www.snowthaproductmerch.com Open in urlscan Pro
2606:4700:3108::ac42:287d Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
an-x-request-uuid: a6134cb0-6f8f-4a28-92bf-7d7424740e47
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTE5ODU5ODY2NDYwMDQ1NDM0Ng%3D%3D
x-proxy-origin: 217.114.215.131; 217.114.215.131; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 0631 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 0631 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 8D30 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7412ddf037c63259d9456352b490da8baac65c32879176e90a2d24a96c449dd4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F16E
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHynWUe-t5dK-gkHTvFIKZc&google_push=AXcoOmTLsdvh8YasIOmAdXHXEz8dtO-qxVmsvFK1FL5rVKuuh13WCWB5FL...

170 B
188 B

54ms
52ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHynWUe-t5dK-gkHTvFIKZc&google_push=AXcoOmTLsdvh8YasIOmAdXHXEz8dtO-qxVmsvFK1FL5rVKuuh13WCWB5FLgWckBH7N0h4vXCrvLdFlRaswSrFfNmrcRirzpUkVWaQw

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230050-FRA
pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1695775145.885733,VS0,VE99
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEHynWUe-t5dK-gkHTvFIKZc&google_push=AXcoOmTLsdvh8YasIOmAdXHXEz8dtO-qxVmsvFK1FL5rVKuuh13WCWB5FLgWckBH7N0h4vXCrvLdFlRaswSrFfNmrcRirzpUkVWaQw
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F16E
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEH2pscUxCAWNhZ87tN9F2UM&google_cver=1&google_push=AXcoOmSe6w-rHPHh-GVs19B64HJJBetxqgddajgZEbV1yHdbajphNcoWVB_RwluVain_4Kgymt4BfzIt0q7m4W4xS3VlCCb0UtmwMg
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E218BFB78FC34F61B4A778CEF50CD2CB&google_push=AXcoOmSe6w-rHPHh-GVs19B64HJJBetxqgddajgZEbV1yHdbajphNcoWVB_RwluVain_4Kgymt4BfzIt0q7m4W4...

170 B
232 B

37ms
37ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E218BFB78FC34F61B4A778CEF50CD2CB&google_push=AXcoOmSe6w-rHPHh-GVs19B64HJJBetxqgddajgZEbV1yHdbajphNcoWVB_RwluVain_4Kgymt4BfzIt0q7m4W4xS3VlCCb0UtmwMg

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Sep 2023 00:39:04 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E218BFB78FC34F61B4A778CEF50CD2CB&google_push=AXcoOmSe6w-rHPHh-GVs19B64HJJBetxqgddajgZEbV1yHdbajphNcoWVB_RwluVain_4Kgymt4BfzIt0q7m4W4xS3VlCCb0UtmwMg
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 26 Sep 2023 00:39:04 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame F16E 70 B
149 B 162ms
49ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEA7y-faxDeys_ME9O1IilPo&google_cver=1&google_push=AXcoOmQrdWZi7O4YI4A6c5b1G_oA12udYtdikgx7oIEjMUfalD-s3uPJ7g92S-yQhPT13BhcIZBlJtA5FLICVgBlQB87vjI-0U-apQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=1859851007&pi=t.aa~a.3564571348~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=6&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0&nras=2&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1344&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=FGv7XAfqP7&p=https%3A//www.snowthaproductmerch.com&dtd=74
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F16E
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDcZhTgmF1fesoQMp87W_fA&google_cver=1&google_push=AXcoOmRAGsBmXwATzpLPvHf-JdbID4xLDNw-TWO6FL8UVLBIl-rkhGByFesaXOS328TJAfaMumBcXxwXJQ_...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRAGsBmXwATzpLPvHf-JdbID4xLDNw-TWO6FL8UVLBIl-rkhGByFesaXOS328TJAfaMumBcXxwXJQ_s8gJBeKMRRDtVGP8wcQ&google_hm=ZtPDuptPQr2GeyDgN8...

170 B
243 B

33ms
32ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRAGsBmXwATzpLPvHf-JdbID4xLDNw-TWO6FL8UVLBIl-rkhGByFesaXOS328TJAfaMumBcXxwXJQ_s8gJBeKMRRDtVGP8wcQ&google_hm=ZtPDuptPQr2GeyDgN8I-ToM

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRAGsBmXwATzpLPvHf-JdbID4xLDNw-TWO6FL8UVLBIl-rkhGByFesaXOS328TJAfaMumBcXxwXJQ_s8gJBeKMRRDtVGP8wcQ&google_hm=ZtPDuptPQr2GeyDgN8I-ToM
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F16E
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFxbhNRke7s56-OhkOE92qw&google_cver=1&google_push=AXcoOmTQNjpajpCH70D6xtpKAZJzRrJtXxrO8Sv6dv-oEJXKwNaEN6GXAONJHJjNLrYGu36NJLC4JQgoVK3yB4MGBWh6Tl-...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTQNjpajpCH70D6xtpKAZJzRrJtXxrO8Sv6dv-oEJXKwNaEN6GXAONJHJjNLrYGu36NJLC4JQgoVK3yB4MGBWh6Tl-B8XahDg&google_hm=eS1HQ0Vwb0RSRTJwRTVB...

170 B
188 B

35ms
34ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTQNjpajpCH70D6xtpKAZJzRrJtXxrO8Sv6dv-oEJXKwNaEN6GXAONJHJjNLrYGu36NJLC4JQgoVK3yB4MGBWh6Tl-B8XahDg&google_hm=eS1HQ0Vwb0RSRTJwRTVBaDZ4MjRhQ2RUaDhBU1M2Sk1MdX5B

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Sep 2023 00:39:04 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTQNjpajpCH70D6xtpKAZJzRrJtXxrO8Sv6dv-oEJXKwNaEN6GXAONJHJjNLrYGu36NJLC4JQgoVK3yB4MGBWh6Tl-B8XahDg&google_hm=eS1HQ0Vwb0RSRTJwRTVBaDZ4MjRhQ2RUaDhBU1M2Sk1MdX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F16E
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESENQIc4hQbNuM99P-ELdoTyM&google_cver=1&google_push=AXcoOmQMSfBb9ZbHdElCEYsrT_Z1Wd1w87aaE8qaAIdFM6M93b0438dPmG2Aqv6UyCC4DkgimniR5Eg_BJFzUpzCicvCAdD...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESENQIc4hQbNuM99P-ELdoTyM&google_cver=1&google_push=AXcoOmQMSfBb9ZbHdElCEYsrT_Z1Wd1w87aaE8qaAIdFM6M93b0438dPmG2Aqv6UyCC4DkgimniR5Eg_BJFzUpzCicvCA...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQMSfBb9ZbHdElCEYsrT_Z1Wd1w87aaE8qaAIdFM6M93b0438dPmG2Aqv6UyCC4DkgimniR5Eg_BJFzUpzCicvCAdDl7SXcGw

170 B
188 B

43ms
43ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQMSfBb9ZbHdElCEYsrT_Z1Wd1w87aaE8qaAIdFM6M93b0438dPmG2Aqv6UyCC4DkgimniR5Eg_BJFzUpzCicvCAdDl7SXcGw

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQMSfBb9ZbHdElCEYsrT_Z1Wd1w87aaE8qaAIdFM6M93b0438dPmG2Aqv6UyCC4DkgimniR5Eg_BJFzUpzCicvCAdDl7SXcGw
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F16E
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEJ8OnmcQmfT6SV9CoJ8tBWw&google_cver=1&google_push=AXcoOmTC7pBa7PHJkh-mYKQ4w0LHCVrxjT9XNJgyXK8n6ZbSxrfHQEL_iIeBYWdGudk9qTzZAsZdBspx...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEJ8OnmcQmfT6SV9CoJ8tBWw&google_cver=1&google_push=AXcoOmTC7pBa7PHJkh-mYKQ4w0LHCVrxjT9XNJgyXK8n6ZbSxrfHQEL_iIeBYWdGudk9qTzZAsZ...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyNDIyNzI5NDk1NTE2MjU1Nw&google_push=AXcoOmTC7pBa7PHJkh-mYKQ4w0LHCVrxjT9XNJgyXK8n6ZbSxrfHQEL_iIeBYWdGudk9qTzZAsZdBs...

170 B
188 B

42ms
40ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyNDIyNzI5NDk1NTE2MjU1Nw&google_push=AXcoOmTC7pBa7PHJkh-mYKQ4w0LHCVrxjT9XNJgyXK8n6ZbSxrfHQEL_iIeBYWdGudk9qTzZAsZdBspxtQ46pB0F1cMHFovRcJrjsw

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyNDIyNzI5NDk1NTE2MjU1Nw&google_push=AXcoOmTC7pBa7PHJkh-mYKQ4w0LHCVrxjT9XNJgyXK8n6ZbSxrfHQEL_iIeBYWdGudk9qTzZAsZdBspxtQ46pB0F1cMHFovRcJrjsw
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame F16E 0
139 B 53ms
37ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IjoEstDc5yKAiconufNq8W7AfkYP0XqKLvtEvpjEqXIXFVMccyQIc5vmvy61KDijZEnhqW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 185E 14 KB
1 KB 33ms
32ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=934386975&adf=4061327640&pi=t.aa~a.3923628355~rp.4&w=1198&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1198x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=1&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280&nras=4&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=201&ady=2446&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=OLMaQscRPV&p=https%3A//www.snowthaproductmerch.com&dtd=85

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 27 Sep 2023 00:39:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/ro
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Sep 2023 23:05:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 27 Sep 2023 00:39:04 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230925/r20110914/client/ Frame 185E 2 KB
892 B 21ms
21ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230925/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 14:00:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38288
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 14:00:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230925/r20110914/ Frame 185E 23 KB
9 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230925/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 14:00:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 14:00:47 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230925/r20110914/client/ Frame 185E 3 KB
1 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230925/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 21:15:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12244
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 21:15:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230925/r20110914/client/ Frame 185E 20 KB
8 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230925/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

113c3c3c7de8fe21fe5a6d4b6c367d658dab1dc5b5f820393e0b98fc11032771

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 14:00:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38300
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8282
x-xss-protection: 0
server: cafe
etag: 5314254467506293444
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 10 Oct 2023 14:00:44 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 185E 0
0 29ms
28ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS6pzlrkFDUeFcRZ-i4I2PZgpqAXmqjQu4tkKyuFibigSFViaIeUFavh6rGStTsbB2cVnnoItVQ5YMY5qI70BxZD3henw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=934386975&adf=4061327640&pi=t.aa~a.3923628355~rp.4&w=1198&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1198x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=1&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280&nras=4&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=201&ady=2446&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=OLMaQscRPV&p=https%3A//www.snowthaproductmerch.com&dtd=85
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 185E 182 KB
57 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff18e273fc7f233bf924108949a94f34e0587ed1cdfaa6820ba90be9cb739720

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1695641553523962"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Sep 2023 00:39:04 GMT

GET
H3 200 c233ef7b00e27d1a3d2fdfcca9f8c94a.js Show response
www.gstatic.com/mysidia/ Frame 185E 36 KB
15 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c233ef7b00e27d1a3d2fdfcca9f8c94a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8ab5f91903d3ffacb3291e6c04e255b777d32970c2ac56f48e527089044b234

