 Dec 2022 14:58:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900025.redintelligence.net/ Frame 7CCD 7 KB
2 KB 38ms
12ms Document
text/html 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=f799a98d39&subid=&uid=08827735d3a5e63a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC8kDGrfuRY_D0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QKWPMC75_YEos0EBP4nKyy3eEBGAxSJq_eUXsQFV-KjgEh19hebYj3p3nlcqcit6RYiHzzXAH1hGGEBnK29qTMxbq5_Qtus5NAaQUCyYLgDlp6AgW_DocO_lA0bbJiskEPhEBI_LgksMznlZvTEegjpIew1estx4_SMVonkBjc_bqS0mQ32jp375yzTuAObg6zhhnZ51Jdj0IpIixwSqf5J9r-Y2Z1fYh8moFu_w1rf5L_dyjQ5LQjIVYlQx8SfajSlGU-VlvGJmNnhal1fKA7TN6SxU4RceIupYViBM19gisr8cjT3G8EeE4vkOHhki86uc9_TBkgvNxDxRD7MiIJeXu_JCSlZ7Utoex1NMewFcJRnFk_4LABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KkmyOUsyQXlkpVHztSe6wX2vDIw%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-AIuafvo3SAE49ZExwGGivTlkQuRU089UvgZ3pBHAPVTgIQulX5khC1rRRqBvDp7HykqVQwrQaqFatb6EwxLNwawLxqduutKCAT7Ia9LroIed_Vfkwmj0sY6i_Xtgpg40rIyD8cGAdPNd4Tx5OqmQeb9idpUKVin_BdA0U0lyMHzxqKjoI%26cry%3D1%26dbm_d%3DAKAmf-AzjDMNXqP3eIbgwv8R0l_xiH4hfqKydt6cxC8paElMQ8zRHX0oLkpLucqbSBhNq3zZwvxfEtqY7xuNvCJWxGWCgivuiD0bpO0ZebneoZLzw7bPrbztBwVaMrbgVl4kKxumMv-kqijH0_mVQ5U8Sig0OVQSy8dHCPKYAJZtJTRqC9CCEzeO8t2rsIi_G24fiM5dT_nDrW_nQBUmwMNwBhtPiP6RTaaf4NMqkz66mds1XDypM7oDAuoM3jUTTgoU9al2_ns7GHVRBspCnX8jTEYe-aV2WBXF_Adi8FDOnGFV2q3lQ6s_OTGeHHaiwPreety4uIZcQm0i_Gzzlwi3YSOUye4dXW7uFsat68U5aOpBli1PKiBdNXei3N4T3gWgPD-TagtfhV7pI_6m6tT_gyE0j8edLzna9M3Le6K9BJ4jFSCttmrXhO6GVQYke1yWO6QKfHx3eB2q7LfYHUXNzzpq-f_I5E5GOWA7Hhut1r-fXM9Soq5I2i32KHevs6APTlnc4YKgXw9HHvE9yDN0CBgkodfvu-apz39uFY7R88bIm45myCI%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=5975012852202&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 2dbc8a0cccc106b56776f916728244166258a5d16c6d1a9b89ff2738eb2d39a3

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2066
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Dec 2022 14:58:56 GMT
Expires: Thu, 08 Dec 2022 14:58:56 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame CDAB
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=33732700075051904444550012167025
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=33732700075051904444550012167025
https://ad-server.eu/wm/pb/native.png

68 B
312 B

159ms
32ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 15:02:17 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: B2A2D187:C57E_91EFC182:01BB_6391FBB1_51F5D01:4674
X-IPLB-Instance: 40028
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame CDAB 43 B
702 B 58ms
41ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=33732700075051904444550012167025&pv=1

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2 200 / Show response
adv.office-partner.de/ Frame 8065 930 B
930 B 39ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Thu, 08 Dec 2022 14:58:56 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Thu, 15 Dec 2022 14:58:56 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 8C19
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=68509000082440504444550012167001&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68509000082440504444550012167001&actionid=981741&produktid=&dt_url=

0
200 B

51ms
30ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68509000082440504444550012167001&actionid=981741&produktid=&dt_url=

Requested by

Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 08 Dec 2022 03:58:56 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Thu, 08 Dec 2022 14:58:57 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=68509000082440504444550012167001&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: B2A2D187:C58E_91EFC182:01BB_6391FBB0_10500995:491E

GET
H2 200 link.html Show response
track.webgains.com/ Frame 0853 2 KB
2 KB 104ms
57ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=68509000082440504444550012167001&nw=1
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: f4241b80ff94c6736eb9b237328471b943d164337caf5845581ba060a61852ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:56 GMT
last-modified: Thu, 08 Dec 2022 14:58:56 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Thu, 08 Dec 2022 14:59:56 GMT

GET
H3

200

activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577 Show response
5994599.fls.doubleclick.net/ Frame 0BA8
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577?

391 B
240 B

185ms
129ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577?

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

7863cda02f94f8d1aa7a4214af8e329991dc802a109709c2d0fecd2f801c4eb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:57 GMT
expires: Thu, 08 Dec 2022 14:58:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90001.redintelligence.net/ Frame A66A 7 KB
2 KB 42ms
15ms Document
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=34edbc52c3&subid=&uid=0173c72fcc5a91a7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCGoO3rfuRY_H0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_Q2TmDzNg5t-UMExELFyKnkRIKIetEjLTzH-i9KZQzHMfw9J8_xKbO2YwWEZKH8PBzPjuK7kP3Zog8L7Yih-Vo7khltlcQ5aOxJyh1y3l5HdnDLpn7rYE95EuYnNUsMgnq-TFCNugS2TE0oq6iRNmC9sNfe9ZHjB6wqqcoAh-UcY42BNdoFDqtDZb6XQUXfbGoKsA5PT6p4Vvix9Wt-AdYp6KuBvAk8EmToK4xkGNEn5OXDGVPLYdZ0LLcuB0wu8F3H3n7K_XVP3O1ZVvtFfCiHQeqJrJWxSCiRh8XaQ4PLehStXWMIX-89_g19m1fL8nLejmMviWAzfgQ8kMsMjnHuGxvejM6K8PsWWVtj3lJDeQjiUrTX7fABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2KOvlBZb11Tdfz2hhd11NLya4Fig%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-BLA2bAr0fZnN7qI9tS3OsaOVCgDuL6eK7S9ifldReC_PLectB1jafC7JlWWwSajAqxvC_V4jLeAmA1GOL3bLLjdIEaZNcgSsXIb0f86PI47NHINYYKe4l4ooogF7rNEk9cVyekL40TWqywzbuw8bjxchP3G4sccmjUyChlTDh0eEwZ7J8%26cry%3D1%26dbm_d%3DAKAmf-AtC2W1-g3n9pchkInfdav9B7TIE2qJ76mSbT0ysfJZLSbRnhMhByCzXN1qiuQzoZswWYDz0coRWL9qtrUb_-ggQxldeskR1-U-sfMqcMipxJ6etUCJ9tkx3mQtybNZYRV5chWvGJBTLc0o_D-0WA6rOIsvAF6JZ4DKL2yNJlbcuSpx5HoIfsBQkFOo4YGH7a35cx-JMa3K0_Umu5s9WBvrpGqGPV1CFEnUD1en8ApQmMOp3AVEdfHPgb1EvlGVXiElabIwQUTvmX3ZZgNYmffXI5h25jugUSmka6cXt3TJ8qL8VjTTkGrwDJgWz2bX1EH3h-3TvY2zE6Azi1ubl3PiNy1kE0g51yO4yQd8ioQFURU40VVnprYrSH7X_peBFwXIifl-tZUlG4d6LRtM80psVer1AbJcrSNUh7PieR3oNy-4F3M2U7bo__vrj85jkgur0Yptwe60PhofCoQhPCQL6F54AhPLp13CAxYn4AVi_AevUV-804h_irJ6yTh4u2rj0whp32138piT8InA0qQ_LTmlPBYc79mM6CJp9hUHNHVjmw4%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=8865865705091&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 2a7f8310cd440fe2e8b9ad27fede6c29b7cf4cb862eafe0f4a2208a236be3c65

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2062
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Dec 2022 14:58:56 GMT
Expires: Thu, 08 Dec 2022 14:58:56 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 0853
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=68509000082440504444550012167001
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=68509000082440504444550012167001
https://ad-server.eu/wm/pb/native.png

68 B
312 B

165ms
29ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 15:02:17 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: B2A2D187:C58E_91EFC182:01BB_6391FBB1_105009A2:491E
X-IPLB-Instance: 40027
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 0853 43 B
702 B 83ms
69ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=68509000082440504444550012167001&pv=1

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:56 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame C3CF 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f9f33140a5716d675e6325648a1a5980dfcce885abeac1496f65177444b20282

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CDAB 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01ea4b3df7245318b9d78edffcab3e2aa714136425847e9175064e17e9bdcb63