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 20:54:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13459
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15198
x-xss-protection: 0
last-modified: Mon, 25 Sep 2023 16:42:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 25 Dec 2023 20:54:45 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AA7A 1 KB
643 B 21ms
21ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17535
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 26 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Wed, 27 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 80AE 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6489409035599&version=m202309120101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 80AE 0
20 B 55ms
54ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6489409035599&version=m202309120101&ct=77&x=1&cor=3541991678893509000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 80AE 16 KB
12 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ByXnugca2XUCUWYnoAPi4uxdsNsIE0KQO9k29vK54JtKY550js53vTsVOArqUBKSZgYmudtIxEF-zPCUpO01BsUcSc9kqlIYLsT1lH1v2JDzgEBgjIdB3LMIsgMidcOa20nF294PxfXbywKfFI7DtbJ4gFqPTklXK9sLaWnb0VbNK_bv0&cry=1&dbm_d=AKAmf-CqaRkDEluedu1j4O4QdjiUlVzwFkbcgxQWC1ACUUtTL3vEwkDrWKR35qwzkroDb-V6m5CJuDssoAO0cLAXD9IEo1DlsXZ_4m0CBJsplVUrrnru5-YpTUZeHfTC4fr0ookQpT-MS4y0yLi9dTUXI-Uz1T7Dq-BVqMXjJ-AYWdslTRbhha2yS1yWsB_mkQIh7aa2hb0-f1EQPqNHiI3HO0I3RCDGeybz3KJlwRNN1ucx1QJgw4hHP7p-PfLJgfA8uTfnhumDS4IkeAohTLS7sat4PspDAz1zRrxB8qj-7RhjFU7m12LKNvuDio0MKmVK5EH-vvRE2V3YEInwGUsbhNyeOLkVG-kuQolFj-n039Y4fglO_dFK0alE5GYrI0k0-pB5Z60PNLLeBM5ZtJgvVMq-dH1JeGMbJOEVSmQxNsmdXW1NOMhzxS1X3S3o75M6qaxQXZsDnMIdwrYt-UVVQlK5EPu8VeDBYtR5mC9FKp3gr3jxrAEKLRRw-hTi3mJOLiz2NNoXMK1AaLQMgV8TtQ5gV5bnwkDWspUxq_nhmqNT2BD1kfuPBWSesWPWeIy9t8cu_9MjdyOtvWAiqm6YYlG2piysF_10FfPqscRKKHH8Jt_MICsfNiyMfKdTHuuJ5592ZVj07z5sSKz0fGn9Th-nTPjZ9hu0jhMRZZE8ICsrDnDP_szsCAWZGqPmItVPNSpTa26pLe2Ewar2a9zhk-lJyXTTnU583gA993SieJ0ns3hQ_Liz4UoJlpTA56gzYIJwa6d8PjAnBOmZPqUbqK-0mOdkB_Flube9BSL6f7tagh7LyIZX5PHAunmHdBchHWN9TwFKZQc42JYSlV8sD_JtibPdN4iGs-TQ4pbgc4Q-UlwQCOBi4HjBFrG03ueaRBcj_lN17_Q-tSKlOnpvqrINrW9uoprjUQ78hDGUVxwGJPUECmCAvKx8BUclvtbiqRJdxHsIrhzKnEKF9PjNXTvV_oD6HyyIGAgVytfWGG9n187FT7JutPFBuU3_lvBUE5XJ_X_oYJsg8YtPT4phjb0O5pWjBDFbyXW0zucZjtVZTvVLd-FA8O9cQTqtoQRjzGK0Fpm64imfsDO-o2TZ5KD_MTQAA2Wtz6dZ-z7BNgXQz_K4IZAucthebEyS3uZVLolY3Urnr-UDnkxUlKI38FnzkN3HRfhiWe51_Sms65NjCFgmc-u8YCa6fT4E0VEQiO_uN9QIhR3ruZnOLXIgY9PZfzbE5L9tDhdV96eFsYMLOCF2K1lcdpecPn71Ob6H7htBTb8nCu78K5jqZ-qsiXxLurH0-II9RnxGGp3xXgQ9A0DpKHlM_L3PguFP3PcpLtlyiYJmeK8qmMWcB-eKtTKdLeCHbJrotdWUGuqwz2zuDMFNVi73GhTk5AMoADHEnZF1hJBKt6BItXWUqBBs3d05BYpaeTo4-lg7DKjsPzSL9epP1IqzYaP4nKM0q5rjkZDzRiqj24TeXhMmGzE-xi7EBSitXZrWPLn10FMHUJ9PbK_DDx9Q3yQDBREwETOrygtq8WKfkts9GvnMqY7BiIumjTU1THnW5Y5d9zWHbP2qSTulVYV_P69Q4QKDdBfREk8e2Mm9fF5OMOkbwJO8k23LaG9cVyuu0TapxNRbapKjKKIXuvv0WuORTVuQKbstvfjWP-zw2LZlHCWz6BYx-1Iafp61MVQYVJTHvRm3QBziZiEjSY35JMwScOl45N-07FxjwxTzoRuGlJBPgpe8cvFZXLm8_fK9XMP2NZcG6hYdVbc7wGoaAWn8i8rRrQzYnEwFcnl_HL94roLRiqklQ0S-od9cZrIUcyuU7XlfUEsMGEZUPYqHYB5ZZNeY_dCA7qIlRMKinAQsVwgimKEHnVJJpA-yKzmQ5sGc-MfeVsMgpA4QiAQzcfUyJi3vA3WbEW7x8MAS6FhgNfWJw8XrttNdmq2FmdVcV87qDIZVwgbyDY36DxKRx5RzUS87s_dkqZoVlNyWBRGbjGkALwywiJZKZ8rSr8FVjOsO10DDyzo7MBJObleHcgsI285mwzKBIch1YS1J1cziM2WPXqya74KruXa42ynlMJUsNaxsQ3z-UP6oJwQgNUbGT9aAsXT9EtIirqecvhLnU1fbrmARDJ1DowAStOOiuGNgcIinlnJWYjblbTFlDkZGsjKy7nv7VAvx92oHCZTtQ7s7TGF0IculTm_NSt9PgpkGa3wZwC4WnzBfB0igbsqo7EFUXOHA_eBCoVWWLUf-12f_WUNFztBY2fa7F1ovjJOLK3KjEM_AGvX3XVPQmA-1YLCnQkfbsgzrLIgalzzH55AJpLAm2KnP2xlXh8nPnm0Xzn_jAeG31_eM3zsp-CVIbQgRq7ivwuFNZ9IsnrqU3F5CyabmUYwNRN0Es0OtmIoWj1o1YeqezpsVb6mZBnKpALlzdI32SqDKJrNMJQDB0L9woimkvKhl9RmmHieKU1wsY54CBhsw1kH7A_M2sOQ1amAUoZ_5Q_cIHAZcN6PJ-pJeHT9APXU55a17mQIQlrBt1sek6WRuwO63mhbeI8k4r_I0Q-FtQm4GQ1q6hxdRKfj4OXqirxmMJ3kmxMgBk10suuG6ktZsYZx7jDnbbHBPqBnwhNrDwroaxLzR6B_QZm_fi5LTj2jKLVU_MZmURsxk71K7Q9tsTrnP6PPhVEVpfyzmvLi4_kQaI4GQbVJGP8-djq8v-OvqRKDu2wBmSPcJ-lq7hLR-UKFE4T75WJZRXebfgBSyP1ojtZ4LQ9c7K979ICI_BecSBPbC_LsInWH1dopmQlPBo3Vwzbz_HIHX0qYJwzYhIIVZyzpH-lO7Fm2v39FbEWT2PxWpZbApARyEUFMVB1WxNcUy2_lY93pQllS3xcooAfmpjxZD573Ry_L7M4pPpLmpZ1mQqzsOkGNKLkut863eUfvHfJnku_9YtggZRv7VJQhZpQ-eL6Z7ci5wlTWwP849scU1oFyL0UZWO-AxHwD9-qJzXtRBRTc2tg40cUPnYK6AfKqwmIa53Y14OP6tAI_vf9kIhgr7HIoswM0HeleERX1Phyw5tKA1hiZWJY9iaE9-K4G9cYMf01b3WiE5pq9gW0kOEcjgz9pwNFTCIydPKC_KIopw4buTgzNN8jyMH5BD9qGZh0xwkFIL9Kd3LubaM0cekKRjoVUzpLH7dSTPL0h9GnM5nmRy95Jq6N6AJGAly37ZonZEUVXHD93OF6Ouxnb2WLALxOmhDYr9wVpO1kD3AML8Ei-lkLsBAiRJdZ36USxX-ZHj_cEjzimpVECVD54aCXYNxofXxdpw3_R_2q5boDoO-ISXOsrLrNdCO3s3VNSNkzN7zwv6ABdUSCLqTUBmq4MWWIsIzKyJzk83CaELDC5XUasNxCmY2TMNCv2Jc612H56QkU_viKkdbGY-LcJSXVcpYDMnhDPdpGSs5QYX-ZlMyta8Fb6ts9ANU6K_lSbDpOgSRsmO3uivhrc1ddvIXXaJrfldjm08RYFPeqAs0DTiamNxl5xIYX1oCv_ACTXeYgUGHQTZEfwjehubedzs033FyCxsl7uaW8kgRh5Qww-SbbbNiabJLRQ6shsyxH6sHV3T4qNFPif8kA1U6S32Td3Uu3v4j94X_pzpBrdLi1r0ljSWeLke0QupJbHFun3F6LI1Nc01bhL6dMNJBQo2HxBbl6H5SLTs8JyxV5zyEL9LEO29duw9JibNDh4aix62VTlEgWt7UPhmXfovbzWxElnQTh5A4ICKtWq43G_mkOnaB2tABsn-I4mfb6GEX2x8fKG7ViN-Zt6jZFfT1clgZBqtFq6oR--uUEwxnlPydO79H63VDH5QliHSAoCU-Noa&cid=CAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB&dv3_ver=m202309120101&rfl=https%3A%2F%2Fwww.snowthaproductmerch.com&ds=l&xdt=1&iif=1&cor=3541991678893509000&adk=497053795&idt=57&cac=0&dtd=16

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8175f57b0410d25fad5b1d011f3dd0e7312873c73b52e5712aa6d16df577077d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12173
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3C77 15 KB
16 KB 73ms
21ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700|Roboto:500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tpc.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 13:37:19 GMT
x-content-type-options: nosniff
age: 298905
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 13:37:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 3C77 16 KB
16 KB 78ms
26ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700|Roboto:500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://tpc.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 02:35:09 GMT
x-content-type-options: nosniff
age: 338635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 02:35:09 GMT

GET
DATA 200
OK truncated
/ Frame 0631 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cff8954e51aca92404aade84bf6573b4a000f4d79d6f45587aa696f9e1a5a850

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CCD0 1 KB
643 B 21ms
20ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17535
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 26 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Wed, 27 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 8D30 33 KB
33 KB 45ms
44ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 05:04:01 GMT
x-content-type-options: nosniff
age: 329703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:04:01 GMT

GET
H2 400 data=YIrjcLEPiPZD8twxPxSZIQ-FUeEm_lPDZ9vvK93eKTBVr3NJTnpdp8WGuWd7VllHaFY_f3fikXQYXPmN-F9dpQ
mts0.google.com/vt/ Frame 185E 0
0 30ms
29ms Image
text/html 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mts0.google.com/vt/data=YIrjcLEPiPZD8twxPxSZIQ-FUeEm_lPDZ9vvK93eKTBVr3NJTnpdp8WGuWd7VllHaFY_f3fikXQYXPmN-F9dpQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=934386975&adf=4061327640&pi=t.aa~a.3923628355~rp.4&w=1198&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1198x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=1&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280&nras=4&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=201&ady=2446&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=OLMaQscRPV&p=https%3A//www.snowthaproductmerch.com&dtd=85
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 185E 297 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65f22d8aa0690bd9cf8ffe5d68e5f6866b05ed8fc6f6c9083b996c1b3c4c75f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 185E 336 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3b15b1e68cf3e9278293d3b50491fe16c985e0ee5968852cac4fc062a7134e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 185E 462 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01cbb105faef1373e9d53ddc5e62c9c7b5f66cbc64c2c045a3daec0328b831e6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 185E 465 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41b7f4ef86f2344e72da822fe79265700ff1bf3361450a02ab4397ff1a5eb040

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0631 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoKCAEqBmJhbm5lcgoKCAIqBnNlcnZlcgoNECshAAAAAACASEAwBAoNEAMhAAAAAAB4g0AwBAoNEAohAAAAgMzMJEAwBAoNEA0hAAAAAAAAAAAwBAoOEB4qCDEyMDB4MjgwMAQKDhAZKggxMjAweDI4MDAECg0QDiEAAAAAAAAAADAECg0QBCEAAABmZs6DQDAECg0QDyEAAAAAAAAAADAECg0QKyEAAAAAAIBOQDAECg0QBSEAAACamdGDQDAECg0QECEAAAAAwMPkQDAECg0QESEAAAAAsGTwQDAECg0QEiEAAAAAAAAQQDAECg0QEyEAAAAAAAAAQDAECg0QFyEAAACamQWHQDAEEhpDUHJYMnRqR3lZRURGWjhEVlFnZFc0OEZzUSIJdGV4dC9yeXVrKBU=

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/2bc2aca8c3044a40756a16145a859bef.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 0631 33 KB
33 KB 45ms
45ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 05:04:01 GMT
x-content-type-options: nosniff
age: 329703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:04:01 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame AA7A 0
104 B 186ms
73ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEPvtpPrRDzNIppVOcyzdqqE&google_cver=1&google_push=AXcoOmR8LkWvjzR7CxzgwgmjOdl1YmYsvAEoFLqwVfxyrvrcdiYqCR-B-LY4WX3OqwCFCtY_i8dIXPrdUb7BuGKryS8XKVj6hvEFyyJC
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=485386628&adf=3229536656&pi=t.aa~a.3728729089~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1200x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=2&bdt=1570&idt=2&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280%2C1198x280&nras=5&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=4190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=zCac2iM1BU&p=https%3A//www.snowthaproductmerch.com&dtd=91
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Sweden, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 200 sync
x.bidswitch.net/ Frame AA7A 43 B
146 B 72ms
21ms Image
image/gif 3.68.49.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEMzQqoWlSQlOQNGz74KgMjE&google_cver=1&google_push=AXcoOmSexi68hrYA3N2F7BPtKw34GyzrCgYB9xcfuL7aVdpa-BpEpDDDxBWzpSD3yzFdyCkL2RRlgRl81hvxjyyRX6BYQ2UsgYHBxiOw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=485386628&adf=3229536656&pi=t.aa~a.3728729089~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1200x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=2&bdt=1570&idt=2&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280%2C1198x280&nras=5&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=4190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=zCac2iM1BU&p=https%3A//www.snowthaproductmerch.com&dtd=91
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.49.182 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-68-49-182.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AA7A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJULdwgoFl_1d6RUIRb92Vo&google_cver=1&google_push=AXcoOmTSk28afZWbJp0gcU__5gTThZOGHvCBY3w7SstHUULpOneTvLsYumWD_jEm9zDYID5kzY-szGmMMxE_7_eyfPUmkef...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTSk28afZWbJp0gcU__5gTThZOGHvCBY3w7SstHUULpOneTvLsYumWD_jEm9zDYID5kzY-szGmMMxE_7_eyfPUmkefVttdz3b-g&google_hm=eS1EUGFCMVBGRTJwRW...

170 B
188 B

43ms
41ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTSk28afZWbJp0gcU__5gTThZOGHvCBY3w7SstHUULpOneTvLsYumWD_jEm9zDYID5kzY-szGmMMxE_7_eyfPUmkefVttdz3b-g&google_hm=eS1EUGFCMVBGRTJwRWYyRmFENHJqNzJHUkI5eGJxT25uU35B

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Sep 2023 00:39:04 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTSk28afZWbJp0gcU__5gTThZOGHvCBY3w7SstHUULpOneTvLsYumWD_jEm9zDYID5kzY-szGmMMxE_7_eyfPUmkefVttdz3b-g&google_hm=eS1EUGFCMVBGRTJwRWYyRmFENHJqNzJHUkI5eGJxT25uU35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AA7A
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEH6UV_lPhCHZT9ZyPvJTJEc&google_cver=1&google_push=AXcoOmQWS5_KotTWkKkVNox7QHOlNGZUMSklSIkvBJCcV5DR-rYYMQ_B5H63IiBdZbniO7UYN9ltUgCqL9JnbIJFm8UHzgq...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEH6UV_lPhCHZT9ZyPvJTJEc&google_cver=1&google_push=AXcoOmQWS5_KotTWkKkVNox7QHOlNGZUMSklSIkvBJCcV5DR-rYYMQ_B5H63IiBdZbniO7UYN9ltUgCqL9JnbIJFm8UHz...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQWS5_KotTWkKkVNox7QHOlNGZUMSklSIkvBJCcV5DR-rYYMQ_B5H63IiBdZbniO7UYN9ltUgCqL9JnbIJFm8UHzgqEvp61mTaV

170 B
188 B

33ms
32ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQWS5_KotTWkKkVNox7QHOlNGZUMSklSIkvBJCcV5DR-rYYMQ_B5H63IiBdZbniO7UYN9ltUgCqL9JnbIJFm8UHzgqEvp61mTaV

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQWS5_KotTWkKkVNox7QHOlNGZUMSklSIkvBJCcV5DR-rYYMQ_B5H63IiBdZbniO7UYN9ltUgCqL9JnbIJFm8UHzgqEvp61mTaV
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame AA7A 42 B
204 B 95ms
30ms Image
image/gif 34.160.236.64
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEF9X_QXgue75EQH2_hio9hM&google_push=AXcoOmRC4FhsQbea26UOt7wPlw3pEmhWCUX6N-PqwxGNYc9b-J7jUZgCNh7yFbuU96x2pBI4ymyBAAgbfalMOuobs1ViaTqqZ1ERgQbL&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=485386628&adf=3229536656&pi=t.aa~a.3728729089~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1200x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=2&bdt=1570&idt=2&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280%2C1198x280&nras=5&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=4190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=zCac2iM1BU&p=https%3A//www.snowthaproductmerch.com&dtd=91
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.236.64 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 64.236.160.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
via: 1.1 google
last-modified: Tue, 28 Jun 2022 14:08:50 GMT
server: nginx
etag: "62bb0b72-2a"
content-type: image/gif
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 trk
ag.innovid.com/ Frame AA7A 43 B
297 B 160ms
35ms Image
image/gif 2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEDXssV-YGentuAMONUosrMc&google_cver=1&google_push=AXcoOmSeI3V9o7NxgInxMe5IZWJtRO79FKJzW7TZSk_95DeJRfXxLWSNPaHBtOyEo8NQqj_FLJtf3roTbLihlTUmAX-olIvG7juouJ8
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=485386628&adf=3229536656&pi=t.aa~a.3728729089~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1200x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=2&bdt=1570&idt=2&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280%2C1198x280&nras=5&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=4190&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=zCac2iM1BU&p=https%3A//www.snowthaproductmerch.com&dtd=91
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:d9e9:4576:4b39:3a88 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
cache-control: no-cache
content-length: 43
request-time: 0
expires: -1

GET googleredir
googlecm.hit.gemius.pl/ Frame AA7A 0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame AA7A 0
49 B 33ms
29ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KBFq8eKi7apgjCSSMiPInrxExTEIb5PzzcJkGykk_Qs3yUfZykMPq50D1M-MBowrGl38EQ6w

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 80AE 41 KB
13 KB 25ms
22ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ByXnugca2XUCUWYnoAPi4uxdsNsIE0KQO9k29vK54JtKY550js53vTsVOArqUBKSZgYmudtIxEF-zPCUpO01BsUcSc9kqlIYLsT1lH1v2JDzgEBgjIdB3LMIsgMidcOa20nF294PxfXbywKfFI7DtbJ4gFqPTklXK9sLaWnb0VbNK_bv0&cry=1&dbm_d=AKAmf-CqaRkDEluedu1j4O4QdjiUlVzwFkbcgxQWC1ACUUtTL3vEwkDrWKR35qwzkroDb-V6m5CJuDssoAO0cLAXD9IEo1DlsXZ_4m0CBJsplVUrrnru5-YpTUZeHfTC4fr0ookQpT-MS4y0yLi9dTUXI-Uz1T7Dq-BVqMXjJ-AYWdslTRbhha2yS1yWsB_mkQIh7aa2hb0-f1EQPqNHiI3HO0I3RCDGeybz3KJlwRNN1ucx1QJgw4hHP7p-PfLJgfA8uTfnhumDS4IkeAohTLS7sat4PspDAz1zRrxB8qj-7RhjFU7m12LKNvuDio0MKmVK5EH-vvRE2V3YEInwGUsbhNyeOLkVG-kuQolFj-n039Y4fglO_dFK0alE5GYrI0k0-pB5Z60PNLLeBM5ZtJgvVMq-dH1JeGMbJOEVSmQxNsmdXW1NOMhzxS1X3S3o75M6qaxQXZsDnMIdwrYt-UVVQlK5EPu8VeDBYtR5mC9FKp3gr3jxrAEKLRRw-hTi3mJOLiz2NNoXMK1AaLQMgV8TtQ5gV5bnwkDWspUxq_nhmqNT2BD1kfuPBWSesWPWeIy9t8cu_9MjdyOtvWAiqm6YYlG2piysF_10FfPqscRKKHH8Jt_MICsfNiyMfKdTHuuJ5592ZVj07z5sSKz0fGn9Th-nTPjZ9hu0jhMRZZE8ICsrDnDP_szsCAWZGqPmItVPNSpTa26pLe2Ewar2a9zhk-lJyXTTnU583gA993SieJ0ns3hQ_Liz4UoJlpTA56gzYIJwa6d8PjAnBOmZPqUbqK-0mOdkB_Flube9BSL6f7tagh7LyIZX5PHAunmHdBchHWN9TwFKZQc42JYSlV8sD_JtibPdN4iGs-TQ4pbgc4Q-UlwQCOBi4HjBFrG03ueaRBcj_lN17_Q-tSKlOnpvqrINrW9uoprjUQ78hDGUVxwGJPUECmCAvKx8BUclvtbiqRJdxHsIrhzKnEKF9PjNXTvV_oD6HyyIGAgVytfWGG9n187FT7JutPFBuU3_lvBUE5XJ_X_oYJsg8YtPT4phjb0O5pWjBDFbyXW0zucZjtVZTvVLd-FA8O9cQTqtoQRjzGK0Fpm64imfsDO-o2TZ5KD_MTQAA2Wtz6dZ-z7BNgXQz_K4IZAucthebEyS3uZVLolY3Urnr-UDnkxUlKI38FnzkN3HRfhiWe51_Sms65NjCFgmc-u8YCa6fT4E0VEQiO_uN9QIhR3ruZnOLXIgY9PZfzbE5L9tDhdV96eFsYMLOCF2K1lcdpecPn71Ob6H7htBTb8nCu78K5jqZ-qsiXxLurH0-II9RnxGGp3xXgQ9A0DpKHlM_L3PguFP3PcpLtlyiYJmeK8qmMWcB-eKtTKdLeCHbJrotdWUGuqwz2zuDMFNVi73GhTk5AMoADHEnZF1hJBKt6BItXWUqBBs3d05BYpaeTo4-lg7DKjsPzSL9epP1IqzYaP4nKM0q5rjkZDzRiqj24TeXhMmGzE-xi7EBSitXZrWPLn10FMHUJ9PbK_DDx9Q3yQDBREwETOrygtq8WKfkts9GvnMqY7BiIumjTU1THnW5Y5d9zWHbP2qSTulVYV_P69Q4QKDdBfREk8e2Mm9fF5OMOkbwJO8k23LaG9cVyuu0TapxNRbapKjKKIXuvv0WuORTVuQKbstvfjWP-zw2LZlHCWz6BYx-1Iafp61MVQYVJTHvRm3QBziZiEjSY35JMwScOl45N-07FxjwxTzoRuGlJBPgpe8cvFZXLm8_fK9XMP2NZcG6hYdVbc7wGoaAWn8i8rRrQzYnEwFcnl_HL94roLRiqklQ0S-od9cZrIUcyuU7XlfUEsMGEZUPYqHYB5ZZNeY_dCA7qIlRMKinAQsVwgimKEHnVJJpA-yKzmQ5sGc-MfeVsMgpA4QiAQzcfUyJi3vA3WbEW7x8MAS6FhgNfWJw8XrttNdmq2FmdVcV87qDIZVwgbyDY36DxKRx5RzUS87s_dkqZoVlNyWBRGbjGkALwywiJZKZ8rSr8FVjOsO10DDyzo7MBJObleHcgsI285mwzKBIch1YS1J1cziM2WPXqya74KruXa42ynlMJUsNaxsQ3z-UP6oJwQgNUbGT9aAsXT9EtIirqecvhLnU1fbrmARDJ1DowAStOOiuGNgcIinlnJWYjblbTFlDkZGsjKy7nv7VAvx92oHCZTtQ7s7TGF0IculTm_NSt9PgpkGa3wZwC4WnzBfB0igbsqo7EFUXOHA_eBCoVWWLUf-12f_WUNFztBY2fa7F1ovjJOLK3KjEM_AGvX3XVPQmA-1YLCnQkfbsgzrLIgalzzH55AJpLAm2KnP2xlXh8nPnm0Xzn_jAeG31_eM3zsp-CVIbQgRq7ivwuFNZ9IsnrqU3F5CyabmUYwNRN0Es0OtmIoWj1o1YeqezpsVb6mZBnKpALlzdI32SqDKJrNMJQDB0L9woimkvKhl9RmmHieKU1wsY54CBhsw1kH7A_M2sOQ1amAUoZ_5Q_cIHAZcN6PJ-pJeHT9APXU55a17mQIQlrBt1sek6WRuwO63mhbeI8k4r_I0Q-FtQm4GQ1q6hxdRKfj4OXqirxmMJ3kmxMgBk10suuG6ktZsYZx7jDnbbHBPqBnwhNrDwroaxLzR6B_QZm_fi5LTj2jKLVU_MZmURsxk71K7Q9tsTrnP6PPhVEVpfyzmvLi4_kQaI4GQbVJGP8-djq8v-OvqRKDu2wBmSPcJ-lq7hLR-UKFE4T75WJZRXebfgBSyP1ojtZ4LQ9c7K979ICI_BecSBPbC_LsInWH1dopmQlPBo3Vwzbz_HIHX0qYJwzYhIIVZyzpH-lO7Fm2v39FbEWT2PxWpZbApARyEUFMVB1WxNcUy2_lY93pQllS3xcooAfmpjxZD573Ry_L7M4pPpLmpZ1mQqzsOkGNKLkut863eUfvHfJnku_9YtggZRv7VJQhZpQ-eL6Z7ci5wlTWwP849scU1oFyL0UZWO-AxHwD9-qJzXtRBRTc2tg40cUPnYK6AfKqwmIa53Y14OP6tAI_vf9kIhgr7HIoswM0HeleERX1Phyw5tKA1hiZWJY9iaE9-K4G9cYMf01b3WiE5pq9gW0kOEcjgz9pwNFTCIydPKC_KIopw4buTgzNN8jyMH5BD9qGZh0xwkFIL9Kd3LubaM0cekKRjoVUzpLH7dSTPL0h9GnM5nmRy95Jq6N6AJGAly37ZonZEUVXHD93OF6Ouxnb2WLALxOmhDYr9wVpO1kD3AML8Ei-lkLsBAiRJdZ36USxX-ZHj_cEjzimpVECVD54aCXYNxofXxdpw3_R_2q5boDoO-ISXOsrLrNdCO3s3VNSNkzN7zwv6ABdUSCLqTUBmq4MWWIsIzKyJzk83CaELDC5XUasNxCmY2TMNCv2Jc612H56QkU_viKkdbGY-LcJSXVcpYDMnhDPdpGSs5QYX-ZlMyta8Fb6ts9ANU6K_lSbDpOgSRsmO3uivhrc1ddvIXXaJrfldjm08RYFPeqAs0DTiamNxl5xIYX1oCv_ACTXeYgUGHQTZEfwjehubedzs033FyCxsl7uaW8kgRh5Qww-SbbbNiabJLRQ6shsyxH6sHV3T4qNFPif8kA1U6S32Td3Uu3v4j94X_pzpBrdLi1r0ljSWeLke0QupJbHFun3F6LI1Nc01bhL6dMNJBQo2HxBbl6H5SLTs8JyxV5zyEL9LEO29duw9JibNDh4aix62VTlEgWt7UPhmXfovbzWxElnQTh5A4ICKtWq43G_mkOnaB2tABsn-I4mfb6GEX2x8fKG7ViN-Zt6jZFfT1clgZBqtFq6oR--uUEwxnlPydO79H63VDH5QliHSAoCU-Noa&cid=CAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB&dv3_ver=m202309120101&rfl=https%3A%2F%2Fwww.snowthaproductmerch.com&ds=l&xdt=1&iif=1&cor=3541991678893509000&adk=497053795&idt=57&cac=0&dtd=16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 06:58:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 409240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 06:58:24 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 80AE 12 KB
4 KB 91ms
27ms Script
text/html 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1695775144181253&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoGhXqHkTZYWIC4vXgAfKoLXYCqblvaBpvZOcp8kP8C4QASCTgrKaAWCVqp-CsAfIAQmpAnJ52OFfvLE-qAMByAObBKoEhAJP0CSB2jK-IM8sY7pdC5_t-MKxie49UDeQBUSbEmQ7FNB3dq8xnC7ACayl8iORYAHQqbxiztbh5M828UkcUMjLCvvMR4QMgyfVor3yvgn1zIxBNHGgBJ7aCANCDZmnrvrxH9I7D6JtHP7Ue4hx6lTPxmft8dg04XfcoFlOFC7I7UDXBdaGceBZ3BlSxDlT-QgB_wmBJDvaAffGFFgRZeY04_Kq1nfdU1HIRVFvNdYCe_Ic0_asHYjoQjm3oav7AzI65b_sIVBni9pLIq_jXW5lA5KyPdi6-yb33mszUmR4EIdZ0gVRfqvYI83sx0if35_Vu3XQSKHE6sWHgCMujBPq1L0ktcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMIhfzZ2MbJgQMViyvgCh1KUA2rEAEYASAAEgLOAvD_BwE%26num%3D1%26cid%3DCAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB%26sig%3DAOD64_1sUkI4Jo82WIs6fKk96f3HnLqGJg%26client%3Dca-pub-6413192959719959%26dbm_c%3DAKAmf-Ct6uoEPZcx5AQqOrdSj-wTxeI1EpqE6qN0o_46e39H_wW6DLTSFZ4CHS4mxQZYtB2CAwPLCSRbUR81G_qNH9QLb56u4rWMrs9X3cQ7K_X1RDfVVjtSxXD3l8lzeSy8-rE2W9mJX27Tzc5k36P7rLh2v9hM4Ia7OsvFDYwXTI3SW0EnRnE%26cry%3D1%26dbm_d%3DAKAmf-AUAtQxxwc2MzJ9jD1RoANG70MCxE0BVQoRFLhG9KXn3dRERKBfmm6Ksor3ptcfsOIgsS-Y_GhVcT6Z1yNOmgMMF569r1sw8L_zyHpweZ4u595RczYkBclvmzOIedVB1hDCd-ixF0USClprzmrVIQMJLik-VquyJ85GV6FpLOhyooivdHFKDSJEDCIBlFfpMk4cU7jTglDrR3H6xwNdEkgTcSTQ-DM34Pl1ZIEqcpzS4PP3PzcdY3F6Nkkrqs9E2iGEqRGZxShsxqNsJy5WnxRF1ZLb8rtPJolItZgKzoj5bkrGkMY7Ps4xBbI-cN95kF5iE2ydS1UwumdN4ka744Gmr0LVr8ycg6V7maiH_hzuCmz29-9an-HCnoOGKAgiBZjLw334ztoMNovKco4zk2EV3-XkHS3pXKLr2kwfvTImH0v1qnDnCg2MGQxSSgxvU6_C6HK1isJ3u_k7q2xBpKcvRff2UbQYmaP7MgU2zj3ogXXakqvmM4iXUGR0y_H5TCR6TRT9GDMxKKqxSXi0gRyt032ubVOvwleHAWt_ARziiTCYWgSBqVD3sTLLwr0A7SoC9vBr%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3ca57024623323e996f760f4db8198f4c1a6a606d161929edbf4b582f8f6840

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4225
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame CCD0
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEAlvs0_BK9x9Dks7M_fYBqw&google_cver=1&google_push=AXcoOmR46Nz5KWC5haUR39J4qbyNVYo0PaiQCdqWwqS9tU1IQD01gLlyeLRJO5p1_g1bTNapfEONC6EWdzymBPpvRhFANLtFo70bP...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAlvs0_BK9x9Dks7M_fYBqw&google_cver=1&google_push=AXcoOmR46Nz5KWC5haUR39J4qbyNVYo0PaiQCdqWwqS9tU1IQD01gLlyeLRJO5p1_g1bTNapfEONC6EWdzymBPpvRhFANLtFo70...

43 B
428 B

194ms
179ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAlvs0_BK9x9Dks7M_fYBqw&google_cver=1&google_push=AXcoOmR46Nz5KWC5haUR39J4qbyNVYo0PaiQCdqWwqS9tU1IQD01gLlyeLRJO5p1_g1bTNapfEONC6EWdzymBPpvRhFANLtFo70bPvM&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmR46Nz5KWC5haUR39J4qbyNVYo0PaiQCdqWwqS9tU1IQD01gLlyeLRJO5p1_g1bTNapfEONC6EWdzymBPpvRhFANLtFo70bPvM%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80cfb0026b0c9945-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 304
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEAlvs0_BK9x9Dks7M_fYBqw&google_cver=1&google_push=AXcoOmR46Nz5KWC5haUR39J4qbyNVYo0PaiQCdqWwqS9tU1IQD01gLlyeLRJO5p1_g1bTNapfEONC6EWdzymBPpvRhFANLtFo70bPvM&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmR46Nz5KWC5haUR39J4qbyNVYo0PaiQCdqWwqS9tU1IQD01gLlyeLRJO5p1_g1bTNapfEONC6EWdzymBPpvRhFANLtFo70bPvM%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 80cfb00079a39945-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame CCD0 70 B
148 B 52ms
47ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEJvGcPhV7tmZIR9a9pPuqtI&google_cver=1&google_push=AXcoOmRUaBuQIhIMPvuPGbEIGVMJ9rtvDuyeF_1lOgUFqFzpYK2c91m0B8KfU51oLqKkYnOVLtvP3eRB666M0NrVn3vnBtdIQcYtQ8g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=934386975&adf=4061327640&pi=t.aa~a.3923628355~rp.4&w=1198&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1198x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=1&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280&nras=4&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=201&ady=2446&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=OLMaQscRPV&p=https%3A//www.snowthaproductmerch.com&dtd=85
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 451 466606.gif
id.rlcdn.com/ Frame CCD0 0
98 B 91ms
30ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAXcoOmSuv-tCURt8s4qnNsjmmrSLwpijAgwkbkQ-3WgGqD-hHmBKL0oD_PzuWol2NoQhKianoiAL7_1qJh_cMjKPCfBwfeAEY9XuniU&google_gid=CAESEHSLdaqUAandAFwqFr8qiyk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=934386975&adf=4061327640&pi=t.aa~a.3923628355~rp.4&w=1198&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1198x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=1&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280&nras=4&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=201&ady=2446&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=OLMaQscRPV&p=https%3A//www.snowthaproductmerch.com&dtd=85
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CCD0
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEJCg-zWih_olhaaHG1tF5GM&google_cver=1&google_push=AXcoOmTpFfy5Gdcg3_cteItelbeUzdhs1qHevewfE4YLIikOO37TVfWlYZDz9BQ9CQZakBuVHrMwwr55ZpTBtw...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI4MzI5ODc4OTE0NTM3NjkyMg%3D%3D&google_push=AXcoOmTpFfy5Gdcg3_cteItelbeUzdhs1qHevewfE4YLIikOO37TVfWlYZDz9BQ9CQZakBuVHrMwwr55ZpTBtwcWu2...