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0853 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 23f0ccce6055153cd9aff9c51eb4b4304ac5cbbced0fde463a7a67e249e8096e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 65EB 1 KB
419 B 52ms
24ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7f24d5e431e274a8d8c196752f7ab87ff9c636de1a7bc3d9c44729c1a87570a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 13:01:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 65EB 9 KB
9 KB 36ms
13ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/627x627_Office-Partner.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: ce11e780efc514f36a4d80a5a135e54beb6cbdb41b887fce34ab1ad61eed498c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:56 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9287
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 65EB 9 KB
9 KB 36ms
13ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_627x627.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 7ff609fe748db8104189dc0eba5aaf4b5fce8d42bd7f91b6e397adaeba2aa096

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9363
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 65EB 7 KB
7 KB 36ms
13ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native4.png
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 00cb4fc5f70558fd84c4ccf5fc6477c59c3edfcdf6c1664942677751b560dd48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 7130
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 7CCD 1 KB
419 B 34ms
24ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7f24d5e431e274a8d8c196752f7ab87ff9c636de1a7bc3d9c44729c1a87570a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 13:09:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 7CCD 9 KB
9 KB 36ms
12ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/627x627_Office-Partner.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: ce11e780efc514f36a4d80a5a135e54beb6cbdb41b887fce34ab1ad61eed498c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9287
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 7CCD 9 KB
9 KB 36ms
12ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_627x627.jpg
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 7ff609fe748db8104189dc0eba5aaf4b5fce8d42bd7f91b6e397adaeba2aa096

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9363
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 7CCD 7 KB
7 KB 41ms
14ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native4.png
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 00cb4fc5f70558fd84c4ccf5fc6477c59c3edfcdf6c1664942677751b560dd48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 7130
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame A66A 1 KB
419 B 27ms
26ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7f24d5e431e274a8d8c196752f7ab87ff9c636de1a7bc3d9c44729c1a87570a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 13:03:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A66A 16 KB
16 KB 37ms
14ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: f9ab0998daf244f7094c0a6941897a877c8c9bc769e027d5e05e86fee45c7621

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16550
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A66A 16 KB
16 KB 42ms
16ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 36e7af491251c0a86687e4b5d489c4006f9a26d85275f1af910f85f1b61ab191

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16269
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A66A 11 KB
11 KB 55ms
15ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 0fb1e3aae8ed295f9e219aa4f2c6920387e350c723beb7422232e96075457541

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90001.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10954
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 / Show response
adv.office-partner.de/ Frame C197 930 B
930 B 7ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Thu, 08 Dec 2022 14:58:57 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Thu, 15 Dec 2022 14:58:57 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 62A0
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=64530200074707104444550012167011&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=64530200074707104444550012167011&actionid=981741&produktid=&dt_url=

0
36 B

28ms
28ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=64530200074707104444550012167011&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 08 Dec 2022 14:58:56 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 08 Dec 2022 03:58:56 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Thu, 08 Dec 2022 14:58:57 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=64530200074707104444550012167011&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027
X-IPLB-Request-ID: B2A2D187:C67E_91EFC182:01BB_6391FBB1_10516D2D:491B

GET
H2 200 link.html Show response
track.webgains.com/ Frame FB48 2 KB
2 KB 89ms
88ms Script
text/html 18.133.50.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=64530200074707104444550012167011&nw=1
Requested by: Host: www.spokesman.com
URL: https://www.spokesman.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.133.50.153 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-133-50-153.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 47600c595fb2a305b8a705435ae947f28b6ccc3b23f79e2179c2ea5174a16cd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:57 GMT
last-modified: Thu, 08 Dec 2022 14:58:57 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Thu, 08 Dec 2022 14:59:57 GMT

GET
H3

200

activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954 Show response
5994599.fls.doubleclick.net/ Frame 1B21
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954?

391 B
237 B

126ms
123ms

Document
text/html

142.250.185.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954?

Requested by

Host: www.spokesman.com
URL: https://www.spokesman.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f6.1e100.net

Software

cafe /

Resource Hash

5b94d40d15fc2fc7c6bf597209655292729ade79767d5800def3d2e6f279035b

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: br
content-length: 214
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:57 GMT
expires: Thu, 08 Dec 2022 14:58:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 08 Dec 2022 14:58:57 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900011.redintelligence.net/ Frame 0FC1 7 KB
2 KB 35ms
13ms Document
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=89a84c7ac0&subid=&uid=02c009bc9255bc20&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCC8jXrfuRY_L0GaCR7_UP9bi76Amm5b2gaYWVnKfJD_AuEAEgw6D8AWCVwqaCsAfIAQmpAsPVbPxmprE-qAMBqgSYAk_QSDeTpElCQoYBpFBnqgpZNnisjjfkU33R2ckvUooXhNwZotZyPmYLUxDNmuPVUwaAUb_CENhQ94Z-NWwwZB9d9DiI4rD8Kp-m3FCDVH-BYLDK9ToHdtYYZvxHJ0dOImahZlPwxIfzePfgLzschlZYel7o3LnBNc0zie2eR6f9wzmJrF7RZDR0NBd6toM_jfGc3Hhdr-CuEejakXoCgxvbGrOK6598qa6fv-LchRHV1KQkymqwzz_6UAJ_vq7bHnGKMpScphTaf1vfDnp0S8BDThYq58lv0ESDqCiPZlipMO47t8IkDEIAZxeu474Ykq3dQuvtzZEho4skxAuXyCVMaO3mhqDBz3G5mnK7vQB8NO2TB5T9hPjABOuP_I73A-AEA5AGAaAGTYAHrK31nwOoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggRCIDhgBAQARgdMgKqAjoCgECACgGYCwHICwGADAGwE4-10Q7QEwDYEwPYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSSwDq26N9w6jwjZMNTfZCpkDZsjc56QAh8STZ4dgfKAe-XNTZ7KnxULcmeUMLCklrsSK-mwjyDMkXDv4S40cxjkdtzOWWGvYi3K0ncxgBIBM%26sig%3DAOD64_2TAm7lnEEFeIFu19v67g4eLvciTA%26client%3Dca-pub-9779652122014728%26dbm_c%3DAKAmf-CaL29AIJXDSZP0TJnCFmAYgW0MEdF_FFlwLdJgpG_ohb2Ly1s9r_DjGJIiDrLTEglby2iihIWBjuckpqSrxp6JDFzLlXCQLywUAGPaPLYuBpzFcJ3jEbdS6sdxeLJXinnT2NWqFInCwJqXQfi3Zy_wOWAxCIEKKZJkYFfCceh9bCav3tc%26cry%3D1%26dbm_d%3DAKAmf-AcObEX5234QNOvWIYiQ4xs_LqTuUsWY43yIuRtrmGjxXoLMDpaD2VP3J8rGnq_lg9xyd1uqJX5Xc-EYEItaiqI6eD0z8uCE89_SV4dclL8UCiZdmfQP248QRM6Ye4LtLzIgBGZg6ewQv8G6zTd45EcyQ0fcS_iGK1tUyBYn3JOKDMcUDia41mGb3b_qi7Wc7RXcez41tj5c7zo9YYTuBvF2dfFOXcV83xU0ecRO-a03M8qZEAx4DZ_AlG4rhTn7ef2ULomw-a7UsCyT4PBPIs1I5LkwU6k9Qd4GI7r2DxQ4DU3yAL6Is8qt3yzrS9lsVw7u4hyxKfQEU6IgPzD4L6-yiML_iDY8fqP2hlbyPwA9waRNzF-atePQbwq_p-zMRDkPmBeNEFpiAKtzC3b4SUiNdGmaGPfpTtUaZHsWEJ2eILjOVZj0fZnyo-rVBLRlJxBapBjrdjhaxK6mVj_hhAOE7r-m_i0O_Xu5lVVpKMuy9f77kIXSrkFpxalSGburcjEQgI2DjYKfFurBgbEm0KxDAbdoR3EE76sw3zgL8ueisOzPC0%26adurl%3D&documentReferer=https%3A%2F%2Fefe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&ancestorOrigins=https%3A%2F%2Fwww.spokesman.com&random=930122363849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 935172ff533d09eb63415f2559ae576c01b8c58b203c477fc8d0b0e348057a07

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2046
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Dec 2022 14:58:57 GMT
Expires: Thu, 08 Dec 2022 14:58:57 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame FB48
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=64530200074707104444550012167011
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=64530200074707104444550012167011
https://ad-server.eu/wm/pb/native.png

68 B
312 B

150ms
30ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 15:02:17 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: B2A2D187:C680_91EFC182:01BB_6391FBB1_51FC73A:4673
X-IPLB-Instance: 40028
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame FB48 43 B
702 B 84ms
84ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=64530200074707104444550012167011&pv=1

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:57 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 6A6A 102 KB
39 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eefb88376fdf02202306aa917197657cc9cf0db45ec37252847aa11a3a6825e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40302
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 8D89 102 KB
39 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b26fc6d3acad11b990846eefefd3bccd0171a0dbed08449647a1bbf42f07a065