170 B
188 B

48ms
48ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI4MzI5ODc4OTE0NTM3NjkyMg%3D%3D&google_push=AXcoOmTpFfy5Gdcg3_cteItelbeUzdhs1qHevewfE4YLIikOO37TVfWlYZDz9BQ9CQZakBuVHrMwwr55ZpTBtwcWu23Sd5q0Lh05mqM

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzI4MzI5ODc4OTE0NTM3NjkyMg%3D%3D&google_push=AXcoOmTpFfy5Gdcg3_cteItelbeUzdhs1qHevewfE4YLIikOO37TVfWlYZDz9BQ9CQZakBuVHrMwwr55ZpTBtwcWu23Sd5q0Lh05mqM
Date: Wed, 27 Sep 2023 00:39:05 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 sync
x.bidswitch.net/ Frame CCD0 43 B
145 B 49ms
21ms Image
image/gif 3.68.49.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEBnLSyaFh7iJuKoes4mqcwQ&google_cver=1&google_push=AXcoOmSb4IkC-WwwZEV8zOP4LfE3XuDdJzETiqsIAaswLkkvN5YZbDKfanDcGo5NLEYtDtgPEzIwkFZZp6l4ZPRD1cn8PEKu4CyBSQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=934386975&adf=4061327640&pi=t.aa~a.3923628355~rp.4&w=1198&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=1198x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=1&bdt=1570&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280%2C584x280&nras=4&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=201&ady=2446&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=OLMaQscRPV&p=https%3A//www.snowthaproductmerch.com&dtd=85
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.49.182 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-68-49-182.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame CCD0 43 B
363 B 98ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmSqAo_EHje3mD0-PjN9lBweGaB7LVTq8Bj6hNfioF_nkJY06Fw1qNOW8LOOQC28BkCHMGqNSkbD4f1YcAhDsppQF9fY3aPYySQ&google_gid=CAESEK8--Jvqfd1hjsRk6IgsjjY&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 388746
expires: Wed, 27 Sep 2023 00:00:00 GMT

GET googleredir
googlecm.hit.gemius.pl/ Frame CCD0 0
0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame CCD0 0
49 B 35ms
31ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JxYR9jsff1Sd9byaROhIAZXHUYFwF5ERtUs35cG992u7RQpgfK-Z4K0fWU01qrMD5NR7Vo8g

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame C002
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CG_Nip3kTZcu-EITe7gObw4b4Be_L45dzkciR7pUS9--HgaEjEAEgk4KymgFglaqfgrAHoAG-i5HQA8gBCakCDGksNTe6sT6oAwHIA0iqBO0BT9CoevANy39obVe1KTewDui2p4u5YcuJDjy...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2210393408419417616695%22,%22debug_reporting%22:true,%22destination%22:%22https://bechtle.com%22,%22event_report_window%22:%...

0
0

109ms
59ms

Fetch
text/css

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2210393408419417616695%22,%22debug_reporting%22:true,%22destination%22:%22https://bechtle.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22973358526%22],%224%22:[%2209-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2217463909896519969489%22}&andc=true

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"10393408419417616695","debug_reporting":true,"destination":"https://bechtle.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["973358526"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"17463909896519969489"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 27 Sep 2023 00:39:05 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"10393408419417616695","debug_reporting":true,"destination":"https://bechtle.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["973358526"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"17463909896519969489"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 8D30
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C-c-HqHkTZYLTCsvVgQek3a2IA66J4sBrtdeT4ZgQ2vKCvvEKEAEgk4KymgFglaqfgrAHoAHDv_GQA8gBCakCDGksNTe6sT6oAwHIA8sEqgTmAU_Qjci_mUwMJ8bioRooCy6WVYrRzPUUXAA...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2214607560493665334903%22,%22debug_reporting%22:true,%22destination%22:%22https://schermbecker-kuechen.de%22,%22event_report...

0
0

107ms
59ms

Fetch
text/css

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2214607560493665334903%22,%22debug_reporting%22:true,%22destination%22:%22https://schermbecker-kuechen.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22840720323%22],%224%22:[%2209-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221390691578165838081%22}&andc=true

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"14607560493665334903","debug_reporting":true,"destination":"https://schermbecker-kuechen.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["840720323"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"1390691578165838081"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 27 Sep 2023 00:39:05 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"14607560493665334903","debug_reporting":true,"destination":"https://schermbecker-kuechen.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["840720323"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"1390691578165838081"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 185E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 151196338666a8fc2eb65503e6fa60c24c301e7330cc1f4de86e7786dd0f1bed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 0631
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CavsjqHkTZfrjC5-H1PIP256WiAu_9vmoZ8zBzJ6JDdnZHhABIJOCspoBYJWqn4KwB6ABjtDv8QPIAQmpAgxpLDU3urE-qAMByAPLBKoE6wFP0MfPLf1WifS_0RVBuhZm9m1NGR7vYRzZAXe...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229631737397492192675%22,%22debug_reporting%22:true,%22destination%22:%22https://karten-ankauf.de%22,%22event_report_window%...

0
0

107ms
59ms

Fetch
text/css

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229631737397492192675%22,%22debug_reporting%22:true,%22destination%22:%22https://karten-ankauf.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221044113422%22],%224%22:[%2209-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2215075134802545800337%22}&andc=true

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"9631737397492192675","debug_reporting":true,"destination":"https://karten-ankauf.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1044113422"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"15075134802545800337"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 27 Sep 2023 00:39:05 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9631737397492192675","debug_reporting":true,"destination":"https://karten-ankauf.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1044113422"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"15075134802545800337"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 513e9ee2a54d9e6f243160cd75c703e6.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10122332229189492278/media/ Frame 3C77 7 KB
7 KB 21ms
21ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10122332229189492278/media/513e9ee2a54d9e6f243160cd75c703e6.jpg

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c5818758024afd4331a14e8754c1921d3a8d73dc7e45c55d6dc01407790f8090

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/10122332229189492278/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Thu, 21 Sep 2023 22:36:50 GMT
x-content-type-options: nosniff
age: 439335
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7350
x-xss-protection: 0
last-modified: Mon, 11 Sep 2023 09:22:28 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 20 Sep 2024 22:36:50 GMT

GET
DATA 200
OK truncated
/ Frame 3C77 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 505b3a888072b44fe30bd9a656091e28e48226bd015ffe4167a921218304de64

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 3C77 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b99f2d56ae3e025c37b3b88dcdff9a834d6451aef6325862f5d25f4add5c1fe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame D464 37 KB
14 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230925/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:21:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 580635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:21:50 GMT

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame A3B5 37 KB
14 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:21:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 580635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:21:50 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0631 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoKCAEqBmJhbm5lcgoKCAIqBnNlcnZlcgoNEBQhAAAAAGA-AEEwBAoNEBUhAAAAAAAAKkAwBAoNEBYhAAAAAAAAFEAwBAoNEBghAAAAmpkRi0AwBBIaQ1ByWDJ0akd5WUVERlo4RFZRZ2RXNDhGc1EiCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/2bc2aca8c3044a40756a16145a859bef.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 185E 33 KB
33 KB 22ms
21ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 05:04:01 GMT
x-content-type-options: nosniff
age: 329704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 22 Sep 2024 05:04:01 GMT

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame D7F7 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:21:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 580635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:21:50 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 120ms
56ms Preflight
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 27 Sep 2023 00:39:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5FF0 22 KB
8 KB 23ms
21ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 194875
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 24 Sep 2023 18:31:10 GMT
expires: Mon, 23 Sep 2024 18:31:10 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900013.redintelligence.net/ Frame 80AE
Redirect Chain

https://hal900013.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900013.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

154ms
104ms

Script
application/x-javascript

116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoGhXqHkTZYWIC4vXgAfKoLXYCqblvaBpvZOcp8kP8C4QASCTgrKaAWCVqp-CsAfIAQmpAnJ52OFfvLE-qAMByAObBKoEhAJP0CSB2jK-IM8sY7pdC5_t-MKxie49UDeQBUSbEmQ7FNB3dq8xnC7ACayl8iORYAHQqbxiztbh5M828UkcUMjLCvvMR4QMgyfVor3yvgn1zIxBNHGgBJ7aCANCDZmnrvrxH9I7D6JtHP7Ue4hx6lTPxmft8dg04XfcoFlOFC7I7UDXBdaGceBZ3BlSxDlT-QgB_wmBJDvaAffGFFgRZeY04_Kq1nfdU1HIRVFvNdYCe_Ic0_asHYjoQjm3oav7AzI65b_sIVBni9pLIq_jXW5lA5KyPdi6-yb33mszUmR4EIdZ0gVRfqvYI83sx0if35_Vu3XQSKHE6sWHgCMujBPq1L0ktcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMIhfzZ2MbJgQMViyvgCh1KUA2rEAEYASAAEgLOAvD_BwE%26num%3D1%26cid%3DCAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB%26sig%3DAOD64_1sUkI4Jo82WIs6fKk96f3HnLqGJg%26client%3Dca-pub-6413192959719959%26dbm_c%3DAKAmf-Ct6uoEPZcx5AQqOrdSj-wTxeI1EpqE6qN0o_46e39H_wW6DLTSFZ4CHS4mxQZYtB2CAwPLCSRbUR81G_qNH9QLb56u4rWMrs9X3cQ7K_X1RDfVVjtSxXD3l8lzeSy8-rE2W9mJX27Tzc5k36P7rLh2v9hM4Ia7OsvFDYwXTI3SW0EnRnE%26cry%3D1%26dbm_d%3DAKAmf-AUAtQxxwc2MzJ9jD1RoANG70MCxE0BVQoRFLhG9KXn3dRERKBfmm6Ksor3ptcfsOIgsS-Y_GhVcT6Z1yNOmgMMF569r1sw8L_zyHpweZ4u595RczYkBclvmzOIedVB1hDCd-ixF0USClprzmrVIQMJLik-VquyJ85GV6FpLOhyooivdHFKDSJEDCIBlFfpMk4cU7jTglDrR3H6xwNdEkgTcSTQ-DM34Pl1ZIEqcpzS4PP3PzcdY3F6Nkkrqs9E2iGEqRGZxShsxqNsJy5WnxRF1ZLb8rtPJolItZgKzoj5bkrGkMY7Ps4xBbI-cN95kF5iE2ydS1UwumdN4ka744Gmr0LVr8ycg6V7maiH_hzuCmz29-9an-HCnoOGKAgiBZjLw334ztoMNovKco4zk2EV3-XkHS3pXKLr2kwfvTImH0v1qnDnCg2MGQxSSgxvU6_C6HK1isJ3u_k7q2xBpKcvRff2UbQYmaP7MgU2zj3ogXXakqvmM4iXUGR0y_H5TCR6TRT9GDMxKKqxSXi0gRyt032ubVOvwleHAWt_ARziiTCYWgSBqVD3sTLLwr0A7SoC9vBr%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6413192959719959%26output%3Dhtml%26h%3D280%26adk%3D3317751963%26adf%3D3598894932%26pi%3Dt.aa~a.3559586387~rp.4%26w%3D584%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695767944%26rafmt%3D1%26to%3Dqs%26pwprc%3D8994025055%26format%3D584x280%26url%3Dhttps%253A%252F%252Fwww.snowthaproductmerch.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695775144076%26bpp%3D5%26bdt%3D1569%26idt%3D-M%26shv%3Dr20230925%26mjsv%3Dm202309260101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D893f26028c1e0217-22f090a297de0093%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w%26gpic%3DUID%253D00000c872f283a76%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw%26prev_fmts%3D0x0%252C584x280%26nras%3D3%26correlator%3D3382411098356%26frm%3D20%26pv%3D1%26ga_vid%3D370313908.1695775143%26ga_sid%3D1695775143%26ga_hid%3D192712713%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D800%26ady%3D1687%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31076838%252C44798934%252C31078216%252C44803790%26oid%3D2%26pvsid%3D842789656273050%26tmod%3D995138675%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dtgz5yBrREe%26p%3Dhttps%253A%2F%2Fwww.snowthaproductmerch.com%26dtd%3D81&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.snowthaproductmerch.com&random=6274804542843&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: HTTP/1.1
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 59115b68cdaacf32090e90936309bce0d6a7b3cde1e36530384d90a8b2431d9f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Sep 2023 00:39:05 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 87862600004614304444994012460013
Connection: close
Content-Length: 1391
Expires: Wed, 27 Sep 2023 01:39:05 +0200

Redirect headers

Pragma: no-cache
Date: Wed, 27 Sep 2023 00:39:05 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoGhXqHkTZYWIC4vXgAfKoLXYCqblvaBpvZOcp8kP8C4QASCTgrKaAWCVqp-CsAfIAQmpAnJ52OFfvLE-qAMByAObBKoEhAJP0CSB2jK-IM8sY7pdC5_t-MKxie49UDeQBUSbEmQ7FNB3dq8xnC7ACayl8iORYAHQqbxiztbh5M828UkcUMjLCvvMR4QMgyfVor3yvgn1zIxBNHGgBJ7aCANCDZmnrvrxH9I7D6JtHP7Ue4hx6lTPxmft8dg04XfcoFlOFC7I7UDXBdaGceBZ3BlSxDlT-QgB_wmBJDvaAffGFFgRZeY04_Kq1nfdU1HIRVFvNdYCe_Ic0_asHYjoQjm3oav7AzI65b_sIVBni9pLIq_jXW5lA5KyPdi6-yb33mszUmR4EIdZ0gVRfqvYI83sx0if35_Vu3XQSKHE6sWHgCMujBPq1L0ktcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMIhfzZ2MbJgQMViyvgCh1KUA2rEAEYASAAEgLOAvD_BwE%26num%3D1%26cid%3DCAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB%26sig%3DAOD64_1sUkI4Jo82WIs6fKk96f3HnLqGJg%26client%3Dca-pub-6413192959719959%26dbm_c%3DAKAmf-Ct6uoEPZcx5AQqOrdSj-wTxeI1EpqE6qN0o_46e39H_wW6DLTSFZ4CHS4mxQZYtB2CAwPLCSRbUR81G_qNH9QLb56u4rWMrs9X3cQ7K_X1RDfVVjtSxXD3l8lzeSy8-rE2W9mJX27Tzc5k36P7rLh2v9hM4Ia7OsvFDYwXTI3SW0EnRnE%26cry%3D1%26dbm_d%3DAKAmf-AUAtQxxwc2MzJ9jD1RoANG70MCxE0BVQoRFLhG9KXn3dRERKBfmm6Ksor3ptcfsOIgsS-Y_GhVcT6Z1yNOmgMMF569r1sw8L_zyHpweZ4u595RczYkBclvmzOIedVB1hDCd-ixF0USClprzmrVIQMJLik-VquyJ85GV6FpLOhyooivdHFKDSJEDCIBlFfpMk4cU7jTglDrR3H6xwNdEkgTcSTQ-DM34Pl1ZIEqcpzS4PP3PzcdY3F6Nkkrqs9E2iGEqRGZxShsxqNsJy5WnxRF1ZLb8rtPJolItZgKzoj5bkrGkMY7Ps4xBbI-cN95kF5iE2ydS1UwumdN4ka744Gmr0LVr8ycg6V7maiH_hzuCmz29-9an-HCnoOGKAgiBZjLw334ztoMNovKco4zk2EV3-XkHS3pXKLr2kwfvTImH0v1qnDnCg2MGQxSSgxvU6_C6HK1isJ3u_k7q2xBpKcvRff2UbQYmaP7MgU2zj3ogXXakqvmM4iXUGR0y_H5TCR6TRT9GDMxKKqxSXi0gRyt032ubVOvwleHAWt_ARziiTCYWgSBqVD3sTLLwr0A7SoC9vBr%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6413192959719959%26output%3Dhtml%26h%3D280%26adk%3D3317751963%26adf%3D3598894932%26pi%3Dt.aa~a.3559586387~rp.4%26w%3D584%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695767944%26rafmt%3D1%26to%3Dqs%26pwprc%3D8994025055%26format%3D584x280%26url%3Dhttps%253A%252F%252Fwww.snowthaproductmerch.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695775144076%26bpp%3D5%26bdt%3D1569%26idt%3D-M%26shv%3Dr20230925%26mjsv%3Dm202309260101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D893f26028c1e0217-22f090a297de0093%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w%26gpic%3DUID%253D00000c872f283a76%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw%26prev_fmts%3D0x0%252C584x280%26nras%3D3%26correlator%3D3382411098356%26frm%3D20%26pv%3D1%26ga_vid%3D370313908.1695775143%26ga_sid%3D1695775143%26ga_hid%3D192712713%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D800%26ady%3D1687%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31076838%252C44798934%252C31078216%252C44803790%26oid%3D2%26pvsid%3D842789656273050%26tmod%3D995138675%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dtgz5yBrREe%26p%3Dhttps%253A%2F%2Fwww.snowthaproductmerch.com%26dtd%3D81&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.snowthaproductmerch.com&random=6274804542843&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 27 Sep 2023 01:39:05 +0200

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 104ms
58ms Preflight
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 27 Sep 2023 00:39:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 185E
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=Cs243qHkTZbGsC8OX1PIPgrKduAmuieLAa43Xk-GYENrygr7xChABIJOCspoBYJWqn4KwB6ABw7_xkAPIAQmpAnJ52OFfvLE-qAMByAPLBKoE5wFP0LG8BivA9sC9Ptc8lcZx7nJcxuDZPm5...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229972751144940651861%22,%22debug_reporting%22:true,%22destination%22:%22https://schermbecker-kuechen.de%22,%22event_report_...

0
0

59ms
58ms

Fetch
text/css

216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229972751144940651861%22,%22debug_reporting%22:true,%22destination%22:%22https://schermbecker-kuechen.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22840720323%22],%224%22:[%2209-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2212613512764232848321%22}&andc=true

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"9972751144940651861","debug_reporting":true,"destination":"https://schermbecker-kuechen.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["840720323"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"12613512764232848321"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 27 Sep 2023 00:39:05 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9972751144940651861","debug_reporting":true,"destination":"https://schermbecker-kuechen.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["840720323"],"4":["09-27"],"6":["true"]},"priority":"500","source_event_id":"12613512764232848321"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 3C77 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:21:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 580635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:21:50 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 69ms
57ms Preflight
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 27 Sep 2023 00:39:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 97A9 37 KB
14 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:21:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 580635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:21:50 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0631 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoKCAEqBmJhbm5lcgoKCAIqBnNlcnZlcgoNEDIhAAAAADAz0z8wBAoNEDMhAAAAADAz0z8wBAoNEDQhAAAAADAz0z8wBAoNEDUhAAAAADAz0z8wBAoNEDYhAAAAADAz0z8wBAoNEDchAAAAADAz0z8wBAoNEDghAAAAAGhm9j8wBAoNEDkhAAAAzMxseEAwBAoNEDohAAAAAAC4eUAwBAoNEDshAAAAzMwAh0AwBAoNEDwhAAAAzMwAh0AwBAoNED0hAAAAmpkFh0AwBAoNED4hAAAAmpmtikAwBAoNED8hAAAAmpmtikAwBAoNEEAhAAAANDMzi0AwBBIaQ1ByWDJ0akd5WUVERlo4RFZRZ2RXNDhGc1EiCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/2bc2aca8c3044a40756a16145a859bef.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 59ms
58ms Preflight
text/html 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 27 Sep 2023 00:39:05 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 5FF0 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/zoJWBzK8T3bx0gS17Fy3cZjSCDkxpLbxY97VcN3Od5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce82560732bc4f76f1d204b5ec5cb77198d2083931a4b6f163ded570ddce779b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 07:21:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 580635
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Sep 2024 07:21:50 GMT

GET
H2 200 / Show response
adv.office-partner.de/ Frame 7828 930 B
931 B 137ms
22ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoGhXqHkTZYWIC4vXgAfKoLXYCqblvaBpvZOcp8kP8C4QASCTgrKaAWCVqp-CsAfIAQmpAnJ52OFfvLE-qAMByAObBKoEhAJP0CSB2jK-IM8sY7pdC5_t-MKxie49UDeQBUSbEmQ7FNB3dq8xnC7ACayl8iORYAHQqbxiztbh5M828UkcUMjLCvvMR4QMgyfVor3yvgn1zIxBNHGgBJ7aCANCDZmnrvrxH9I7D6JtHP7Ue4hx6lTPxmft8dg04XfcoFlOFC7I7UDXBdaGceBZ3BlSxDlT-QgB_wmBJDvaAffGFFgRZeY04_Kq1nfdU1HIRVFvNdYCe_Ic0_asHYjoQjm3oav7AzI65b_sIVBni9pLIq_jXW5lA5KyPdi6-yb33mszUmR4EIdZ0gVRfqvYI83sx0if35_Vu3XQSKHE6sWHgCMujBPq1L0ktcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMIhfzZ2MbJgQMViyvgCh1KUA2rEAEYASAAEgLOAvD_BwE%26num%3D1%26cid%3DCAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB%26sig%3DAOD64_1sUkI4Jo82WIs6fKk96f3HnLqGJg%26client%3Dca-pub-6413192959719959%26dbm_c%3DAKAmf-Ct6uoEPZcx5AQqOrdSj-wTxeI1EpqE6qN0o_46e39H_wW6DLTSFZ4CHS4mxQZYtB2CAwPLCSRbUR81G_qNH9QLb56u4rWMrs9X3cQ7K_X1RDfVVjtSxXD3l8lzeSy8-rE2W9mJX27Tzc5k36P7rLh2v9hM4Ia7OsvFDYwXTI3SW0EnRnE%26cry%3D1%26dbm_d%3DAKAmf-AUAtQxxwc2MzJ9jD1RoANG70MCxE0BVQoRFLhG9KXn3dRERKBfmm6Ksor3ptcfsOIgsS-Y_GhVcT6Z1yNOmgMMF569r1sw8L_zyHpweZ4u595RczYkBclvmzOIedVB1hDCd-ixF0USClprzmrVIQMJLik-VquyJ85GV6FpLOhyooivdHFKDSJEDCIBlFfpMk4cU7jTglDrR3H6xwNdEkgTcSTQ-DM34Pl1ZIEqcpzS4PP3PzcdY3F6Nkkrqs9E2iGEqRGZxShsxqNsJy5WnxRF1ZLb8rtPJolItZgKzoj5bkrGkMY7Ps4xBbI-cN95kF5iE2ydS1UwumdN4ka744Gmr0LVr8ycg6V7maiH_hzuCmz29-9an-HCnoOGKAgiBZjLw334ztoMNovKco4zk2EV3-XkHS3pXKLr2kwfvTImH0v1qnDnCg2MGQxSSgxvU6_C6HK1isJ3u_k7q2xBpKcvRff2UbQYmaP7MgU2zj3ogXXakqvmM4iXUGR0y_H5TCR6TRT9GDMxKKqxSXi0gRyt032ubVOvwleHAWt_ARziiTCYWgSBqVD3sTLLwr0A7SoC9vBr%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6413192959719959%26output%3Dhtml%26h%3D280%26adk%3D3317751963%26adf%3D3598894932%26pi%3Dt.aa~a.3559586387~rp.4%26w%3D584%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695767944%26rafmt%3D1%26to%3Dqs%26pwprc%3D8994025055%26format%3D584x280%26url%3Dhttps%253A%252F%252Fwww.snowthaproductmerch.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695775144076%26bpp%3D5%26bdt%3D1569%26idt%3D-M%26shv%3Dr20230925%26mjsv%3Dm202309260101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D893f26028c1e0217-22f090a297de0093%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w%26gpic%3DUID%253D00000c872f283a76%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw%26prev_fmts%3D0x0%252C584x280%26nras%3D3%26correlator%3D3382411098356%26frm%3D20%26pv%3D1%26ga_vid%3D370313908.1695775143%26ga_sid%3D1695775143%26ga_hid%3D192712713%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D800%26ady%3D1687%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31076838%252C44798934%252C31078216%252C44803790%26oid%3D2%26pvsid%3D842789656273050%26tmod%3D995138675%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dtgz5yBrREe%26p%3Dhttps%253A%2F%2Fwww.snowthaproductmerch.com%26dtd%3D81&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.snowthaproductmerch.com&random=6274804542843&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 27 Sep 2023 00:39:05 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 04 Oct 2023 00:39:05 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame E7D6 0
467 B 138ms
59ms Document
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=87862600004614304444994012460013&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoGhXqHkTZYWIC4vXgAfKoLXYCqblvaBpvZOcp8kP8C4QASCTgrKaAWCVqp-CsAfIAQmpAnJ52OFfvLE-qAMByAObBKoEhAJP0CSB2jK-IM8sY7pdC5_t-MKxie49UDeQBUSbEmQ7FNB3dq8xnC7ACayl8iORYAHQqbxiztbh5M828UkcUMjLCvvMR4QMgyfVor3yvgn1zIxBNHGgBJ7aCANCDZmnrvrxH9I7D6JtHP7Ue4hx6lTPxmft8dg04XfcoFlOFC7I7UDXBdaGceBZ3BlSxDlT-QgB_wmBJDvaAffGFFgRZeY04_Kq1nfdU1HIRVFvNdYCe_Ic0_asHYjoQjm3oav7AzI65b_sIVBni9pLIq_jXW5lA5KyPdi6-yb33mszUmR4EIdZ0gVRfqvYI83sx0if35_Vu3XQSKHE6sWHgCMujBPq1L0ktcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMIhfzZ2MbJgQMViyvgCh1KUA2rEAEYASAAEgLOAvD_BwE%26num%3D1%26cid%3DCAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB%26sig%3DAOD64_1sUkI4Jo82WIs6fKk96f3HnLqGJg%26client%3Dca-pub-6413192959719959%26dbm_c%3DAKAmf-Ct6uoEPZcx5AQqOrdSj-wTxeI1EpqE6qN0o_46e39H_wW6DLTSFZ4CHS4mxQZYtB2CAwPLCSRbUR81G_qNH9QLb56u4rWMrs9X3cQ7K_X1RDfVVjtSxXD3l8lzeSy8-rE2W9mJX27Tzc5k36P7rLh2v9hM4Ia7OsvFDYwXTI3SW0EnRnE%26cry%3D1%26dbm_d%3DAKAmf-AUAtQxxwc2MzJ9jD1RoANG70MCxE0BVQoRFLhG9KXn3dRERKBfmm6Ksor3ptcfsOIgsS-Y_GhVcT6Z1yNOmgMMF569r1sw8L_zyHpweZ4u595RczYkBclvmzOIedVB1hDCd-ixF0USClprzmrVIQMJLik-VquyJ85GV6FpLOhyooivdHFKDSJEDCIBlFfpMk4cU7jTglDrR3H6xwNdEkgTcSTQ-DM34Pl1ZIEqcpzS4PP3PzcdY3F6Nkkrqs9E2iGEqRGZxShsxqNsJy5WnxRF1ZLb8rtPJolItZgKzoj5bkrGkMY7Ps4xBbI-cN95kF5iE2ydS1UwumdN4ka744Gmr0LVr8ycg6V7maiH_hzuCmz29-9an-HCnoOGKAgiBZjLw334ztoMNovKco4zk2EV3-XkHS3pXKLr2kwfvTImH0v1qnDnCg2MGQxSSgxvU6_C6HK1isJ3u_k7q2xBpKcvRff2UbQYmaP7MgU2zj3ogXXakqvmM4iXUGR0y_H5TCR6TRT9GDMxKKqxSXi0gRyt032ubVOvwleHAWt_ARziiTCYWgSBqVD3sTLLwr0A7SoC9vBr%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6413192959719959%26output%3Dhtml%26h%3D280%26adk%3D3317751963%26adf%3D3598894932%26pi%3Dt.aa~a.3559586387~rp.4%26w%3D584%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695767944%26rafmt%3D1%26to%3Dqs%26pwprc%3D8994025055%26format%3D584x280%26url%3Dhttps%253A%252F%252Fwww.snowthaproductmerch.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695775144076%26bpp%3D5%26bdt%3D1569%26idt%3D-M%26shv%3Dr20230925%26mjsv%3Dm202309260101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D893f26028c1e0217-22f090a297de0093%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w%26gpic%3DUID%253D00000c872f283a76%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw%26prev_fmts%3D0x0%252C584x280%26nras%3D3%26correlator%3D3382411098356%26frm%3D20%26pv%3D1%26ga_vid%3D370313908.1695775143%26ga_sid%3D1695775143%26ga_hid%3D192712713%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D800%26ady%3D1687%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31076838%252C44798934%252C31078216%252C44803790%26oid%3D2%26pvsid%3D842789656273050%26tmod%3D995138675%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dtgz5yBrREe%26p%3Dhttps%253A%2F%2Fwww.snowthaproductmerch.com%26dtd%3D81&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.snowthaproductmerch.com&random=6274804542843&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Content-Length: 0
Content-Type: application/javascript; charset=utf-8
Date: Wed, 27 Sep 2023 00:39:05 GMT
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
Server: nginx
Strict-Transport-Security: max-age=15768000
Vary: Origin
X-IPLB-Instance: 40027
X-IPLB-Request-ID: D972D783:C154_91EFC182:01BB_651379A9_1944DE75:22021

GET
H2 200 link.html Show response
track.webgains.com/ Frame 80AE 2 KB
2 KB 201ms
114ms Script
text/html 18.134.234.224
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=87862600004614304444994012460013&nw=1
Requested by: Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.134.234.224 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-134-234-224.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: c5bc24b977bcfafa9443cbbb8ba2643685a8619a87ffa5d396abf15c986fe1a2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
last-modified: Wed, 27 Sep 2023 00:39:05 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 27 Sep 2023 00:40:05 GMT

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 80AE 0
467 B 138ms
58ms Script
application/javascript 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=87862600004614304444994012460013&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D783:C156_91EFC182:01BB_651379A9_1944C559:22024
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 80AE 43 B
483 B 143ms
57ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=87862600004614304444994012460013&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Strict-Transport-Security: max-age=15768000
Server: nginx
Host: pv.medialead.de
X-IPLB-Request-ID: D972D783:C152_91EFC182:01BB_651379A9_1944C55A:22024
X-IPLB-Instance: 40027
Vary: Origin
Content-Type: image/gif
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Request-ID
Access-Control-Allow-Credentials: true
Content-Length: 43
Proxy-Host: pv.medialead.de