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40293
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 8065 102 KB
39 KB 47ms
47ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eefb88376fdf02202306aa917197657cc9cf0db45ec37252847aa11a3a6825e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40302
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 97ms
97ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjpudWxsLCJlYnV5IjoiMCIsImVhZHYiOiIwIiwiZWNpZCI6bnVsbCwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9ob21lcGFnZV8xXzcyOHg5MCIsImVzaWQiOm51bGwsInNpemUiOiI3Mjh4OTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=5dad4076-e660-4df4-adc3-993bfb227f5c&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536253&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:57 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
DATA 200
OK truncated
/ Frame FB48 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09058072a7ec566e3818fd89ff01eb86b15b7a2c2833c388c0d7e5d99033f0fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B510 0
20 B 166ms
165ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BWim-sPuRY9nDF9STjuwPtrS_QAAAAAA4AeAEAg&bg=!mZqlmt7NAAYgquz3AKo7ACkAdvg8WpU8kQIsonK7gs44aPfpCrgSenU2UUi19n_kwr3cqzVdHadrBgIAAAEDUgAAAANoAQcKAKmRxRkW_A_czS8kxMj-Fvu0QbST-owXTENGHIdDQp0AsSZRI3q8sJ_WkyZYWo915diuqtgQQzLLAjtaZ8PCyH9HwBI0o4Hh383c0jzuEy3AYjIMmhV8XwalW_oyGrbhZ8aZtFYCR6Ol-5rKIl4YXDwrNg_fvbC5Xrv9r2OUBHtEjZgiiym2obQTJkhQU0m6OVNA6Zcgiqs3MY2GGA7kWYa9pPnNg8iyJQJ_mQLnMk15Zxpqm3UfVpINcg1P8pwDymlkYlVA60TaHspYl3fm-Fp1kKqV6Ly38oeDtY7kpKV8OEqDVUBp7GAFR6r-A7ElWX7UfljPc6Ylh8VwsbL99y977fTMP3gUxLxMNTw-EuQ8Ig4DaeTBc-5ZY33DFSF2zQkZ9-RbSJAcgNTbXDyzpahHPlo1hvoLv1LiKV2DONL35oFw6CiW5MLHMUBfC0Z5tTkB6s1UBcDEPuuJc5ZXc-EHu3F3QsWVLdkaLD_A4m2Pz_r0akAaMvVZXY-8LT6CJERWRfI5a4hWT-TELdAbMFFj-pAzvpe2gbKrQYBtz-ostp0-HvSPSMr2z1e7IMFNAzzrFDHZNEVmm2EECcuOHGKmjYy2hMMhl6n9CJoceZrpAyG_LbG1lO7-UzNtousfUTbQxIn2d57gm3xcH8vsRaG_qNhNFXX0eFo8eqXdZBCc4FFKH8DNnxqPnEiG-LN7VAyP5f31RFRwL15cmSb2UQtt5Bok6D0qvt0M9-05EQU7uzFHW1Hh7gRHe-g0m4yWFnaA3em15P4ERpN0x2op9G6lXdi-jG7hBM-gqtsTKoVKunwSmwy39phJKmcaBN75KQ6jdeOpt9Db0gIKbS1FmTkBDchlp0HUVPNYecyBsQwpFs1emqdfL1BICiBYzGI-lkx8jJ-U0OqQCEKd98kNAaMC-yM97TclwTdDneixFjvt4ZE2ChSUZVVkj0DisK2X332TmM0JFGtAMSiMkLuDyxzxYdbJ8lNZznlQeqFpJAq33bnNl5TEVn3GWkDPp0laQLrfwrZfYpw-WH82wj7wRQhN7P9Y9wMWitHuhH-iV05bu-CvwbEQROepnOJ7S_nduUUkOr9HZinE8n7bZ3A_NHb5W3FWXvLgUmmpIu0ScKWoCDhXeIKCJGFDq4RrFAWshc6wOx44JFGcn6-Lg455tsMM4wlhHYw1lwYBN9isNZEirTk2H_xYcFSqeQGkbd62NLGD7V0

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90006.redintelligence.net/ Frame 65EB 0
150 B 47ms
12ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/viewability?s=22540900075928304444550012167006&a=33035e0c&vb=m
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90006.redintelligence.net/request_content.php?s=22540900075928304444550012167006&a=a9a9d17d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK viewability Show response
hal900025.redintelligence.net/ Frame 7CCD 0
150 B 47ms
12ms Script
text/html 138.201.84.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900025.redintelligence.net/viewability?s=33732700075051904444550012167025&a=c64bce79&vb=m
Requested by: Host: hal900025.redintelligence.net
URL: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.245 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.245.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900025.redintelligence.net/request_content.php?s=33732700075051904444550012167025&a=3a58bf00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C603 0
20 B 165ms
165ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdxZ7sPuRY5rHF-ew9u8P8_eK4AkAAAAAOAHgBAI&bg=!gYKlgsbNAAYgquz3AKo7ACkAdvg8WjDh2_LUOxP8ADAxjLeo62dAdcRvr2mRylKJyJjiw85y0V7eEAIAAAEvUgAAAAJoAQcKAFzjHOai5EdbwoxosVWweMS2mFyCT7Sc8_Jqwf77By9WLZku5OFLgjWrsVk68gdLX7ix9AyWmtmbj36ZNnj89L5-jZnZ1CRGp2gReNcOLc-B8XD0gs-6A4QIFi-BopkC-FH60LAxktM6BZgGKetj-p379DCLxt2x6v1DoYLv9_IowyJuKIUP2e7yJQG0E9VE3wBJMh2j7CiStwC5-E9oRjmZ5wG828sUFHBrl2GfR90WQclJgqCAxl05C9O0vGZy7PS4b5wcZJt5KoAZc7NBvryfRrP89ls5W4IYVq4pxNcoO_7Sz2PPmtNKIclIYbS5h0PzevhMflQBr4OUczuk02LwEDazMI1fjHy7Prlrubo5LyA-5AOlwQBqK5EhVljsmayu_UYg2Y0qgyqMGWI74FQYppJEzL0SQ1V0kEglX-hSNy3Jxm7YAZHRyAmIHsdcoR4dH715tefvEziEU0IllDjBI4-Mm9bh5fDD9HhI06CNA8gQlu_AsOb1h2wSBo29AXvqwcOI6WFYNzXru8NJ6mxpb68uhkCiIpXWOI0ydmsr-Tr0lOqEOgWX6MyJzegWa0xqPfGGFe9jx0xM_nK0xv0dLIxL-jLbtUdbp0GPE4sct0Zs05MkqMUi6hYPZTwTzoQwJBqVNer2jvuXUn7tlFjBMqNT_doXVx0piYenLDjIvOCjhFVzkx13Mb987SA4ksGOKRDyjIQWBtnqzv8qJ_Gu-p37pyMKtaPYfVnYbyTcQ-H2ZBLgArsDWL-8nqmrEsRx2W6gdQHSQ_8U4pgeVOHXYldC4Hpc7M-JkxWTBdctifTFno51OS1rq7Dd3KDhzoYVZD-aYsQsVhXycT9RfHTF1jRbes7QYVkp_EvaUVkyxTWPVgCVi4pe_zOQ4Ab2DjU-Gug_d7oAm_0Wr4Lw2KOU27ntPRnMBXdRr4kHJQBXShcyH64iqPP02biYKjTsOnzPSFEf6zevROXW_sqap0qLu83zS_ot2bg1TG00b-oE5SrtjuQiXxkM08cgvlTVCd06U7hL9ztU4U40nfAh3GLtsqOxMKQDMGA7x4NbuNZDf2D8pUUoszU2ZY93c1lR05j5jS_mLV8-D_2jeoIV3aFu2UtuL20FhFpdACLm4Wvm6T9HLwUthtE

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 0FC1 1 KB
419 B 34ms
34ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7f24d5e431e274a8d8c196752f7ab87ff9c636de1a7bc3d9c44729c1a87570a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 13:01:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0FC1 9 KB
9 KB 47ms
12ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/627x627_Office-Partner.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: ce11e780efc514f36a4d80a5a135e54beb6cbdb41b887fce34ab1ad61eed498c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9287
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0FC1 9 KB
9 KB 39ms
12ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_627x627.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 7ff609fe748db8104189dc0eba5aaf4b5fce8d42bd7f91b6e397adaeba2aa096

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 9363
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0FC1 7 KB
7 KB 39ms
13ms Image
image/png 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native4.png
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 Krefeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 00cb4fc5f70558fd84c4ccf5fc6477c59c3edfcdf6c1664942677751b560dd48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 7130
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 0853 85 KB
31 KB 74ms
8ms Script
application/javascript 65.9.66.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=68509000082440504444550012167001&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-92.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 20:21:54 GMT
content-encoding: gzip
via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 67024
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: AiMPS8DyXxBqRwZJnOtf3oHzutu3VDdLzEJ1TM4q9HD0QuGwfsNb0A==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 0853 85 B
436 B 61ms
10ms Image
image/gif 13.224.189.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1670511836&Signature=pfKWixreMMbozwRun5EeudGBEnsyRd6XMGQ1CUxVasWzoAUHBu8kr8BiS5SXrcVsSR~lFT0YPtIprs9FH4mB1p-lqc0PdoDlNHQ9oDxqegFTTQdqLjKl223g1dCSbhxgnBL0QpFmBf3ym62DBNOJ427PjCNxcYLla70QOzwK4XeE~N3RBZ1OnAaS-fW9XlTcE4tsF2IKgwJbxnxeHaVTn1rq5wk0oDH2jAJdgHMcFm64t~hZoh~EHEwjuh2sColrSetMEBWRv3FuHeyiGOQDYDalU8q2NjeGSWGjm0zfT9J9eyD8yBM0C5B-8ozXEFPes2lD666SnVzYq7mq-sFdVw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-47.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 08 Dec 2022 05:01:49 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
age: 35829
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: u9VLma9zGbylMyptQvH5d40jLrUJuLLSbK6u9SE9wXdkuivIvUoTcQ==