GET
H2 200 impression.php
t23.intelliad.de/ Frame 80AE 43 B
554 B 108ms
32ms Image
image/gif 3.65.87.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t23.intelliad.de/impression.php?cl=2353636373136323131303&cp=101&ag=248&bm=100&bmcl=5373735313236323131303&crid=101&timestamp=1695775145&co=
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=c1c83e8787&subid=&uid=20da64f4306a36a8&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCoGhXqHkTZYWIC4vXgAfKoLXYCqblvaBpvZOcp8kP8C4QASCTgrKaAWCVqp-CsAfIAQmpAnJ52OFfvLE-qAMByAObBKoEhAJP0CSB2jK-IM8sY7pdC5_t-MKxie49UDeQBUSbEmQ7FNB3dq8xnC7ACayl8iORYAHQqbxiztbh5M828UkcUMjLCvvMR4QMgyfVor3yvgn1zIxBNHGgBJ7aCANCDZmnrvrxH9I7D6JtHP7Ue4hx6lTPxmft8dg04XfcoFlOFC7I7UDXBdaGceBZ3BlSxDlT-QgB_wmBJDvaAffGFFgRZeY04_Kq1nfdU1HIRVFvNdYCe_Ic0_asHYjoQjm3oav7AzI65b_sIVBni9pLIq_jXW5lA5KyPdi6-yb33mszUmR4EIdZ0gVRfqvYI83sx0if35_Vu3XQSKHE6sWHgCMujBPq1L0ktcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAZgLAcgLAYAMAaoNAkRFyA0BsBPMnNkS0BMA2BMDiBQB2BQB0BUB-BYBgBcB%26ae%3D1%26gclid%3DEAIaIQobChMIhfzZ2MbJgQMViyvgCh1KUA2rEAEYASAAEgLOAvD_BwE%26num%3D1%26cid%3DCAQSPADICaaNKyPJ58GRIRJIJ11_2dtmqsfpoonygnUvtIyWOr66RRZLEW0pvrdcRO801qLQ4npRgYa9WMVePhgB%26sig%3DAOD64_1sUkI4Jo82WIs6fKk96f3HnLqGJg%26client%3Dca-pub-6413192959719959%26dbm_c%3DAKAmf-Ct6uoEPZcx5AQqOrdSj-wTxeI1EpqE6qN0o_46e39H_wW6DLTSFZ4CHS4mxQZYtB2CAwPLCSRbUR81G_qNH9QLb56u4rWMrs9X3cQ7K_X1RDfVVjtSxXD3l8lzeSy8-rE2W9mJX27Tzc5k36P7rLh2v9hM4Ia7OsvFDYwXTI3SW0EnRnE%26cry%3D1%26dbm_d%3DAKAmf-AUAtQxxwc2MzJ9jD1RoANG70MCxE0BVQoRFLhG9KXn3dRERKBfmm6Ksor3ptcfsOIgsS-Y_GhVcT6Z1yNOmgMMF569r1sw8L_zyHpweZ4u595RczYkBclvmzOIedVB1hDCd-ixF0USClprzmrVIQMJLik-VquyJ85GV6FpLOhyooivdHFKDSJEDCIBlFfpMk4cU7jTglDrR3H6xwNdEkgTcSTQ-DM34Pl1ZIEqcpzS4PP3PzcdY3F6Nkkrqs9E2iGEqRGZxShsxqNsJy5WnxRF1ZLb8rtPJolItZgKzoj5bkrGkMY7Ps4xBbI-cN95kF5iE2ydS1UwumdN4ka744Gmr0LVr8ycg6V7maiH_hzuCmz29-9an-HCnoOGKAgiBZjLw334ztoMNovKco4zk2EV3-XkHS3pXKLr2kwfvTImH0v1qnDnCg2MGQxSSgxvU6_C6HK1isJ3u_k7q2xBpKcvRff2UbQYmaP7MgU2zj3ogXXakqvmM4iXUGR0y_H5TCR6TRT9GDMxKKqxSXi0gRyt032ubVOvwleHAWt_ARziiTCYWgSBqVD3sTLLwr0A7SoC9vBr%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6413192959719959%26output%3Dhtml%26h%3D280%26adk%3D3317751963%26adf%3D3598894932%26pi%3Dt.aa~a.3559586387~rp.4%26w%3D584%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1695767944%26rafmt%3D1%26to%3Dqs%26pwprc%3D8994025055%26format%3D584x280%26url%3Dhttps%253A%252F%252Fwww.snowthaproductmerch.com%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1695775144076%26bpp%3D5%26bdt%3D1569%26idt%3D-M%26shv%3Dr20230925%26mjsv%3Dm202309260101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D893f26028c1e0217-22f090a297de0093%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w%26gpic%3DUID%253D00000c872f283a76%253AT%253D1695775143%253ART%253D1695775143%253AS%253DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw%26prev_fmts%3D0x0%252C584x280%26nras%3D3%26correlator%3D3382411098356%26frm%3D20%26pv%3D1%26ga_vid%3D370313908.1695775143%26ga_sid%3D1695775143%26ga_hid%3D192712713%26ga_fc%3D1%26u_tz%3D120%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D800%26ady%3D1687%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C44759837%252C31076838%252C44798934%252C31078216%252C44803790%26oid%3D2%26pvsid%3D842789656273050%26tmod%3D995138675%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D4%26uci%3Da!4%26btvi%3D2%26fsb%3D1%26xpc%3Dtgz5yBrREe%26p%3Dhttps%253A%2F%2Fwww.snowthaproductmerch.com%26dtd%3D81&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fwww.snowthaproductmerch.com&random=6274804542843&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.87.76 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-87-76.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: Apache
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW NID PSAo PSDo OUR STP OTC"
content-type: image/gif
cache-control: no-store, no-cache, max-age=0, must-revalidate
content-length: 43
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5FF0 0
20 B 58ms
58ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BPqVDqHkTZb6ENp-H1PIP256WiAsAAAAAOAHgBAI&bg=!b2ylbCPNAAbbC4-Z-ws7ADQBe5WfOA2SNJv71bhegCTe7FU0xaFH-F5Yvr78wupxXIaPOQDbSatmWGdqEiXVDkslBNN4AgAAAFlSAAAABWgBB5kDEmIWitVzStqbN5dAabP7oKiDU6JvV0VUmGE7QEUczTb9KBKkst4CNqgWqaNO8zPjnnzXTEOU-xkIZVXSOUXqbmrauMMmVb3zSHeLHo4yrFPgvUy7XnnshNFsOp6Ov8x-Y77EUTJJMz3OAwu1lQRGgUzLyUcU2r1XdkerhG9HNAUZeS4j4Aws4fGJOcHJofk3IFYvBDiVcpaAZ3R3Ee3Mwt5M-vu9xXRM5_Yf-SVmmWmOy38fW_U0lE15pw2kabMh6cI_3XW6FklpWjumwFuZrSMSc_c2OfHAEbaSdUU9O51plewTPWy7xJr4mRYq5PPvDHYMq-Qi4R-Ss6zti0vJTjZgSa0ciBCYFUuvJIuSCUhE8fDm4ELSyQOOcxYqI6rvyoT1wu52UwAJRD9wyVcTu9nNogg9NfIgCE3p0V8xh5MUrICgljyWzug_KulNi4VvPQIiTOc08J_0j2dWpbY44rPPPLWzLvWaBNdsPHP0HMQDelM3_jYfrDgzgifL5ehrk0z0eEZZz46AT3_ql9VnzOURMaoKFFd7xcDrDZK_jIH857_jRknq5WjE_e2MiZX0dgz-tx-gRrhnVBUqGKpzJt95tANqylaMlaZbwErrKshN2_3oy2GIln9OMIHBKG8PfTKoufFBZ__rPm59AE46y-BwKaqY6BT7jniGJ_fPY2s-DDrAFGkQHoEk5K9iaQaDEsEjEXOFpHwzQonCbqXUFSQgXnVEaYGA8Txe9aRdyyB7tLXuLzh5WMPKpJ5oHPtivoL67df_-tC0mAO-Cln0w4AqfXAmagvAcOL4bq5WJaUGOdMlSiyoceVwDnL9Y6LlZbl6aGQ1GiLu-W8NmIOKsJJ6fUr2Ughd-ol2IYQydI0SCHrovNCq2EzElJf4gOJsMqQpLFyD3bavchcal7J8VG0XBHuad94p5M8KqJ9Fp3GdpHGQMInCJ7-PhVEenQ5_soIpNxj3FRcWbEJaNVgs8s17d-Y_SryH3dDm7I58OAFQjS3PWJNz6sllRemDtTlbMMDGsFpNVIsiPeX_Y0yV4CQc9g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

activityi;dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875 Show response
8019191.fls.doubleclick.net/ Frame 6747
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875?

392 B
331 B

40ms
39ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f6.1e100.net

Software

cafe /

Resource Hash

8473010814ff64a86f7f71b1b72c12e6c56351048db683dd9ae6dffe23373aee

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Sep 2023 00:39:05 GMT
expires: Wed, 27 Sep 2023 00:39:05 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Sep 2023 00:39:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900013.redintelligence.net/ Frame 12E9 7 KB
2 KB 87ms
29ms Document
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: 66154157f99799ecd45582060e9b898a1c180f4b86e1b0cc2822db4b0fa38f24

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2129
Content-Type: text/html; charset=utf-8
Date: Wed, 27 Sep 2023 00:39:05 GMT
Expires: Wed, 27 Sep 2023 01:39:05 +0200
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2A5F 1 KB
643 B 21ms
21ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 17536
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 26 Sep 2023 19:46:49 GMT
etag: 48472445140208031
expires: Wed, 27 Sep 2023 19:46:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 80AE 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3813a492b9abbe95e9ad2a8cc332b007032acca682621ba7936361f16ac76568

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 7828 173 KB
62 KB 31ms
30ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4457b900df8f45b6c7c2f3ab089560873824dc5812ae62bff65f8036a78a1e48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63597
x-xss-protection: 0
last-modified: Wed, 27 Sep 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 27 Sep 2023 00:39:05 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2A5F
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESECmw6SdAWX2whw4Ypi1HgrY&google_cver=1&google_push=AXcoOmQExVt7ysF_A9KOZTECnutcpe3wL0N6sSApEuCTb9kn0yMAkrehsEuIUvlTvidNWiUheb5bc0keRPN0JYOkbqkSDj3tCIJSo86O
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzczMTYwNDczNTg0NjY1OTEyMg==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIglnSGSX7Ycn8NIX83_aBQ&google_cver=1

43 B
398 B

42ms
28ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIglnSGSX7Ycn8NIX83_aBQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: H2
Server: 2001:678:cb4:bbbb::11 -, , ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEIglnSGSX7Ycn8NIX83_aBQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 2A5F 70 B
148 B 52ms
49ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEHkG_YjFxwkAKEencG4WVvM&google_cver=1&google_push=AXcoOmROMEl-SIHDs9em-t3pwfvck9rpMfse5JYeoHykaEYN_kH_yumfY5oiRjCgQtEdzitzl4fieUNRXtnsGYZ4yLi8fw_36gqoEA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A5F
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHLGMZQcIHksWnN7pYca2a0&google_cver=1&google_push=AXcoOmS6Xb_ahmVq014jhR3-2GSETOFbsjYZhl5AunWxUNhIC3-zIJKJ3HScRnPnjbSdSK6D_MrfMQ4Tbbx...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmS6Xb_ahmVq014jhR3-2GSETOFbsjYZhl5AunWxUNhIC3-zIJKJ3HScRnPnjbSdSK6D_MrfMQ4TbbxSHs-I-E3ZDuBSRGbUwVRD&google_hm=ZtPDuptPQr2GeyDg...

170 B
188 B

33ms
32ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmS6Xb_ahmVq014jhR3-2GSETOFbsjYZhl5AunWxUNhIC3-zIJKJ3HScRnPnjbSdSK6D_MrfMQ4TbbxSHs-I-E3ZDuBSRGbUwVRD&google_hm=ZtPDuptPQr2GeyDgN8I-ToM

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:04 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmS6Xb_ahmVq014jhR3-2GSETOFbsjYZhl5AunWxUNhIC3-zIJKJ3HScRnPnjbSdSK6D_MrfMQ4TbbxSHs-I-E3ZDuBSRGbUwVRD&google_hm=ZtPDuptPQr2GeyDgN8I-ToM
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame 2A5F 43 B
145 B 23ms
21ms Image
image/gif 3.68.49.182
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEN5FTa0yojR0XpuFf8FLE7s&google_cver=1&google_push=AXcoOmTe85etCgbMbgpwyJtCZBBvh9FmHy6JNLGxTgXOrdVNgSCwOtkahpJh0kTz7PdSrciNzn3LBfvUo2ajLzfolsOvgSlP-_-tu8v0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.68.49.182 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-68-49-182.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A5F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGQ0SMXX7sxfmOFKBTpub8Q&google_cver=1&google_push=AXcoOmRxWjiG8o51vAmz9Ei0AKxjpAvpFL9nxLbvYZwHW2xAsKrIRADa4Pf0fCZaDBJNGAzmFF89FBGHxMQQJmsKtwNfZFZ...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRxWjiG8o51vAmz9Ei0AKxjpAvpFL9nxLbvYZwHW2xAsKrIRADa4Pf0fCZaDBJNGAzmFF89FBGHxMQQJmsKtwNfZFZjYlTpXk4&google_hm=eS1EUGFCMVBGRTJwRWY...

170 B
188 B

33ms
33ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRxWjiG8o51vAmz9Ei0AKxjpAvpFL9nxLbvYZwHW2xAsKrIRADa4Pf0fCZaDBJNGAzmFF89FBGHxMQQJmsKtwNfZFZjYlTpXk4&google_hm=eS1EUGFCMVBGRTJwRWYyRmFENHJqNzJHUkI5eGJxT25uU35B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Sep 2023 00:39:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRxWjiG8o51vAmz9Ei0AKxjpAvpFL9nxLbvYZwHW2xAsKrIRADa4Pf0fCZaDBJNGAzmFF89FBGHxMQQJmsKtwNfZFZjYlTpXk4&google_hm=eS1EUGFCMVBGRTJwRWYyRmFENHJqNzJHUkI5eGJxT25uU35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A5F
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEHnDpwWtHv5nVLHUX5AdLds&google_cver=1&google_push=AXcoOmRA4nqKH0KuzNBKcKCb1kOIJcIF_epA-IO9HoAH0Jcf7MONeJ9pkJr_XZEWGHN3nNtGlwpU4WV1witjuQEeQ70hUS_...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRA4nqKH0KuzNBKcKCb1kOIJcIF_epA-IO9HoAH0Jcf7MONeJ9pkJr_XZEWGHN3nNtGlwpU4WV1witjuQEeQ70hUS_4_4tB0ftD

170 B
188 B

34ms
34ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRA4nqKH0KuzNBKcKCb1kOIJcIF_epA-IO9HoAH0Jcf7MONeJ9pkJr_XZEWGHN3nNtGlwpU4WV1witjuQEeQ70hUS_4_4tB0ftD

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmRA4nqKH0KuzNBKcKCb1kOIJcIF_epA-IO9HoAH0Jcf7MONeJ9pkJr_XZEWGHN3nNtGlwpU4WV1witjuQEeQ70hUS_4_4tB0ftD
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A5F
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEAztOLU-RL-gNDhQxZtB9ew&google_cver=1&google_push=AXcoOmQRKOFDM7ItBHHs_Ae5_n_jtag6l023WZ3RoOGTOKWGsdHI7TEnxuBOkalQoqTIKJPp1TXwVl0AJQg1...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQRKOFDM7ItBHHs_Ae5_n_jtag6l023WZ3RoOGTOKWGsdHI7TEnxuBOkalQoqTIKJPp1TXwVl0AJQg1ArYYCnAVHg5E-dNzIh5x

170 B
188 B

34ms
33ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQRKOFDM7ItBHHs_Ae5_n_jtag6l023WZ3RoOGTOKWGsdHI7TEnxuBOkalQoqTIKJPp1TXwVl0AJQg1ArYYCnAVHg5E-dNzIh5x

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQRKOFDM7ItBHHs_Ae5_n_jtag6l023WZ3RoOGTOKWGsdHI7TEnxuBOkalQoqTIKJPp1TXwVl0AJQg1ArYYCnAVHg5E-dNzIh5x
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2A5F 0
12 B 32ms
30ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KbdDcEMnsgIGugNLWhCi-TaQIzFyOjR7QQsy7a69BmuABnJkBnRZd6HNx5QEQStXEyccql

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 80AE 51 KB
18 KB 99ms
23ms Script
text/javascript 18.66.147.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=87862600004614304444994012460013&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.147.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-147-52.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 43c969dd91796954ee5b0d995fddf5dc9b008844db541a4103c1d95b28ef2f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 02:14:35 GMT
content-encoding: gzip
via: 1.1 da78abc509aafffb42eec33ca2dc60d4.cloudfront.net (CloudFront)
last-modified: Mon, 07 Aug 2023 14:11:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 80671
etag: W/"cb7accb6a6fc086cd831549a78a2fe42"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: XrBnPTQs3NwHF8KMbw8mi3r6vf8DziC56IZaUMd5WDr6-sFldhcioQ==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 80AE 3 KB
3 KB 91ms
23ms Image
image/png 99.86.4.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1695775445&Signature=BE8FJZHblDNSE6YVC8fvjrcxzlQq-6Tw9nLRv0zEPIerQ1m1sr5y8iOXFT7CBaLB81ebYdWgs4v4PW6ghQfzC3gjCRdqMt7V-oH2k4AiszaBZyVenFdxQbmwhYBY0t2cbxI~9-41A1GoGsPGepvlHNKVbkJAjQnQGXqP1Yvy7fnvCI42oeB0xad813boJSUeXejyckvBZZXFjTQIWx3woG9DyUjB96vuAEE-8YkRMFBTYrk-08zI7PjQASN6alczLvLJ7L8lFllT2jFK~sB7leFphrho7fTYcIQfi93fGe1xxiZ7ZDWmWAX1CQUlOBa0TW3HZ3Iu1wG18dWDcDNOSw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6413192959719959&output=html&h=280&adk=3317751963&adf=3598894932&pi=t.aa~a.3559586387~rp.4&w=584&fwrn=4&fwrnh=100&lmt=1695767944&rafmt=1&to=qs&pwprc=8994025055&format=584x280&url=https%3A%2F%2Fwww.snowthaproductmerch.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1695775144076&bpp=5&bdt=1569&idt=-M&shv=r20230925&mjsv=m202309260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D893f26028c1e0217-22f090a297de0093%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbAv1ttESbP3-1X-rky2hiCtmKp9w&gpic=UID%3D00000c872f283a76%3AT%3D1695775143%3ART%3D1695775143%3AS%3DALNI_MbjlRhvwX1XK8HJuLLML35VGK8LUw&prev_fmts=0x0%2C584x280&nras=3&correlator=3382411098356&frm=20&pv=1&ga_vid=370313908.1695775143&ga_sid=1695775143&ga_hid=192712713&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=800&ady=1687&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31076838%2C44798934%2C31078216%2C44803790&oid=2&pvsid=842789656273050&tmod=995138675&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tgz5yBrREe&p=https%3A//www.snowthaproductmerch.com&dtd=81
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-94.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 26 Sep 2023 09:15:57 GMT
via: 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 69256
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: hf0Qbg5wLMb-oJsVdQyYTLkPFZ0WkgLE6y3njpdmaWdKARzIt3tPww==

GET
H3 200 css
fonts.googleapis.com/ Frame 12E9 5 KB
682 B 32ms
32ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 27 Sep 2023 00:39:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 26 Sep 2023 23:28:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 27 Sep 2023 00:39:05 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 12E9 16 KB
16 KB 85ms
32ms Image
image/png 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 654317ab56c16b574668e7ce724dba1827bcae2b78af96421527912f7e6b1292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16511
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 12E9 17 KB
17 KB 82ms
31ms Image
image/png 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 56b001e4a0af5ac5a73365fec65e45dc14f95035958b7cbdc3ba3c483de9f95d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 12E9 10 KB
10 KB 81ms
30ms Image
image/png 144.76.238.55
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71572/creativesup/iQ_Online-Deutschkurse_1200x627px.jpg
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.55.238.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 83538dd03490ae5f8d831e1453e41fdf6baf2ea100869b7bb4adff8f8ed12f82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10144
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 7828 271 KB
91 KB 38ms
37ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

606c757b8ee58ea72b142448df4b02c0e05f256d744e75b677d8fa3cc94dfb65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92719
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 27 Sep 2023 00:39:05 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C002 42 B
174 B 60ms
60ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssG_P6Ge3ASBeUb7QpTJmFrJQfNKkXC_o49LNk2vyjbipkXfMub4zOtxHsEqg3JLrB6I99F0EbenP_Xt2IrLRq5F6JsNIQIuj4B1ZHmyP0UA0rXEDOA-YSmIQKA4Xroi2cvoz-PHrAzduni&sai=AMfl-YQrs2Nu0F-7ci596eOlT8y_BOMBwfVy-sGJ6iGHaSizeP3jBJ4MPEA91fPZzj5HcZrqqhyp-NoU1MS2&sig=Cg0ArKJSzGgeqb7SAG_ZEAE&cid=CAQSGwDICaaNcGxUUIokq3h3nzmOhK4Zo26rmJYMPRgB&id=lidar2&mcvt=1006&p=0,0,124,1005&mtos=143,806,1006,1104,1104&tos=143,663,200,98,0&v=20230925&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1695775144277&rpt=321&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900013.redintelligence.net/ Frame 12E9 0
150 B 80ms
30ms Script
text/html 116.202.48.214
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900013.redintelligence.net/viewability?s=87862600004614304444994012460013&a=73cf8f3f&vb=m
Requested by: Host: hal900013.redintelligence.net
URL: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 116.202.48.214 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.214.48.202.116.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900013.redintelligence.net/request_content.php?s=87862600004614304444994012460013&a=d26e1b5c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Wed, 27 Sep 2023 00:39:05 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 12E9 14 KB
15 KB 22ms
21ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900013.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 23:04:46 GMT
x-content-type-options: nosniff
age: 351259
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 23:04:46 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 12E9 15 KB
15 KB 24ms
23ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900013.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Fri, 22 Sep 2023 03:41:01 GMT
x-content-type-options: nosniff
age: 421084
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Sep 2024 03:41:01 GMT

GET
H2 200 dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875
adservice.google.com/ddm/fls/z/ Frame 6747 42 B
401 B 116ms
59ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLrVudnGyYEDFeKf_Qcd6nMHqg;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=522041090520.34875?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 widget.js Show response
rccd-help.freshchat.com/js/ 66 KB
21 KB 382ms
119ms Script
application/javascript 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/js/widget.js

Requested by

Host: www.snowthaproductmerch.com
URL: https://www.snowthaproductmerch.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

7b8a937e123fbe8d977b7d2d9810495a086a36fb1eec0d52264b07bbeea7848d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-trace-id: 00-d97737474767fd346b98094350816b92-77bb6a2c1a0d3439-01
date: Wed, 27 Sep 2023 00:39:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
last-modified: Thu, 21 Sep 2023 04:10:41 GMT
server: fwe
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/javascript
x-fw-ratelimiting-managed: false
cache-control: max-age=900, must-revalidate
x-server: jgn6s
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: 83ab47a4-7080-9180-bc40-9ec8c93a7d8e

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 42ms
41ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230925&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35d0632b0780d51ef51656adfd282a626027ae7d498568cd36ee2fc29ba535d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12144
x-xss-protection: 0

POST
H3 204 rum Show response
www.snowthaproductmerch.com/cdn-cgi/ 0
186 B 27ms
25ms XHR
text/plain 2606:4700:3108::ac42:287d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.snowthaproductmerch.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v8b253dfea2ab4077af8c6f58422dfbfd1689876627854

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:287d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.snowthaproductmerch.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
content-type: application/json

Response headers

date: Wed, 27 Sep 2023 00:39:05 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.snowthaproductmerch.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 80cfb0064a561907-FRA

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 27 Sep 2023 00:39:06 GMT

GET
H2 200 339a9ad746a4a4e9a18a4d3eb33b425b.jpeg
cdn.lazyshop.com/files/6be80a53-9109-456f-89be-007943558ce9/product/ 152 KB
152 KB 23ms
23ms Image
image/jpeg 2600:9000:236e:3a00:7:4ac9:1e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.lazyshop.com/files/6be80a53-9109-456f-89be-007943558ce9/product/339a9ad746a4a4e9a18a4d3eb33b425b.jpeg?x-oss-process=style%2Fthumb
Requested by: Host: cdn.lazyshop.com
URL: https://cdn.lazyshop.com/assets/aa8dd7f8ef41bb1d7e5abe8a29b4e318/lazysizes.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:3a00:7:4ac9:1e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AliyunOSS /
Resource Hash: 4e88ba3dd91c32ee9f392d2b0a9370cc1a033ad43eb48a2e28487fbfb8228949

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:07:54 GMT
via: 1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront)
x-oss-request-id: 6513725A2A8F620F84C328DA
x-amz-cf-pop: FRA60-P1
age: 1872
x-cache: Hit from cloudfront
content-length: 155339
x-oss-object-type: Normal
last-modified: Thu, 13 Apr 2023 08:05:52 GMT
server: AliyunOSS
etag: "481DA45D549F5685262245DD4ABF0A97"
vary: Origin
content-type: image/jpeg
x-oss-storage-class: Standard
x-oss-hash-crc64ecma: 5171534112483184331
x-amz-cf-id: 2GchEIbmB0cCEYEyOAbgBnEutmsFxhhpF53rQ3chr34vTHKIgSdNdA==
x-oss-server-time: 38

GET
H2 200 339a9ad746a4a4e9a18a4d3eb33b425b.jpeg
cdn.lazyshop.com/files/6be80a53-9109-456f-89be-007943558ce9/product/ 326 KB
326 KB 23ms
22ms Image
image/jpeg 2600:9000:236e:3a00:7:4ac9:1e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.lazyshop.com/files/6be80a53-9109-456f-89be-007943558ce9/product/339a9ad746a4a4e9a18a4d3eb33b425b.jpeg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:3a00:7:4ac9:1e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AliyunOSS /
Resource Hash: c21a3e1e339e1cedbb059c5b65f73caf4c9a792b92969a575bd448deade19cb9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:07:55 GMT
via: 1.1 a300dbfb49a2eb50edb83038642c9f82.cloudfront.net (CloudFront)
x-oss-request-id: 6513725BFB966AC7725E58EC
content-md5: SB2kXVSfVoUmIkXdSr8Klw==
x-amz-cf-pop: FRA60-P1
age: 1871
x-cache: Hit from cloudfront
content-length: 333437
x-oss-object-type: Normal
last-modified: Wed, 16 Nov 2022 02:56:15 GMT
server: AliyunOSS
etag: "481DA45D549F5685262245DD4ABF0A97"
vary: Origin
content-type: image/jpeg
x-oss-storage-class: Standard
accept-ranges: bytes
x-oss-hash-crc64ecma: 4995001442697337050
x-amz-cf-id: 8NTjSgXXiXS9Emz560YBigQNmDCWdViV2i__-sjAAsGpBebt8D0yYw==
x-oss-server-time: 9

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame A2B4 13 KB
5 KB 27ms
25ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11722
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Sep 2023 21:23:44 GMT
expires: Wed, 25 Sep 2024 21:23:44 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D368 829 B
561 B 33ms
31ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c1a36e505660ee0cf2285812685d66a15f29becdee295870cf94e244afd2b2df

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MPNtAqJ3zGlzKeFAuiCakA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MPNtAqJ3zGlzKeFAuiCakA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 27 Sep 2023 00:39:06 GMT
expires: Wed, 27 Sep 2023 00:39:06 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D368 0
0 55ms
55ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230925&jk=842789656273050&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

GET
H3 200 tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js Show response
pagead2.googlesyndication.com/bg/ Frame A2B4 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/tGcDLxZnxcZjneq6ZTfMhLSKmVRaNAcBIKHxIKG0fIc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b467032f1667c5c6639deaba6537cc84b48a99545a34070120a1f120a1b47c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 20:36:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14548
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14772
x-xss-protection: 0
last-modified: Mon, 18 Sep 2023 15:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Sep 2024 20:36:38 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame A2B4 0
12 B 21ms
20ms Image
text/plain 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?cD7DNQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:06 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 config_iframe.html Show response
rccd-help.freshchat.com/widget/ Frame 22E6 701 B
1 KB 120ms
119ms Document
text/html 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/widget/config_iframe.html?host=https://rccd-help.freshchat.com&token=228e12ce-8cde-43bf-a234-6a17a0742420&origin=https://www.snowthaproductmerch.com

Requested by

Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-9-77-36.eu-west-2.compute.amazonaws.com

Software

fwe /

Resource Hash

bae1f759fd4cd9055a14e9384f474c8e53358ea04bffda92bde1e11b0599c61c

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding: gzip
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-type: text/html
date: Wed, 27 Sep 2023 00:39:06 GMT
last-modified: Thu, 21 Sep 2023 04:10:41 GMT
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
server: fwe
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1
x-fw-ratelimiting-managed: false
x-request-id: a548a24b-4885-9e1c-9408-3d5b1d080179
x-server: jgn6s
x-trace-id: 00-d830fb883084eaf42ed81864dd6a6427-28a2d5292747e945-01
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 169ms
42ms Preflight 3.9.77.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.9.77.36 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-9-77-36.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 27 Sep 2023 00:39:06 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 80AE 16 B
209 B 95ms
95ms Fetch
application/json 3.9.77.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.9.77.36 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 27 Sep 2023 00:39:06 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

GET
H2 200 config Show response
rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/ Frame 22E6 3 KB
2 KB 421ms
421ms Fetch
application/json 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/config?domain=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=

Requested by

Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/config_iframe.html?host=https://rccd-help.freshchat.com&token=228e12ce-8cde-43bf-a234-6a17a0742420&origin=https://www.snowthaproductmerch.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

1bd86c35a8d1b7b74d304d3a3f5c6d626077ba61e863cfbced1a5b0b9fb8209f

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/widget/config_iframe.html?host=https://rccd-help.freshchat.com&token=228e12ce-8cde-43bf-a234-6a17a0742420&origin=https://www.snowthaproductmerch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:06 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 302
x-xss-protection: 1; mode=block
x-request-id: c21e8e40-e1c0-44e0-8bf3-9592096a8157
x-trace-id: 00-a8245deb5de3742fac4b1592a944bfeb-40d8af852dd1b5eb-00
server: fwe
vary: accept-encoding
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 9886
x-ratelimit-remaining: 2999
x-ratelimit-limit: 3000

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 58ms
58ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230925&jk=842789656273050&bg=!np2lndLNAAYrDsWMCw47ADQBe5WfOLGb5LxoM1g0eXYI2oWkRLN5n8ZU0XcdpksuwGGlk7MhG4Kx5PSSYm4cPGCoIgTfAgAAAEJSAAAAB2gBBwoAVZ0Epxd_ofUlgJ_y_tcFAFraLOmzz11yjMT5_dLBtAO2iujQIWjBlYbt3H3nYgzdag0_lU2ZFpOlteFBODRikie4b2RLjb1FVzE-3ccMZPI0CdMgGcyZAsVlD4bPOUjnVipAr1UXDNvTAF3YNWOz3Rs8Lx_9vBrugDDshG0rNdQh32ek4LlgbVpWy2ddipsKfzSFytpZ2bb74OTYowMsxxmvZOTdEbT_9fxW_yqls-L-PrgOh91tAmMs6Yn0Q5CbQu986X-vyrXLg0BMHVKHskRG3FCLFWNA3PAZoGH6xJ0uj1WnF6ngRYkeGjEJ19zguGus1Yej7EO9sjZ9S6EAp8EdnfNZpwFIQAoBDTghotDPWUXt-3vGlLV4Dlfuh_1pem8YKTOrzMpwZ0oRwTuC9Lnfg_FxzyitO2SLi3-z1ZLx9dj1pt7odaP1vC9lOoSwDmRbtAwt_-Bdp-1cH-Ms2JEQUspr8BOxe9XaakZ9ISQG-VP2DQNzyaiLE-FS0Jc5XwHDM3SW5SQM4yNa0pT1hMafZIS-LnzHIOHfr66HNOHKb_U43Q9F_H1okaEJDZIEU0uqP4aA3snt-RMVH7EjdNqVpn3ahpfszoHFFxAmwGxORjIkCxXRywZc8_K-IVqd_0wC4_pkldcN1Ni5h0gsYrzsDf4HPj6uEEoTSVpcE5MkzS0YpylgWA8k9TG3Ytb_QguLA1pSj-HhW6F260VdXsSVauXT-yS1Pam6aYi6udDF75XW3k_hpXvW2jEkEp9zDZSzGWLqlNJql1ftNQ6dd7M3ZRSRkZ9Qo9rSR5fi3CY6dSosRfFUpH3VxAGe8DjW7HEguXg8D-FC2KOhGz-SOBaz3duw7yWRYuVV6YIYxiAeuZEAFRlxKD9foZ3PUsWWxEh_AgPPPK8MFgXe9XwpQw2407w-tX8RVigogMt-m2XTuZ4Fos6vJLlseUMDxhBZ-FIoaP-35r2pWtVrrHTetw1wNfyHhraqjavy9wGFwILbBnQHjW5UUfyrZTOM-zbx_qx-NJcw8oJmIZ6mdGmKOzPOkri2-ENAcYLiDMLk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 80AE 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6489409035599&version=m202309120101&ct=77&x=1&cor=3541991678893509000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Sep 2023 00:39:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
rccd-help.freshchat.com/widget/ Frame 044A 5 KB
2 KB 118ms
117ms Document
text/html 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true

Requested by

Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

9361bb97aaf8bc03c697c81e19b9d73fe7f791b094c082fc0bd60ce8c714445d

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-encoding: gzip
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-type: text/html
date: Wed, 27 Sep 2023 00:39:07 GMT
last-modified: Thu, 21 Sep 2023 04:10:41 GMT
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
server: fwe
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 0
x-fw-ratelimiting-managed: false
x-request-id: 3ce9b12e-4d08-498d-bc88-81cb8bbc60dc
x-server: bs84j
x-trace-id: 00-e5a4f804424da2a85f76f64b17e64de1-f670135d50ecdf48-00
x-xss-protection: 1; mode=block

GET
H2 200 widget.css
rccd-help.freshchat.com/widget/css/ 9 KB
2 KB 118ms
118ms Stylesheet
text/css 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/widget/css/widget.css?t=1695775147016