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame C197 102 KB
39 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f4f3326e1fab52c09c1d538ef934c5b4e340e5ded11e2a5d0cb9b96e6d7743d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 14:58:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40300
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Dec 2022 14:58:57 GMT

GET
H/1.1 200
OK viewability Show response
hal90001.redintelligence.net/ Frame A66A 0
150 B 42ms
13ms Script
text/html 46.4.10.49
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90001.redintelligence.net/viewability?s=68509000082440504444550012167001&a=a0f3b4ff&vb=m
Requested by: Host: hal90001.redintelligence.net
URL: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.49 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.49.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90001.redintelligence.net/request_content.php?s=68509000082440504444550012167001&a=27bf4309
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame C3CF 85 KB
31 KB 74ms
15ms Script
application/javascript 65.9.66.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=22540900075928304444550012167006&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-92.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 20:21:54 GMT
content-encoding: gzip
via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 67024
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: v7KCdbqMQktqWjWuph4rULAnc2USTzFhFN9FrgkbzHu5cUTX_r8YbQ==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame C3CF 85 B
436 B 53ms
10ms Image
image/gif 13.224.189.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1670511836&Signature=pfKWixreMMbozwRun5EeudGBEnsyRd6XMGQ1CUxVasWzoAUHBu8kr8BiS5SXrcVsSR~lFT0YPtIprs9FH4mB1p-lqc0PdoDlNHQ9oDxqegFTTQdqLjKl223g1dCSbhxgnBL0QpFmBf3ym62DBNOJ427PjCNxcYLla70QOzwK4XeE~N3RBZ1OnAaS-fW9XlTcE4tsF2IKgwJbxnxeHaVTn1rq5wk0oDH2jAJdgHMcFm64t~hZoh~EHEwjuh2sColrSetMEBWRv3FuHeyiGOQDYDalU8q2NjeGSWGjm0zfT9J9eyD8yBM0C5B-8ozXEFPes2lD666SnVzYq7mq-sFdVw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=22540900075928304444550012167006&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-47.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 08 Dec 2022 05:01:49 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
age: 35829
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: DGOK7TijE9FluuRJtoNa3jmBNOEGhO9UhTgKalq1fyS4NRvWxYoPsQ==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame CDAB 85 KB
31 KB 72ms
16ms Script
application/javascript 65.9.66.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=33732700075051904444550012167025&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-92.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 20:21:54 GMT
content-encoding: gzip
via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 67024
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: uHZnZ-1bdAVVLqjcNEo-xd3CRcMu_ZBR0W_tDVxaoAHck5TsqtK4nQ==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame CDAB 3 KB
3 KB 50ms
9ms Image
image/png 13.224.189.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1670511836&Signature=g34T9LAUPJ12pNSoCEKYFsb0qy~DTfMvJ~01JhsETjo2B2SKe96SdhLkZy2102Fn-VW1h6XWFnBN8aY19~fGlb8Wip14p1~X97sZOfQxSKD0c144dj05hShfKlc5RJa4b7Zb9YOqHyGmVKZhFxU0UJYsG~3NuVGTwWt6lunQ7qCbJgvCpZuGRlmOKIeiYk~oszT9cAdFJiyB3yEvqu8LyD-SCDNXpM38fFJH8jvk2Y8oEOT3zmv3aPFQG7OAHgoxVvjBmGWnc0jO22pzn-Wp46jkLPwacSl07wHqm3ghXcp9JoBfVuRHM0JVuSy33~K4MLYiyFbNB9Z~W~kMGEHOKg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-47.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 08 Dec 2022 05:22:51 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
age: 34567
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: sy1WnqFfKGdgQYM8O-kL9GZ8Q21Wlrl30RToqJS4Dghr_bZkMiAq4w==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9FC3 0
20 B 164ms
163ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BB9rTsPuRY46zGJaT7gPU5KX4DgAAAAA4AeAEAg&bg=!oaKloubNAAYgquz3AKo7ACkAdvg8WkKZRpGdjjbjCJMyIawMxKhk7ozSegUjW9zNzbKAE4qL2EJxlAIAAAErUgAAAAVoAQeZAv9frDvOwfoYKFNh51NExTATHCJfjLB4PwBcBdN5Kw-q-yme2AWKyifz7-XgNMM5p1DvKdkJl7ieGFn688FzaniH_kF3RQTPdHCTfpM0wvJduUQcTvTejXJMwDP1Cvn8pyxejUzvT16P4qF4AESVPG3uZLQch5fQBPUz4MLeoPg9xBSirR9mRId1xTUYU3-174e92tyw61eSoCyh0cDhFDUDsolrOA-iSitcIcdVlsSGyCWQ0z-ICXUevBRVdnv70DBZVsZQOGd9ndFKOAtm480r3GdHVvvHI8kBpR_z0K0AnuI0YIlRHpCmrYSIgzEjWoprXuKjW_6Jz6aSoqzMZBa6QjPqhTfCrgCJul0-N6aghZUoBCjmLJVK95JGq8OicIA9wLTMlty0elkJFMF7UAdhclHxnMs7WFvgF6K8w7BeNgXILpmRdhP9SEYI2wn1HpGadZREnYnk2IOdLrGU_7YiAOtIhtbQSqOXuWqliKiCuQurP_Xd6WYuAKO0Kxipe0c_RTrl__KeBHakm0gieDqstrMiOHyUdm1SLrIppnQQrkzAfK6pYq4mFnQ_K6mQTe983gCVdTNTx-SzcQkz71m881gJDiTzS2TWBH1nNIXuYYGxABXQzWXJiMFb8lxCF84TyRFObnEAaw0OrFwYVlFEaWSSoxulQnDKC_y0tuVFNjeW0AgYP_rRVotXDQGneYaeNyYkRauQIMTqGC-pYW7tBiHJKQF1DBZPxXtUcDCC3CZWcUz_RUtrY-Bp1QoB23nb0ANt5InHvZNLEwqtO9_JyuvYy1PxYKYJPCSVZJ7in0Dne5P6mPhtCVRqteeMEDseDdi9-vJo1L9p2i-BuIuFMVeOVYQZYSoJIxwLpDznHKhT_GrAGX1Fxu5e60758sqcuC8b_zAQNxX2oELiWMQQdDoQiwSVeN2xQNiG3qUKl2gZZgSO7vMIEwrNYf94VA6HaeIPgcGnybJgeXBbgdDE18YJFnIf2uBgWeaSkM-QEmykaAZJ-w47syeVqThSig

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5CF4 0
20 B 164ms
162ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B__TKsPuRY-bOGOin3gOfqLo4AAAAADgB4AQC&bg=!FBelF1PNAAYgquz3AKo7ACkAdvg8Wh7jfrxEDSljyYce1CHenuErtDL280ifZLRp8tKGJ48T454OrQIAAAExUgAAAAJoAQeZAuuLq-mQ5tCQNG8wXEApNQwQCiHjc68tKtf04ZTlD9OML2yYMTPs0GWGI0ZvaBPNlIJXrpTxPjlgH5M1n01ChcOAmsFzqCm94FPZQd0nFMPulQTNWpfF1erHWyU1t01u-vOiK375A0XkZWpu1qjaZ13VKJGiAmmmli0zb2Wbntn7i9haucY73C2Bdwz5KQP8VJKvkZgTYgipvFM7ZvpBh6a_0F24hBPCSgFwfXnmvF3HCqmhXyZiDTeqHVb1YapIT8K5b34B19vWSfXwlqpCwKov4keW50rqmZw0WOQx6LiZcGhMZfvku8g-vI5SIxnh3sqU4_Cq--nqhqTw8yemZpypLF3lBYfb1-HfX7hIigtKzFv6uW5PfZHkbW7YeKQJHoj6mjglk5wwCfG_WpNt3HVSeTeryxzpo2OgRMDSZfj6z_MbDk7I6yoYzoh2TAFfsUG_2-zjvcANzW5tVNmQQLazlNE5Sh7KOeiVT3RSOFOoWdUP0PeOLF3gt3qpEh_aHnRoWXoiWPZNhc2-izd0Xyfe_tKHygNeGx11DZDhY74TOFQJB5YocZ5-OSMxTC4guEZBJMFzysLhv2q8yZZgxCIp2QrwjYMdb41Ii72sIR2PoT1ZJfqX7OODH6ge6TAcEXmV8htLKrB_SrcA0kuAYuhR17in-rCO5CO7tdUJVgIoW0SvqDiiHGcm6EmzFL2KIxDgMeMM8CAYOftMESQBqcgU0Eu-nbU6Clu5oVoZPldq_Zlrei0NPqO4_UVI-7BVos9smyiys5fhX3nt1bOw6K4cTNji6-ehyCH9i4c9CXnKyaJ4V8KcDXpeT5b-7HSDfoSXA2eTcoTRRi4Pkv6FZw9YsnJQZgZtw_FBQXV3jWqPn2I40_LeN-mms_368FL-k0-JJvR5_ZxUZJcRoteHhjZRCM22y3wPiWcMV7LhlBx9Er2ij9-YpxOwkRyjsOi4PghoMpXSghiQmrby_TKPKmFvLF6Jh4Ql9lQVXLM

Requested by

Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900011.redintelligence.net/ Frame 0FC1 0
150 B 38ms
12ms Script
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/viewability?s=64530200074707104444550012167011&a=febf05c2&vb=m
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/request_content.php?s=64530200074707104444550012167011&a=dbdc2c77
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:57 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame FB48 85 KB
31 KB 15ms
12ms Script
application/javascript 65.9.66.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=64530200074707104444550012167011&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-92.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Wed, 07 Dec 2022 20:21:54 GMT
content-encoding: gzip
via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
last-modified: Mon, 31 Oct 2022 15:47:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 67024
etag: W/"faa933973c404f8cfedacd4b67a60b85"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: Ncmtde2rUz3UsOniby-mBwRWwF0j3u4v4BNh32gkA7IcfjsCRuE7iA==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame FB48 3 KB
3 KB 10ms
8ms Image
image/png 13.224.189.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1670511837&Signature=hxnC~9QaR5L-PB1ScB-CckwLXKYdBpvBFM2vuYAXFe8mfCbBXzl79IvjAv4Co2oau2VOQkNfZrELUHV8kSlO~6Rs3WFoVYc8WdRJc~mzUG2AYw2UmQracY3Pa43lRSETk90NNCMqibsUwlWesaPVGPVc7TCcKhDyGF8TBBimKTPbAfnzsEksyLZI5lZSI0dDgmE~zEwF4vK65LTogv4eHEs3hlxIGMw0dzMDqo25sE~31mbFmdRGYk~R31DvkSdP3kinz-JbSntuPH3MEu39QxUB8-ND2mTkxnTu8Y2waxHlH4mmvgvj08SM79yzdvNkXnAU80fxBM0vWzLPbhsSwQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
URL: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.189.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-189-47.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

date: Thu, 08 Dec 2022 02:31:34 GMT
x-amz-version-id: null
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
age: 44844
etag: "4e57de0506fbdb487ffcd53b450caee1"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: pE3hUnbenlPH7n4kfAEftUueMpsEBxgKAxJNTNy0w996bCBzweSwKg==

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 97ms
95ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjpudWxsLCJlYnV5IjoiMCIsImVhZHYiOiIwIiwiZWNpZCI6bnVsbCwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9ob21lcGFnZV8yXzcyOHg5MCIsImVzaWQiOm51bGwsInNpemUiOiI3Mjh4OTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=497e7123-faff-4034-9f51-25bee750efbe&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536254&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:57 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577
adservice.google.com/ddm/fls/z/ Frame 0BA8 42 B
63 B 188ms
157ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CILahLak6vsCFYVCwQodSC0ETw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=97264311343.36577?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463
adservice.google.com/ddm/fls/z/ Frame A729 42 B
63 B 184ms
160ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIXUhLak6vsCFc9fwQodSmkONA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7789510651624.463?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757
adservice.google.com/ddm/fls/z/ Frame BC46 42 B
63 B 181ms
162ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CMnYhLak6vsCFccswQodkWgCWA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5051723223269.757?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
245 B 97ms
97ms Image
image/gif 34.224.131.223
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjpudWxsLCJlYnV5IjoiMCIsImVhZHYiOiIwIiwiZWNpZCI6bnVsbCwiZWVudiI6ImoiLCJlcGlkIjoiLzEwMDk2NDEvU3Bva2VzbWFuRGVza3RvcF9ob21lcGFnZV8zXzcyOHg5MCIsImVzaWQiOm51bGwsInNpemUiOiI3Mjh4OTAiLCJyZW5kZXJlZCI6IjEifQ&tv=js-3.0.155&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=20&tid=7ce1abef-2bbc-461d-aaa1-f5feb48d2a3f&pid=97bd52cb-3d4d-4f2f-95dd-83d9533262ee&dtm=1670511536255&qnm=_matherq&visible=1&tabid=4ac7da3c-4174-4218-a566-1a6d09547f31&url=https%3A%2F%2Fwww.spokesman.com%2F&vp=1600x1200&ds=4000x10174&tofa=1670511533&vid=1&lvidt=1670511533&duid=a630d369-4d7a-42cd-870f-76ceb8da6bbd&fp=2294459535&cid=ma20153&mrk=575681700
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.224.131.223 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-224-131-223.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date: Thu, 08 Dec 2022 14:58:57 GMT
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954
adservice.google.com/ddm/fls/z/ Frame 1B21 42 B
63 B 158ms
158ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLCAjLak6vsCFeRCwQodkxYFkQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2223957093120.954?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A736 42 B
64 B 189ms
157ms Fetch
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuX2l5_v6B6fi6FcmiGJQWeUtt5Vy-_KlSLT0XBjf4uzB9_tUzL5IJu5gcv0Z5Q5FC6NecZpK4ZvtnZn1SEUlCzW3k_d-ekNWO0hZ0JhrMjBurULmfp&sig=Cg0ArKJSzP9ovWMab0BFEAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221207&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=1337061979&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1670511536195&rpt=189&isd=0&lsd=0&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Dec 2022 14:58:57 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK views Show response
prod-spokesman-proxy-connext.azurewebsites.net/api/ 90 B
1 KB 336ms
335ms Fetch
application/json 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=7e5e004a2181915365b97b5f29d70470&ConfigCode=SPOKESMAN&SiteCode=SR
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash: bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

source-system: Plugin
site-code: SR
autoqa: false
accept-language: de-DE,de;q=0.9
settingskey: null
authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NDI1MTE1MzR9.KALwEjNrrSZWFrXsws7yT5ejtFAdMYEWdNN-4TYpBSI
ssid: 0b5e6cd5c96cff8bda5ee024bcd7fcea
environment: prod
config-code: SPOKESMAN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
content-type: application/json
access-control-allow-origin: *
accept: application/json
location: System
Referer
version: Version: 2.8.3.3

Response headers

Expires: -1
Pragma: no-cache
Date: Thu, 08 Dec 2022 14:58:58 GMT
Content-Encoding: gzip
X-Server-Time: 12/8/2022 2:58:59 PM
Server: Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET, ASP.NET
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Server-Time,Request-Context
Cache-Control: no-cache
Content-Length: 193
Request-Context: appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019

OPTIONS
H/1.1 200
OK views
prod-spokesman-proxy-connext.azurewebsites.net/api/ Frame 0
0 475ms
144ms Preflight 13.85.16.224
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-spokesman-proxy-connext.azurewebsites.net/api/views?UserId=7e5e004a2181915365b97b5f29d70470&ConfigCode=SPOKESMAN&SiteCode=SR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method: GET
Origin: https://www.spokesman.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Access-Control-Allow-Headers: access-control-allow-origin,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 08 Dec 2022 14:58:58 GMT
X-Powered-By: ASP.NET

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame FB48 16 B
232 B 68ms
67ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-11-196-201.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Dec 2022 14:58:58 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 78ms
20ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Thu, 08 Dec 2022 14:58:58 GMT
server: nginx

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 68ms
20ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Thu, 08 Dec 2022 14:58:58 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 0853 16 B
232 B 66ms
65ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-11-196-201.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Dec 2022 14:58:58 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame C3CF 16 B
232 B 71ms
70ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-11-196-201.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Dec 2022 14:58:58 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 52ms
20ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Thu, 08 Dec 2022 14:58:58 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame CDAB 16 B
232 B 66ms
64ms Fetch
application/json 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-11-196-201.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Dec 2022 14:58:58 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 36ms
19ms Preflight 3.11.196.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.196.201 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-196-201.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Thu, 08 Dec 2022 14:58:58 GMT
server: nginx

GET
H/1.1 200
OK ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 631 B
1 KB 121ms
120ms Image
image/jpeg 52.216.20.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.20.40 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

Date: Thu, 08 Dec 2022 14:58:59 GMT
Last-Modified: Tue, 15 Oct 2019 13:44:16 GMT
Server: AmazonS3
x-amz-request-id: FQ592M0VDB5SJCBX
ETag: "ef2cc7f55b7ab677b023e36033e26471"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 631
x-amz-id-2: ZwYxp8NCQIaBCQBS0U4FyRbiMfJbr8D5CY3nd7QvRN+J5kh/xh8ixVjixPfoDHPBqPS9l9bV2Yo=
x-amz-meta-s3b-last-modified: 20191015T134358Z

GET
H2 200 index.js Show response
cdn.czx5eyk0exbhwp43ya.biz/ 7 KB
2 KB 8ms
7ms Script
text/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.czx5eyk0exbhwp43ya.biz/index.js
Requested by: Host: cdn.pranmcpkx.com
URL: https://cdn.pranmcpkx.com/prod/spokesman/t8y9347t.min.js?2022118
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CBD) /
Resource Hash: 6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 08 Dec 2022 14:58:58 GMT
content-encoding: gzip
content-md5: nynBpfvYghYqzIzsvfssRw==
age: 98053
x-cache: HIT
content-length: 2382
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jun 2022 17:08:13 GMT
server: ECAcc (frc/4CBD)
etag: 0x8DA5083F65AD9E0
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
x-ms-request-id: b7dd90ad-d01e-00b4-0731-0a3b70000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 14ms
14ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1987337483&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2F&ul=en-us&de=UTF-8&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterLevelSet&el=%7B%22MeterDetermineMethod%22%3A%22Dynamic%22%2C%22MeterRuleName%22%3A%22Home%20Page%22%2C%22MeterLevel%22%3A%22Free%22%7D&_u=aCDACEABBAAAAGACI~&jid=&gjid=&cid=458713268.1670511533&tid=UA-230256-42&_gid=1940115392.1670511533&gtm=2wgbu0WQTQTTW&cd1=1670511539246.sis33irq&cd2=7e5e004a2181915365b97b5f29d70470&cd5=Not%20Set&cd6=Unknown&cd7=Free&cd8=Not%20Set&cd9=Not%20Set&cd3=Not%20Set&cd4=Not%20Set&cd10=Not%20Set&cd11=Not%20Set&cd12=Not%20Set&cd13=Not%20Set&cd14=Not%20Set&cd15=Not%20Set&cd16=homepage&cd17=Not%20Set&cd18=Default&z=1688102989

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 23:43:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54919
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 13ms
13ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1987337483&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2F&ul=en-us&de=UTF-8&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ConversationDetermined&el=%7B%22ConversationName%22%3A%22Homepage%20Sale%20Promo%22%2C%22MeterLevel%22%3A%22Free%22%2C%22ConversationDateStarted%22%3A%222022-12-08T14%3A58%3A59Z%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%222023-01-07T14%3A58%3A59Z%22%2C%22ConversationPaywallLimit%22%3A%22unlimited%22%2C%22ArticleViews%22%3A%221%22%7D&_u=aCDACEABBAAAAGACI~&jid=&gjid=&cid=458713268.1670511533&tid=UA-230256-42&_gid=1940115392.1670511533&gtm=2wgbu0WQTQTTW&cd1=1670511539435.zcw89jzi&cd2=7e5e004a2181915365b97b5f29d70470&cd5=Not%20Set&cd6=Unknown&cd7=Free&cd8=Homepage%20Sale%20Promo&cd9=1&cd3=Not%20Set&cd4=Not%20Set&cd10=unlimited&cd11=unlimited&cd12=2022-12-08T14%3A58%3A59Z&cd13=2023-01-07T14%3A58%3A59Z&cd14=Not%20Set&cd15=Not%20Set&cd16=homepage&cd17=Not%20Set&cd18=Default&z=1211610466

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 23:43:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54919
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 17ms
16ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=1987337483&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spokesman.com%2F&ul=en-us&de=UTF-8&dt=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=PageView&el=%7B%22Page%22%3A%22The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington%22%2C%22ContentType%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Free%22%7D&_u=aCDACEABBAAAAGACI~&jid=&gjid=&cid=458713268.1670511533&tid=UA-230256-42&_gid=1940115392.1670511533&gtm=2wgbu0WQTQTTW&cd1=1670511539542.vz01etfp&cd2=7e5e004a2181915365b97b5f29d70470&cd5=Not%20Set&cd6=Unknown&cd7=Free&cd8=Homepage%20Sale%20Promo&cd9=1&cd3=Not%20Set&cd4=Not%20Set&cd10=unlimited&cd11=unlimited&cd12=2022-12-08T14%3A58%3A59Z&cd13=2023-01-07T14%3A58%3A59Z&cd14=Not%20Set&cd15=Not%20Set&cd16=homepage&cd17=Not%20Set&cd18=Default&z=52046011

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.98 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Dec 2022 23:43:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54919
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: certify.alexametrics.com
URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&time=1670511534259&time_zone_offset=0&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fwww.spokesman.com%2F&random_number=19465555833&sess_cookie=f6770f78184f23f20b36fcd20db&sess_cookie_flag=1&user_cookie=f6770f78184f23f20b36fcd20db&user_cookie_flag=1&dynamic=true&domain=spokesman.com&account=TEMji1aUCm00qs&jsv=20130128&user_lang=en-US

Verdicts & Comments Add Verdict or Comment

131 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
comcast-accountupdates.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9637806220b58c587cf59955ba18286b
www.spokesman.com/	1970-01-20 16:47:27	Name: flipp-uid Value: 2cd811d7-62d6-4a5c-8fe7-e02ede19bc6d
.spokesman.com/	1970-01-20 17:37:51	Name: _ga_G3BY0LGVDL Value: GS1.1.1670511533.1.0.1670511533.0.0.0
.spokesman.com/	1970-01-20 17:37:51	Name: _ga Value: GA1.2.458713268.1670511533
.spokesman.com/	1970-01-20 08:03:17	Name: _gid Value: GA1.2.1940115392.1670511533
.spokesman.com/	1970-01-20 08:01:51	Name: _dc_gtm_UA-230256-14 Value: 1
.spokesman.com/	1970-01-20 08:01:53	Name: _sp_ses.53c5 Value: *
.p.flipp.com/	1970-01-20 17:37:51	Name: gid Value: "Xe9UhwAARSESduZjAEr5FQ=="
.spokesman.com/	1970-01-20 08:01:53	Name: __asc Value: f6770f78184f23f20b36fcd20db
.spokesman.com/	1970-01-20 16:48:53	Name: __auc Value: f6770f78184f23f20b36fcd20db
www.spokesman.com/	1970-01-20 08:01:53	Name: _gada_ses.e3de Value: *
www.spokesman.com/	1970-01-20 17:37:51	Name: _gada_id.e3de Value: f0f565ee-c31a-4c43-b934-196e6a932802.1670511534.1.1670511534.1670511534.17c5ae3a-7877-4335-a45a-91df477d7291
www.spokesman.com/	1970-01-20 08:03:17	Name: privAu Value: 0
www.spokesman.com/	1970-01-20 16:47:27	Name: ai_user Value: DsJmR\|2022-12-08T14:58:54.333Z
.pymx5.com/	1970-01-20 12:21:03	Name: _ia_uid Value: eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.gUX9Bfvu5GH48N-_T-C6R4_r1I2J2A-MO4bAMn5GX0t1yrWGTX9H_w.xMzCpA6mshbbQJf6.ZwPPavPqMYKbJARTkfBaZCQ5iMG3V-KwqsA_siWEwv_oH24oMO2u7GzKdp22mlfCDmZD1WfE8ZlClSOPgeUbITS2Cm4mR4A-jnW6IDybaXPyiVV6XbU3GWrNFr3L1FuD-B7yEEA49z8UJtv16Tzv01_a56BHzAjbxwKlii4-_lcT5Welh9m8aac5nxZdN82Yf7gyGO17R7Pdf68Dw5BvXkBWIrbMiMoY9Aiy1j-di94_Ux73fanJiKAOKoBMUURZ_I7XGXfUz24XLfUBL8CoTUymMyjmU-I3Bm4Vc-zQwjqDxEtOAw0gdL7wHI_rbu42WoHUa79xGqz4BIRDRACQhk6UB0viMLQPYSbWJIEiS2Y.nEsSKSVaX0pVAaMHb317eg
.pymx5.com/	1970-01-20 12:21:03	Name: _ia_version Value: 2
.spokesman.com/	1970-01-20 17:37:51	Name: anonDeviceId Value: 7e5e004a2181915365b97b5f29d70470
.spokesman.com/	1970-01-20 17:37:51	Name: nxt_last_visit Value: 1670511534829
.spokesman.com/	1970-01-20 08:01:51	Name: _gat_UA-230256-42 Value: 1
www.spokesman.com/	1970-01-20 08:01:53	Name: ai_session Value: uOx0x\|1670511535061\|1670511535061
.spokesman.com/	1970-01-20 17:23:27	Name: __gads Value: ID=2283de6ac22b03c0:T=1670511533:S=ALNI_Mag7-CfjsKdURikgWEvAxz_B8xFxg
.spokesman.com/	1970-01-20 17:23:27	Name: __gpi Value: UID=00000b8f84a5b5cd:T=1670511533:RT=1670511533:S=ALNI_MZxdruUi1Ebko7hOpjDraPzQkm09A
.spokesman.com/	1970-01-20 17:37:51	Name: _sp_id.53c5 Value: a630d369-4d7a-42cd-870f-76ceb8da6bbd.1670511533.1.1670511536.1670511533
.doubleclick.net/	1970-01-20 17:23:27	Name: IDE Value: AHWqTUnxZE_EmMVqkPgvvOsHDTRYCp7EMXMrp6cn53wvAQDRp9_Tg4ipK-xd4DOolkw
.casalemedia.com/	1970-01-20 16:47:27	Name: CMID Value: Y5H7sNtQpiPLe0qWjhIl1AAA
.casalemedia.com/	1970-01-20 10:11:27	Name: CMPS Value: 2159
.casalemedia.com/	1970-01-20 10:11:27	Name: CMPRO Value: 2159
.adnxs.com/	1970-01-20 10:11:27	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In1C5r^D!@wnfH8K6pQK`!5=E<L5?%LhfB+TV1/0Bt^NRDUdHu26EeLFC!yWIo+enzbpRzqF1`b`p*Hr/T
.adnxs.com/	1970-01-20 10:11:27	Name: uuid2 Value: 4711569881497593112
.redintelligence.net/	1970-01-20 10:11:27	Name: 8lcfmzhxc8d6_uid Value: 353dd8a1ed18fccb
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 357526:3266505
pb.media01.eu/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: jngt0pgiafknm2thz2pvppzf
pb.media01.eu/	1970-01-20 17:37:51	Name: DTU Value: A41694BED67BFC021AB267B24F65E433
.awin1.com/	1970-01-20 08:03:17	Name: awpv11601 Value: 113440\|1670511537\|d71ae0a0-7708-11ed-89a3-223851067267
.office-partner.de/	1970-01-20 17:37:51	Name: source Value: {"webgains_webgains":{"timestamp":1670511537180,"clickCookie":false}}
.spokesman.com/	1970-01-20 08:03:17	Name: nxt_upd_ac_SR_SPOKESMAN_PROD Value: 1
.spokesman.com/	1970-01-20 17:37:51	Name: nxt_SR_SPOKESMAN_PROD Value: {%221%22:{%22100132%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:1670511539323}%2C%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:%22100132%22}}

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js(Line 9) Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network	error	URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=The%20Spokesman-Review%20%7C%20Local%20News%2C%20Business%2C%20Entertainment%2C%20Sports%20%26%20Weather%20for%20Eastern%20Washington&time=1670511534259&time_zone_offset=0&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fwww.spokesman.com%2F&random_number=19465555833&sess_cookie=f6770f78184f23f20b36fcd20db&sess_cookie_flag=1&user_cookie=f6770f78184f23f20b36fcd20db&user_cookie_flag=1&dynamic=true&domain=spokesman.com&account=TEMji1aUCm00qs&jsv=20130128&user_lang=en-US Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
other	warning	URL: https://cdn.ampproject.org/rtv/012211060024000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
aamcf.aamsitecertifier.com
aamcftag.aamsitecertifier.com
ad-server.eu
adservice.google.com
adservice.google.de
adv.office-partner.de
analytics.webgains.io
api-mg2.db-ip.com
api.aamapiv2.com
api.pymx5.com
api.webgains.io
az416426.vo.msecnd.net
cdn-gateflipp.flippback.com
cdn.ampproject.org
cdn.czx5eyk0exbhwp43ya.biz
cdn.godiciardstia.com
cdn.mircheigeshoa.com
cdn.pranmcpkx.com
cdn.track.production.webgains.team
cdn.wgchrrammzv.com
certify.alexametrics.com
cm.g.doubleclick.net
comcast-accountupdates.com
d31qbv1cthcecs.cloudfront.net
dc.services.visualstudio.com
dsum-sec.casalemedia.com
efe87061ed71d84fbcc69e56fa89539d.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal90001.redintelligence.net
hal900011.redintelligence.net
hal900025.redintelligence.net
hal90006.redintelligence.net
ib.adnxs.com
js.matheranalytics.com
loader-cdn.azureedge.net
media.spokesman.com
medialead.de
p.flipp.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pb.media01.eu
polyfill.io
prod-spokesman-proxy-connext.azurewebsites.net
pv.medialead.de
pymx5.com
redirect.prod.experiment.routing.cloudfront.aws.a2z.com
region1.google-analytics.com
securepubads.g.doubleclick.net
spokesman.com
static.spokesman.com
stats.g.doubleclick.net
sync.teads.tv
thumb.spokesman.com
tpc.googlesyndication.com
track.webgains.com
us-u.openx.net
www.awin1.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.spokesman.com
certify.alexametrics.com
104.111.239.217
104.75.89.75
107.178.250.234
116.202.48.214
13.224.189.14
13.224.189.47
13.32.27.65
13.69.106.211
13.85.16.224
138.201.63.164
138.201.64.38
138.201.84.245
142.250.185.102
145.239.193.130
164.92.121.13
172.67.75.166
18.133.50.153
18.66.97.129
185.80.39.216
185.89.210.153
2001:4860:4802:34::36
216.58.212.162
2600:9000:2057:ba00:2:4597:5e80:93a1
2600:9000:206f:8e00:14:c3e7:6780:93a1
2600:9000:206f:ea00:13:3ce1:5800:93a1
2600:9000:211e:8800:1e:dc88:cb00:93a1
2600:9000:21f3:5200:0:b5fb:e6c0:93a1
2600:9000:2250:8600:18:730a:3f00:93a1
2606:2800:133:206e:1315:22a5:2006:24fd
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:e2::ac40:8a04
2a00:1450:4001:800::2008
2a00:1450:4001:801::2002
2a00:1450:4001:802::2002
2a00:1450:4001:806::2002
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::2001
2a00:1450:4001:810::2002
2a00:1450:4001:811::2003
2a00:1450:4001:813::2001
2a00:1450:4001:813::2002
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2004
2a00:1450:4001:831::200a
2a00:1450:400c:c00::9a
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:800::282
2a0b:4d07:102::1
3.11.196.201
3.134.45.248
34.224.131.223
34.96.74.203
35.227.203.93
35.244.159.8
44.239.110.109
46.4.10.49
52.216.20.40
54.76.176.197
65.9.66.92
88.198.250.30
94.23.99.218
000cb4237204c839588365b865b4ceb28c4d78ba054f6e5a4c7a5e25f36e0c9c
00cb4fc5f70558fd84c4ccf5fc6477c59c3edfcdf6c1664942677751b560dd48
0142ef55c5af25d3f3d64d82452dd49d65607fb2af864499dacbc13723f6cd25
01ea4b3df7245318b9d78edffcab3e2aa714136425847e9175064e17e9bdcb63
0446b3d21c708650eabdbf78880d18f828bd8b25fa401ad0af1af18357887c65
0497e7fd8dd1dc131af40093ce8f0a954258b1354ac591c2fe2168cc194a33a6
08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
09058072a7ec566e3818fd89ff01eb86b15b7a2c2833c388c0d7e5d99033f0fa
099dab513d8ed4fe5dd80830bd52cbbc4c66a14eb7c96c620f0f64a6ba771f62
09eacc18cf8458811d1dd4c785c22ae8c9a677c8eef092de5aaf74ea1fb05910
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0fb1e3aae8ed295f9e219aa4f2c6920387e350c723beb7422232e96075457541
106d2473e20f19c11c7b0657f3c199fefff0e4a9607082794f2a595ec0828e53
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
14b1ccee1733f555c9ef4d552ec5c1062355e6249e7ec3158f7b3675b76c45f6
1783c21d09580495b853644256cdf0f0adb07b6aec1fedaa5a809d6a06aadc5f
196beb31539e747bdf66ddcf9d5f7255eeb42c14210786cb0a93ddbce4664d2e
1b1c3ea8b3d9fec1913ac70c81c83f2172acc41988e747bd24d22bf779fd19a0
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
23f0ccce6055153cd9aff9c51eb4b4304ac5cbbced0fde463a7a67e249e8096e
24d3090452af3e8fd0a0202d5d813a8357bed1ad6ddd5083f542b7c057264cdb
24e40e41c0e6fe3bd70a4250ff3295ee60f5f37aa51be1a27ac65ef6c520a091
2a7f8310cd440fe2e8b9ad27fede6c29b7cf4cb862eafe0f4a2208a236be3c65
2dbc8a0cccc106b56776f916728244166258a5d16c6d1a9b89ff2738eb2d39a3
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
30834c905f6c208cb431997f0f2ba7d2a931cce8ed852be18fc891bcf18533c2
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36e7af491251c0a86687e4b5d489c4006f9a26d85275f1af910f85f1b61ab191
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
3920cb18e8eefa95f33b5ccf2a841aa011c04f0359be68499b71c488e3d0df63
3f4f3326e1fab52c09c1d538ef934c5b4e340e5ded11e2a5d0cb9b96e6d7743d
3fbb19ea0d1bb2bf9b1574c539f9b140d76e57b14a3f6fec34eae9e444922a32
428b19348f218a44e36bd16a007cc9a5b16598f3575812a81a715a6c04ff1112
44c448205f15c4f82a4dfe267d5a2efac45224543d44a7c073b167813d449fce
44d3c23c39b40c70cbd13bb24e0c8696aac11d9950562eb08911b726e7d5ac82
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47600c595fb2a305b8a705435ae947f28b6ccc3b23f79e2179c2ea5174a16cd1
492f490d3a8cae053f8ab9f525210cfcd792987a02d65783aa81ce4edf926fa2
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e15f46414b61320359c479eb44c53a8e7fe70449496f1ccb9c333110446384d
4fadae71f3c2f14c2cd88ec732d986d60eff7fd57262407a045444a31536e688
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50f940612dc804e5128485a7ffc8376a0f72c2eefd5b67652c983a984244c3a5
51133865c7110b85a32f163c87c7be46ae7e54299e1b58480f1f5d05f0e773da
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
559ec07592f3e0a895f5c551f2a7dd4a3f3f186c2f55a9e18018aea530715f0b
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56fb89289ef2a4f7155b1ba99dbe7610be9d7b14c028c388a91d3f79fda97948
5a2aee262821f014d61d9949b24dd6e194a702ae23c9e3661824e512e550ec09
5b94d40d15fc2fc7c6bf597209655292729ade79767d5800def3d2e6f279035b
5ba65148259568967389d182b434f97e0da7b6cd83abf926a602433a340ca9d0
5e84ce936bc3e3844a5d9efb3ac7d28107fa17234fa2a6c2bf3491fc284f0d4f
5f0e58e4c8d23cb8d1453aa9d362f102a4676085ab517acfd34aba74f982d3db
60c7e6d31c1080b0da38c4a95915fc9e80f765f0ad2b7d3fd9874807a197b2e7
6126af5a92030a0c3f9880647dba6ac1aa41953a2f581282928f65df8415b8aa
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
6150a35c0f486c46cadf0e230e2aa159c7c23ecfbb5611b64ee3f25fcbff341f
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
633a42d7b9a7d6be4093abd56ea850f09a93ae5c252f6b9b8e405b0802dae6ed
6653d2cca03c490c0032cd74205c6c37a494ea31ac1c46aec8e55c7017c1b3f9
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
6a9f3c83892833387d92f857563b6f3cfdee0277cbc648a932a2718e000e9e42
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6be85d90ed98c809aa47ac8fe2e2ec7d1844bd785a6de5a2429b6ef2b2116c75
6c93730733907482175a577286c9085cbd3bb91de98bfbdf7e01d5aba2f90e57
6dfc02a8e6f295102871d721f23120a13077e491345a93614fcbb43867de3301
70b6ebae8045d591c0eb83c422f733af18f29d583d470c2f92bb3d4a993bf5a5
71180ea527bbbc698fefdd43b4cfab76568f1a8683eb5ffca1bb19bd874e0e5f
73ab848de7be32a42e9b6b3b9cc34115e15f89c4b9ab8e4ccfdfcc2d80935728
74689bad3b4f480bc6f076adb9927c63e872f5a1b9c675a92be9a13f9d3cf349
7645b6975525c1d68eaf5af383b3041880590b1690206376799151c659639674
7863cda02f94f8d1aa7a4214af8e329991dc802a109709c2d0fecd2f801c4eb3
79fc30a3a4b255c915bba01c0691a5653ec71151821aedb5147898821927e362
7a5c7ff2f4ae40d88ee374e1decd327561cee25a66129a6f1540c79125d677ba
7f24d5e431e274a8d8c196752f7ab87ff9c636de1a7bc3d9c44729c1a87570a2
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
7ff609fe748db8104189dc0eba5aaf4b5fce8d42bd7f91b6e397adaeba2aa096
81094275f0be20d938a47ebde3ad55e55c156cfc9415413ab5ddcaf1adad9976
81ca9adc11006f012270a2cc65f40126d00eb6489d0c6aed6c57497988ddde8f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
836022001bc413eb8342a1faa30188ceaf2b047fbddbaf2a7b8b8ef7de18c5f0
84002ed8cf6047a2da48dbc9497b3922d7e255a9032919f2592f8fefdd473d11
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86a2a3999c65a6ee0bbee35ac7515f04856e0fcbcebdffd56001c0dc924d887a
8ad594d812eca6e5bbcdad531345aadb1684dd8ab8aecd260a1bc58999884640
8c1a344926bccb4d4e452226a49165959e6498a9bb0eedcd99597db6218feeeb
8ee5f53d3752309af021002b2199a06523b1fd03f3ea1cdaf5d59e911d4d8178
92aae892248a7997424fb418031fcb8eefa9cbe7bb00e9e96b6148450d7744b0
92e134fc5f7b95ecae60d856975d7c01b4fb512dba2d55d38cbbebcf549cdf96
935172ff533d09eb63415f2559ae576c01b8c58b203c477fc8d0b0e348057a07
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
9dac1d36fc662c8e423e957e22ec91373848e205b95d1b848a9b8a665396932d
9e7def328adf929a00e7b4e4e2efff635850ee80110756f82924c75a4fc77393
9ef65f1d4b3ddf07c3960a578d532f8aecd6b9d551631b2611596fb652480a9b
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a01f9f2f5ba1812441a49f7f1dc0b04fb56a18b486005289b8df4212381f10ce
a1ec2afd03d9367f5f65faaa6aab1c544f8e3c7aad498b83c9a449f8c04a000c
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a77ccf47a61b8eb1d83a4101826726c3b2b0e5b34eb9f2601785b4d1e513932c
ab2e65cd767ab27b65e3bd2f97ffa0163af196c8a0eceb292f5d57527c9adce8
abdcb145a2887ae3ec7e3e0b7d08ba09765dd13726b30ee4ce61e58ab27f01b1
ad7fe7adf473cba7fb74cfe1dd50e5c9b2f3ead007d809da70a19014db0b90c0
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b26fc6d3acad11b990846eefefd3bccd0171a0dbed08449647a1bbf42f07a065
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b77e3040e4042c61767c86102e6f357df41b4ce53f74ebbc9dc242dad5cd873a
bc2c387a887f40dbb73e526b6213be9cedd527ec7b88d51b497070d97e231c6f
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
c0b59c362ae740c391e742fa4517d90b9461b416b9bec855d14c04603dbaf71c
c3f73b989e0620a4d2e12ed57a0d538e4580b8fefaa1fefbad73e0abad6d227f
c6ad017e60e5457c8f57a13482678e6b8ed1e1c36e9273b0723ebe392c91260a
c8e95eb5d7416051a371f694ac92ec53d148a6718f7768a69871c7b13518d651
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
ce11e780efc514f36a4d80a5a135e54beb6cbdb41b887fce34ab1ad61eed498c
cfb71402dccbd6ed5dff6006585e301609d3bde4523092dc075c5c6b00021c94
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d1e7e4e9ed74c9a5a3c21805b22991284865f4838e177ac98aed7e29a010c0cc
d4890a3c7a6d70985e71fb7178c58b8c3ff183e6edbb3f07a41affe5b897d3ae
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d89cb9800cc62dcc44a0ba866b4a080ad06f735f60a6afecbd6d691d2e8939dd
d8dbbae580c58c196ffc607e708cdc72551544526793f0ef43deae8c75ac07b0
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0be1d222e2e367ac5106f4aee4830c3de18af1d266f8cde53915e11e8b01bfd
e15f20e9ef9afb2d807e387e719bf1e183ac72a1ff378d2b28f79cc33efd9ae5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e609e4bf99fce48f0afcd69ab90064980af5990b02c6bcf4cd3f66723762c5bc
e6b337e169cd1e85e4eec5a27ae0d3248af7229cdaa03459d174373eea2affa8
e93c85341a48fbccd80f6d316b0d45b3b951169f4390adfb5cf81609f4160d45
eb0029d2c2174b61e565a3d3882cd758e09254301bd9291c82c46cb23d928195
eefb88376fdf02202306aa917197657cc9cf0db45ec37252847aa11a3a6825e3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef251f34101684f464a829da3b73f211bd0e7aa009685d7a9e8baa8d4ee1de16
f35ff183302d0372ba0544afc65be2611aa229162a3c7de35cc920deb6e4d9f7
f4241b80ff94c6736eb9b237328471b943d164337caf5845581ba060a61852ef
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f9ab0998daf244f7094c0a6941897a877c8c9bc769e027d5e05e86fee45c7621
f9f33140a5716d675e6325648a1a5980dfcce885abeac1496f65177444b20282

www.spokesman.com Open in urlscan Pro 2600:9000:21f3:5200:0:b5fb:e6c0:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

269 Requests

92 %HTTPS

46 %IPv6

47 Domains

69 Subdomains

60 IPs

9 Countries

17417 kBTransfer

23130 kBSize

37 Cookies

28 Outgoing links

Page URL History

Redirected requests

269 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.spokesman.com Open in urlscan Pro
2600:9000:21f3:5200:0:b5fb:e6c0:93a1 Public Scan

Screenshot
Live screenshot

Full Image

269
Requests

92 %
HTTPS

46 %
IPv6

47
Domains

69
Subdomains

60
IPs

9
Countries

17417 kB
Transfer

23130 kB
Size

37
Cookies

269 HTTP transactions
11 data transactions