Requested by

Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

1746b268addac39a01bc462c8e85434841637a136be1c0234b2eae14988e3d3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 0
x-xss-protection: 1; mode=block
x-request-id: a2105f94-4822-4baf-8898-27920b610aef
x-trace-id: 00-2e45a422aa1b4122f9ee2f2489de076d-ffe16b1c524cc6f4-00
last-modified: Thu, 21 Sep 2023 04:10:41 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: text/css
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: h4jv6
expires: Thu, 26 Sep 2024 00:39:07 GMT

GET
H2 200 vendor.d64d219ca4493f67a3970efc52d51c86.css
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 23 KB
4 KB 98ms
23ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.d64d219ca4493f67a3970efc52d51c86.css
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f2154f49d7d4ed6c74a1ad1dc0e39ef3136fd859059986ed5bcd3050d59867b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:37:11 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Tue, 12 Sep 2023 08:21:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 117
x-amz-server-side-encryption: AES256
etag: W/"d64d219ca4493f67a3970efc52d51c86"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: tx7RuvHDDTEnHZQmYl1rQVcw-SFbz9jEakaKwGTSXYk0k6TaPEDEbQ==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 hotline-web.d41d8cd98f00b204e9800998ecf8427e.css
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 0
419 B 99ms
24ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/hotline-web.d41d8cd98f00b204e9800998ecf8427e.css
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:38:28 GMT
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
age: 221
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 0
last-modified: Wed, 09 Aug 2023 06:20:45 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, no-transform, public
accept-ranges: bytes
x-amz-cf-id: ed6V2QJYMK5CMBLkNXpNyTfiJz3BIPosIqPELKeX2kSW0o4LtJ7pug==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 vendor.862630a2b93632e0d7bbae6d63246102.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 684 KB
181 KB 103ms
29ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a7fecbfe24b0884ff617e8bb7bd0871397a39e6de70a6d2ff276743988f532bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:38:31 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Wed, 09 Aug 2023 06:20:46 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 37
x-amz-server-side-encryption: AES256
etag: W/"862630a2b93632e0d7bbae6d63246102"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: x1TRzUBCCHWNV_VmqmmdrJV-DjmvKTJ8h6UHqiG0bHf1nBkZr-rU5A==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 211.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 772 KB
178 KB 24ms
24ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/211.js
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6433a43310293748cf1fddd99a260723f22d8202abe6c37e736716eb1f0a7c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:36:16 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Thu, 07 Sep 2023 11:12:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 172
x-amz-server-side-encryption: AES256
etag: W/"47c822f8cee790a907c6e7dd37148e0b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: Gr1d3keIsbD8xwbavg03wElDUXwOC0HKyfDmz132TpmFWktgaCMrhg==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 chunk.3a80c234f146afda721e.css
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 241 KB
26 KB 27ms
27ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.3a80c234f146afda721e.css
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7d7a4516a3cd6e5122e536a9d76bffbc6a0c59d79dad627a221448e938e796a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:37:52 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Tue, 19 Sep 2023 04:12:30 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 76
x-amz-server-side-encryption: AES256
etag: W/"62cc2796db3fb2dcce37e137a6e35d5e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: NtqET2EIt5vjhc0K3Q5wXOvqYGk32DYqASxj012LA-oDSVmF1UpMUw==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 fd-messaging.380916c37c66f792f79c.css
assetscdn-wchat.freshchat.com/static/ Frame 044A 241 KB
30 KB 24ms
23ms Stylesheet
text/css 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/fd-messaging.380916c37c66f792f79c.css
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7d7a4516a3cd6e5122e536a9d76bffbc6a0c59d79dad627a221448e938e796a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:38:28 GMT
content-encoding: gzip
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Thu, 21 Sep 2023 04:10:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 40
x-amz-server-side-encryption: AES256
etag: W/"62cc2796db3fb2dcce37e137a6e35d5e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: Pw3Gd4YO0phhsd6o7e3v1cC6tx-C26sRn_0TYflOpvluU2Y6vkzR_A==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 fd-messaging.1acdd59e8f9011a5efd3.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 734 KB
131 KB 24ms
23ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.1acdd59e8f9011a5efd3.js
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d4f61934704c64e7dd135e1b8426cf52254391873239f397fcca7493fa0a93a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:34:21 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Tue, 19 Sep 2023 04:12:31 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 287
x-amz-server-side-encryption: AES256
etag: W/"8283dfb7914678e24b466359167b7f4d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: cWb82CTa0_9WCTTNMZW2wV0_cNjQvj8IFC-Xk9ZKDGRImnbQm0B4gQ==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 rts-min.js Show response
rts-static-prod.freshworksapi.com/us/ Frame 044A 82 KB
25 KB 109ms
33ms Script
text/javascript 108.138.17.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rts-static-prod.freshworksapi.com/us/rts-min.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.1acdd59e8f9011a5efd3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.126 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-126.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 637ae8e55dd9c6199b38e4b0a04f7960a4564fab961c5046702eb27b019f514c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

x-amz-version-id: _X3Qz9F7lBkY6fY5ZFJvKfTDFca1Mb.F
content-encoding: gzip
via: 1.1 a5010656f4f762c0fdffac3448496b86.cloudfront.net (CloudFront)
date: Wed, 27 Sep 2023 00:39:07 GMT
last-modified: Thu, 04 May 2023 08:20:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
age: 1
x-amz-server-side-encryption: AES256
etag: W/"b93463e6b790a2959a44cc7ba847f9ab"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: no-cache
x-amz-cf-id: _uXBbxEYnCgfb9Oyul3jwK-WbIsiFd0WVGDrJV1g3HEKfCMvoPAqSA==

GET
H2 200 chunk.e1834018f36730ec3479.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 5 KB
2 KB 27ms
27ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.e1834018f36730ec3479.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.1acdd59e8f9011a5efd3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d6589cf3446237a8154674f6dafc22dc2c0490876f4d249e349424ac6bd77261

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:38:09 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Thu, 07 Sep 2023 11:12:59 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 58
x-amz-server-side-encryption: AES256
etag: W/"57733f88b8a5194b15dc07116f522afd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: ZNamIuZsUArCdosMzIQW8NZbOUdLSswivBCvAjCAu0CUXI0bhGFxDA==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 chunk.548e16189bbeee12faa9.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 11 KB
4 KB 26ms
26ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.548e16189bbeee12faa9.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.1acdd59e8f9011a5efd3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f530858d6b8c4825ccca831a3c90ba5753effa5d816b36e7c9ecb12d4b2d163

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:36:01 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Wed, 20 Sep 2023 04:21:46 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 188
x-amz-server-side-encryption: AES256
etag: W/"bec55576611cf94c37a8762b1dcbf57c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: fHJBgTfxbvhhxOvsqZ2TGk3ni5es2E1whqr3mZ7MDV_538Y-cvnKGw==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 co-browsing.js Show response
rccd-help.freshchat.com/widget/js/ 26 KB
8 KB 122ms
122ms Script
application/javascript 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/widget/js/co-browsing.js

Requested by

Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/js/widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

1e10e9493470eb296ba1ba705a39455e226be2906bd24a41e1f2b8287ff8f62b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 1
x-xss-protection: 1; mode=block
x-request-id: 10b28dab-d4ae-48b1-a448-afc682dece4d
x-trace-id: 00-cf5835812142f8b7a3fe1a0cc1ee8316-c5c070ffb6d61f06-00
last-modified: Thu, 21 Sep 2023 04:10:41 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/javascript
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: bs84j
expires: Thu, 26 Sep 2024 00:39:07 GMT

GET
H2 206 notif.da662fefc5060dabf2859ea199198b14.mp3
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 4 KB
5 KB 26ms
26ms Media
audio/mpeg 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/notif.da662fefc5060dabf2859ea199198b14.mp3
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eb2e3f703cf8ee0156a1d625e053c0968b0dfcff62ea4254ddd8ba9fece3ad32

Request headers

Referer: https://rccd-help.freshchat.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 27 Sep 2023 00:39:07 GMT
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
age: 8
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-4301/4302
Content-Length: 4302
last-modified: Mon, 11 Sep 2023 04:57:17 GMT
server: AmazonS3
etag: "a529450a7cfb4a60dea41ef294fa90dd"
vary: Accept-Encoding
content-type: audio/mpeg
cache-control: max-age=31536000, no-transform, public
accept-ranges: bytes
x-amz-cf-id: Fwwbn8CCQW4_DT3-nJgPKQPBFV6HgA3m1HUe_DnYnhqCHpE4KS_viw==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 user Show response
rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/ Frame 044A 63 B
1000 B 124ms
124ms XHR
application/json 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/user

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

02a00e3ef645e0351f654665d42b03388e6a73e0ab4f853c8904faecf322b229

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:07 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 3
content-length: 63
x-xss-protection: 1; mode=block
x-request-id: 3ef738d5-163f-4818-a803-98488856ada1
x-trace-id: 00-8c6742a394010153144a68cee6789715-b36c81056dee2873-00
server: fwe
x-ratelimit-remaining: 2998
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 9886
x-ratelimit-limit: 3000

GET
H2 200 cb.css
rccd-help.freshchat.com/widget/css/ 1 KB
1 KB 118ms
118ms Stylesheet
text/css 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/widget/css/cb.css?t=1695775147819

Requested by

Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/widget/js/co-browsing.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

8029982e606b01f8d1651a46683c7a90ef2496e73823047c0e73b72e285d593e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-envoy-upstream-service-time: 0
x-xss-protection: 1; mode=block
x-request-id: 8923b8d7-6694-418e-8e0a-6065a30c4349
x-trace-id: 00-f8fea4933eb74736c104a4248ba5fd1f-02ed4c3b30326b18-00
last-modified: Thu, 21 Sep 2023 04:10:41 GMT
server: fwe
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: text/css
x-fw-ratelimiting-managed: false
cache-control: max-age=31536000,no-cache, no-store, must-revalidate, pre-check=0, post-check=0,public
x-server: bs84j
expires: Thu, 26 Sep 2024 00:39:07 GMT

GET
H2 200 widget_info_v2 Show response
rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/ Frame 044A 7 KB
3 KB 120ms
120ms XHR
application/json 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/widget_info_v2?locales=en-US,en-US&platform=web

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

598363693b32ae62baf8a5615d87e3201144f4cb5b0b749e3bf2791d9d77afc8

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:07 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 0
x-status: HIT
x-xss-protection: 1; mode=block
x-request-id: 8100c302-1508-9c67-8aa7-89a6dcc1b23e
x-trace-id: 00-47270ffa70a1a982f1280cf5425c4f5f-c46800417460a85b-01
server: fwe
vary: accept-encoding
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 3063
x-ratelimit-remaining: 2997
x-ratelimit-limit: 3000

GET
H2 200 chunk.12ad43181c915c02a8cc.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 81 KB
17 KB 25ms
25ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.12ad43181c915c02a8cc.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.1acdd59e8f9011a5efd3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5d8a3dee212fde4a855147d50053121cbc9dbeec028704205d0890cf5c6ff80b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:34:26 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Tue, 19 Sep 2023 04:12:29 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 284
x-amz-server-side-encryption: AES256
etag: W/"daebf4a5cb24649cd0b81325a1236c9d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: Z9GS-yt3XPfgvlwy_7pKcwsYwsByUiuHbGMYExsKdscgjplv1cdpmQ==
expires: Wed, 25 Sep 2024 05:00:27 GMT

GET
H2 200 chunk.eaaa0af46890ad6203d2.js Show response
assetscdn-wchat.freshchat.com/static/assets/ Frame 044A 277 KB
48 KB 26ms
26ms Script
application/javascript 143.204.215.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assetscdn-wchat.freshchat.com/static/assets/chunk.eaaa0af46890ad6203d2.js
Requested by: Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/fd-messaging.1acdd59e8f9011a5efd3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-23.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: baf62e391f405c273590e478bf7bb7d91eeea31336d1cfd99723af08f6adedbb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:36:38 GMT
content-encoding: br
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Tue, 19 Sep 2023 04:12:31 GMT
server: AmazonS3
x-amz-cf-pop: FRA53-C1
age: 155
x-amz-server-side-encryption: AES256
etag: W/"13b940b3954d797f346b158a03d3113e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=31536000, no-transform, public
x-amz-cf-id: VxjzipyFhQXoKDU8pfFN-rAmOcxsTlsnXp8Dbi82FgKld-FFqSlfLg==
expires: Wed, 25 Sep 2024 05:00:27 GMT

PUT
H2 200 activity Show response
rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/user/422bdf8d-e0b3-4f38-a5d7-9bfaf66b2355/ Frame 044A 17 B
954 B 123ms
123ms XHR
application/json 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/user/422bdf8d-e0b3-4f38-a5d7-9bfaf66b2355/activity?widgetInfoTraceId=9fc43691-a2a5-45f0-86dd-6969659c072a

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/211.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

fwe /

Resource Hash

f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Security Headers

Name	Value
Content-Security-Policy	style-src 'unsafe-inline' ; font-src 'self' data:; img-src 'self' * data:; connect-src 'self' ; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.freshchat.com https://.freshworksapi.com; child-src 'self' blob:; media-src 'self' https://.freshchat.com; manifest-src 'self' https://.freshchat.com; default-src 'none';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rccd-help.freshchat.com/widget/?token=228e12ce-8cde-43bf-a234-6a17a0742420&referrer=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=&eagerLoad=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 00:39:08 GMT
content-security-policy: style-src 'unsafe-inline' *; font-src 'self' * data:; img-src 'self' * data:; connect-src 'self' *; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.freshchat.com https://*.freshworksapi.com; child-src 'self' * blob:; media-src 'self' https://*.freshchat.com; manifest-src 'self' https://*.freshchat.com; default-src 'none';
strict-transport-security: max-age=31536000; includeSubDomains
nel: { "report_to": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true}
x-ratelimit-total: 3000
x-ratelimit-used-currentrequest: 1
x-envoy-upstream-service-time: 4
content-length: 17
x-xss-protection: 1; mode=block
x-request-id: 9f35c347-2ed3-9f44-92ed-d9497c33c724
x-trace-id: 00-2053666ec67351f90198cee6bf1e9595-0b749b2fa61216f3-01
server: fwe
x-ratelimit-remaining: 2996
report-to: { "group": "nel-endpoint-freshchat", "max_age": 2592000, "include_subdomains": true, "endpoints": [{"url": "https://edge-admin.us-east-1.freshedge.net/nelreports/freshchat"}]}
content-type: application/json;charset=UTF-8
x-fw-ratelimiting-managed: true
cache-control: no-store
access-control-allow-credentials: true
x-server: 5323
x-ratelimit-limit: 3000

GET
H2 200 index.html Show response
723048247012081.webpush.freshchat.com/ Frame 5794 30 KB
7 KB 475ms
405ms Document
text/html 108.138.7.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://723048247012081.webpush.freshchat.com/index.html?ref=aHR0cHM6Ly93d3cuc25vd3RoYXByb2R1Y3RtZXJjaC5jb20=
Requested by: Host: rccd-help.freshchat.com
URL: https://rccd-help.freshchat.com/js/widget.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.7.43 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-7-43.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 05a530dd5d40bf5dbef4e3d5ed6976e9aec1baf49a20be30e07b1608918e3bc3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 27 Sep 2023 00:39:09 GMT
etag: W/"4d98f93ebe4eb8cedbbfdb3004920aeb"
last-modified: Fri, 25 Oct 2019 06:53:38 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 8d07edb8bf98788bf512d51f8cc554f6.cloudfront.net (CloudFront)
x-amz-cf-id: JEH7RN2h8W0v2g6lGQbFkGngiWnv4UZqJbflV4yCX5iluae0z9R3tQ==
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront

GET
H2 200 categories Show response
rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/omni/faq/ Frame 044A 81 B
1 KB 159ms
159ms XHR
application/json 13.248.221.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://rccd-help.freshchat.com/app/services/app/webchat/228e12ce-8cde-43bf-a234-6a17a0742420/omni/faq/categories?per_page=100&platform=web&locale=en-us&page=1

Requested by

Host: assetscdn-wchat.freshchat.com
URL: https://assetscdn-wchat.freshchat.com/static/assets/vendor.862630a2b93632e0d7bbae6d63246102.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.221.98 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS