femme4.com Open in urlscan Pro
172.67.153.71 Public Scan

Software

sffe /

Resource Hash

389e8e92a2c5ec60237daf64bbca63e5eab2192578723c6022a1343ac857a3b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1000 / 536 of 1000 / last-modified: 1632741118"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25702
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Sep 2021 18:55:51 GMT

GET
H2 200 pre_pws.js Show response
fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/ 534 B
1 KB 156ms
19ms Script
text/javascript 151.101.130.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pre_pws.js?type=default
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 95f2cbf262679817a73625e041af10779dddb0b05c81f0418c4c3b89e5f45e8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
age: 34319
x-guploader-uploadid: ADPycduT4DSwguUOqV5c7Xjx5h3j_C-XhYc01DiLq2hPfx4pOIFJMBJoP01ijg8jkaUzeczDcjzBD0ih-utlp5YgUoE
x-cache: HIT, HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-restarts: 0
x-verify-21-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/pre_pws.js
content-length: 305
x-served-by: cache-mdw17348-MDW, cache-hhn4067-HHN
last-modified: Tue, 14 Sep 2021 20:08:58 GMT
server: UploadServer
x-file-loc: primary0
x-timer: S1632768952.584692,VS0,VE0
etag: "bf661349cca51901bbf66e872a84e79a"
x-orig-url: /script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pre_pws.js?type=default
vary: Accept-Encoding
x-goog-hash: crc32c=iTGIWQ==, md5=v2YTScylGQG79m6HKoTnmg==
x-goog-generation: 1631650138465050
via: 1.1 varnish, 1.1 varnish
expires: Fri, 17 Sep 2021 16:29:48 GMT
cache-control: public, max-age=43200
x-goog-stored-content-length: 534
accept-ranges: bytes
content-type: text/javascript
x-cache-hits: 1, 2

GET
H2 200 pws.js Show response
fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/ 498 KB
149 KB 13ms
13ms Script
text/javascript 151.101.130.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 40f197681407af74d591310154c8691a2b032b2403ae4747af22b7bf14637bbe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
age: 33583
x-guploader-uploadid: ADPycduNrKFN4vUO_fqAC4nlN0i7vCEV_BLnYzfv9VGipLf3t_Udg0sCayETDr19Zd0sNa_kvurIexkQR0BmcehsKr2bbUlq6g
x-cache: MISS, HIT
x-goog-storage-class: STANDARD
x-split-fraction: 10
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-restarts: 0
x-verify-21-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/s/DE/desktop-pws.js
content-length: 151904
x-served-by: cache-mdw17377-MDW, cache-hhn4067-HHN
x-verify-12-url: /prod/sites/6/7/5/6758a527-c373-49a4-94e6-5a958edc9a2a/default/s/DE/desktop-pws.js
last-modified: Mon, 20 Sep 2021 20:20:48 GMT
server: UploadServer
x-file-loc: primary0
x-timer: S1632768952.718286,VS0,VE2
etag: "1df3f2383f5757fc9fefabcb245d90e0"
x-orig-url: /script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
vary: Accept-Encoding
x-goog-hash: crc32c=5fU51g==, md5=HfPyOD9XV/yf76vLJF2Q4A==
x-goog-generation: 1632169248508192
via: 1.1 varnish, 1.1 varnish
expires: Fri, 24 Sep 2021 07:03:23 GMT
cache-control: public, max-age=43200
x-goog-stored-content-length: 510113
accept-ranges: bytes
content-type: text/javascript
x-c-host: S
x-cache-hits: 0, 1

GET
H3 200 cropped-cropped-femme4-wide-logo.png
femme4.com/wp-content/uploads/2020/08/ 14 KB
14 KB 28ms
28ms Image
image/png 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/cropped-cropped-femme4-wide-logo.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d695786f3300c1fdf80b2d5f3d01aefb95f629999b2bdba76114e3df27eeee96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2020/08/cropped-cropped-femme4-wide-logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5729749
vary: Accept-Encoding
content-length: 13937
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 31 May 2021 18:33:22 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "60b52bf2-3671"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W2CaMdaqC1X21IKMd%2FZEB7SdDbbu2hrf9GvGu9jODirlnQHlYPGh4qmomf27knVALBT64%2BDHzgrojsxUp%2FxteAplF%2B5kzChlx9sawDkd7LnoMQWuixXuWI3ATiBG"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc3f493b61-CDG

GET
H3 200 wp-emoji-release.min.js Show response
femme4.com/wp-includes/js/ 18 KB
5 KB 60ms
60ms Script
application/javascript 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.8.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1572822
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Jul 2021 19:02:13 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ff06b5-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JOEdAI2LZj%2B5wLKJRKxiBLZgBR5VBjLPPf8HHW3W%2BNLzaSo2kvMxvgE0Hsi1BZ5zKgUsDgh44HuPTijh7MZxLKYgMRSiZAmanlPit8GWnf%2FvphNN4O384%2FcTxlwz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6956f2dc3f4c3b61-CDG

GET
H3 200 offside.min.js Show response
femme4.com/wp-content/plugins/gp-premium/menu-plus/functions/js/ 6 KB
3 KB 25ms
25ms Script
application/javascript 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.1.0-alpha.3

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ab6ba1e7e051b464b2a5855abc359ba0f4cde98edc2335e2648bbfe5a35cf38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.1.0-alpha.3
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 717698
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 19 Sep 2021 10:42:02 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"614713fa-1631"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=luDVe78WsGqnT9fg2buc53oX3pGuOPiyFU3x843r0uTB4mIhMjzl0Q5fPxGk%2FjTML0m8kSakp0RsnJwYFlKkfqhDelwhrgRa3ucEZ8SZNE0aI2J6TVZLDuLW5JHu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6956f2dbbe003b61-CDG

GET
H3 200 main.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 21ms
21ms Script
application/javascript 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/main.min.js?ver=3.0.4

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0901279dec1117310802c450665b34a60788da4a00e066d2de367327cd13456

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/generatepress/assets/js/main.min.js?ver=3.0.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5729749
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Jul 2021 22:48:58 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ecc6da-1c98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Lcznha8SeRxh%2FRNBM893JuCMJF2TXX7qdUypWY5eJcQOnLTL0u0h0v17hz6y7GbmJczpYXNgbWxkZsDdUhypOR93zkMA3Frtv2jJATVX5titJYwyjvWpy4uFeej"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6956f2dbde4c3b61-CDG

GET
H3 200 navigation-search.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 2 KB
1 KB 23ms
23ms Script
application/javascript 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.0.4

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

199898d01ee6a242c64dc62559177261862ebfd52ee6903eddb87017cfa6d295

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.0.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5729749
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Jul 2021 22:48:58 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ecc6da-87a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bzW%2FbVqxKP%2BkCjNzXqadniK6c0mVmPDwVfxzrbs8bG7rEkI96eq%2BRoJfE1NXM%2Fae1sHxVgaC4OEm8E8NL5zy0MHtocu85anv3UkBZxGjulOgQ4p0tX4rLK9KaXfj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6956f2dc0e863b61-CDG

GET
H3 200 back-to-top.min.js Show response
femme4.com/wp-content/themes/generatepress/assets/js/ 712 B
1 KB 23ms
23ms Script
application/javascript 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.0.4

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3768f04f42b79eb4e04658f9afcdab75362a71eed99e851b05312b74964907aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.0.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5729749
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 12 Jul 2021 22:48:58 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60ecc6da-2c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QR4ycfBmZ%2Bl9b1jR6zISRhikKRFIrsjkteRZOLeOOgL4tPEsfxGPT4aArLu7ItGNCa4GYyIRGQJ7wQHLEDeda0jfVrgR6orla9SIvLaPB9vw21qKrQQCjvIYGCqZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6956f2dc2f1b3b61-CDG

GET
H3 200 wp-embed.min.js Show response
femme4.com/wp-includes/js/ 1 KB
1 KB 27ms
27ms Script
application/javascript 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://femme4.com/wp-includes/js/wp-embed.min.js?ver=5.8.1

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.8.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1572822
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 06 Jun 2021 11:47:44 GMT
server: cloudflare
x-frame-options: sameorigin
etag: W/"60bcb5e0-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UpgWXAL0BMb6kxXlUyIswK%2BekmyNRg136OwHew8tnKk1Ewlm70Wxs74SZPUi4%2F5M1Nqn%2BcWWkpd9ZtFmHa4LdBtZD7ZC5VPMVv4huj3CWDHEJWdHoqhtGyvK6BuI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
cf-ray: 6956f2dc3f383b61-CDG

GET
H2 200 7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v22/ 30 KB
31 KB 88ms
28ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:300,300italic,regular,600,600italic,800,800italic,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 19:16:33 GMT
x-content-type-options: nosniff
age: 517158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31120
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 20:50:02 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 21 Sep 2022 19:16:33 GMT

GET
H3 200 Loneliness.jpg
femme4.com/wp-content/uploads/2021/09/ 101 KB
102 KB 25ms
24ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/09/Loneliness.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

586c723cf2e3d604a05e61ba159f2cb007e6ca73eca8347da8c0a565be7de74c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/09/Loneliness.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 28359
vary: Accept-Encoding
content-length: 103499
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 27 Sep 2021 10:02:20 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "615196ac-1944b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MwpTfMThMl%2BVJY96D6rKxiHi2OCDKZI2bGQY%2FZAf1TF8mymXqSGmPAj7A%2FkUWsZ9CVf41iMaO2va%2FA6PZAYNxV%2BdeGZLe4Q5LA45kaNhTmVrrJp8TUqAi8NA5SuS"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc5f873b61-CDG

GET
H3 200 plastic-surgeon-breast-implant-doctor-surgeon-plastic-surgery-cosmetic-surgery-surgeon-with-breast-implant-mammoplasty-breast-augmentation1-768x1153.jpg
femme4.com/wp-content/uploads/2020/08/ 93 KB
94 KB 39ms
39ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/plastic-surgeon-breast-implant-doctor-surgeon-plastic-surgery-cosmetic-surgery-surgeon-with-breast-implant-mammoplasty-breast-augmentation1-768x1153.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb080597a02926c04e7b9c6af29c0b6e64a353e01a6a95c047c457e32157acc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2020/08/plastic-surgeon-breast-implant-doctor-surgeon-plastic-surgery-cosmetic-surgery-surgeon-with-breast-implant-mammoplasty-breast-augmentation1-768x1153.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 207343
vary: Accept-Encoding
content-length: 95732
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 18 Aug 2020 11:37:52 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "5f3bbd90-175f4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BEFULnKMFIKrWclxqX48Y%2BdyUaguVDt5mVxYH3nsK2n%2BQrOFbrB8eHIzRsQC%2F03evAd%2FS49YkrSnsEpK%2BKy2Iu4TEN8KV9dS5M0Ek4%2FLPy7fD5ngSadqOrqpbhc%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc7fc83b61-CDG

GET
H2 200 fbf3863867f87bded433f0ce7af120d1
secure.gravatar.com/avatar/ 990 B
1 KB 35ms
6ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/fbf3863867f87bded433f0ce7af120d1?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 27 Sep 2021 18:55:51 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="fbf3863867f87bded433f0ce7af120d1.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/fbf3863867f87bded433f0ce7af120d1?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Mon, 27 Sep 2021 19:00:51 GMT

GET
H3 200 fruits-sweet-gluten-raspberries-delicious-dessert1-768x1152.jpg
femme4.com/wp-content/uploads/2020/08/ 84 KB
85 KB 57ms
55ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/fruits-sweet-gluten-raspberries-delicious-dessert1-768x1152.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e03d30caecd455bbd7a382c0b875e4c0b47e7a581ef0ff2f0a4b10da9aab681d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2020/08/fruits-sweet-gluten-raspberries-delicious-dessert1-768x1152.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 288542
vary: Accept-Encoding
content-length: 85864
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 18 Aug 2020 10:07:10 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "5f3ba84e-14f68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NE8OHj%2FKjM155hsD4GhKbJN40c9%2FtLOB8KorkHYrYz%2B%2B25FV1xl5%2FaBhxY4mk3yPbjd8Nx8CX9rkvvt9io5ejYRkIJIonkt05aoyggqNIgdWkRE%2F1tkIC5nYgGeR"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc7fcf3b61-CDG

GET
H2 200 ce76f0a205df5e92bbd271be4d62f3b0
secure.gravatar.com/avatar/ 990 B
1 KB 35ms
6ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/ce76f0a205df5e92bbd271be4d62f3b0?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cd7fed18a4a3bf5287cf7318c717fe4cb80aedb0dce2c8101244fe4d14f3726e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 27 Sep 2021 18:55:51 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ce76f0a205df5e92bbd271be4d62f3b0.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ce76f0a205df5e92bbd271be4d62f3b0?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Mon, 27 Sep 2021 19:00:51 GMT

GET
H3 200 Financial-Cushion.jpg
femme4.com/wp-content/uploads/2021/09/ 88 KB
89 KB 64ms
62ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/09/Financial-Cushion.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6da9563acede60ad9246012ba2bb4f1b38c6370066e36db7715bb84a0f9ce6b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/09/Financial-Cushion.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 352355
vary: Accept-Encoding
content-length: 90598
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 14 Sep 2021 16:48:25 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "6140d259-161e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r02D8nnGlFbuiDRO5ICbsWM9M9uF4ZlQpu9vqoCEpCQydvUT0bJt7wbC7BkXqK0Z6omFTNYYx%2BpfiXFA%2BfQJJbHnQexWkEEBbkdqjGmIjIGaHkdBweSXqCa%2F%2BL2P"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fd23b61-CDG

GET
H2 200 5fe07f4e824a37b592515798eabb9975
secure.gravatar.com/avatar/ 990 B
1 KB 35ms
7ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5fe07f4e824a37b592515798eabb9975?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 27 Sep 2021 18:55:51 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5fe07f4e824a37b592515798eabb9975.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5fe07f4e824a37b592515798eabb9975?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Mon, 27 Sep 2021 19:00:51 GMT

GET
H3 200 Why-Do-We-Crave-Certain-Foods.jpg
femme4.com/wp-content/uploads/2021/09/ 81 KB
81 KB 73ms
71ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/09/Why-Do-We-Crave-Certain-Foods.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e275cc024817ac039b4f07511ee34c5de4f5dd8d3c2a812afd3863b2f8e44da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/09/Why-Do-We-Crave-Certain-Foods.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 440496
vary: Accept-Encoding
content-length: 82729
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 14 Sep 2021 16:15:48 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "6140cab4-14329"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GboAFleX%2BX2EoMO5zdDZ0hckUEQxanE6xFKOZwvN0xeIqZe3d8AHx%2FzlY1DFYuDALaV7ARNTFsv80TajF1EfhraCYLs3KOaZNKCK47SPdfQv3%2BcPKBx%2B%2FcyluRXe"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fd63b61-CDG

GET
H2 200 f4adac497b863ad69ea15904029c6a8c
secure.gravatar.com/avatar/ 990 B
1 KB 35ms
7ms Image
image/jpeg 192.0.73.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/f4adac497b863ad69ea15904029c6a8c?s=35&d=mm&r=g
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.73.2 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc2f72d429e09f22a75be0181d5085859ea78465a38b4156fb7dac894bc0ade4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 27 Sep 2021 18:55:51 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="f4adac497b863ad69ea15904029c6a8c.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/f4adac497b863ad69ea15904029c6a8c?s=35&d=mm&r=g>; rel="canonical"
content-length: 990
expires: Mon, 27 Sep 2021 19:00:51 GMT

GET
H3 200 broken-heart.jpg
femme4.com/wp-content/uploads/2021/09/ 167 KB
167 KB 94ms
92ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/09/broken-heart.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f2f006845c83fbace46ec13ab543cf12097c37a7b7c993e28fcefadd0c09bac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/09/broken-heart.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 524549
vary: Accept-Encoding
content-length: 170755
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 14 Sep 2021 16:35:15 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "6140cf43-29b03"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kS1pbZfwCW%2FupKSWzTpbP5vxKrMKPp4Bqgyky54ADCdMiJBbNjRMwAB10YXdsFGx9r4qDYG6OKgve4tInAakB%2FCZSMoKFX9p%2FEV9YvZCzlOadWG%2FAoIWKKx77waL"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fd83b61-CDG

GET
H3 200 Sleep-Cycle-1-e1631637060380.jpg
femme4.com/wp-content/uploads/2021/09/ 73 KB
74 KB 110ms
108ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/09/Sleep-Cycle-1-e1631637060380.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14b8622717ea4421dcf6fcd35cabfed97a10269cbc59a240916e9147ea5c4a93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/09/Sleep-Cycle-1-e1631637060380.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 613015
vary: Accept-Encoding
content-length: 74687
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 14 Sep 2021 16:31:00 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "6140ce44-123bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IiJQXEAjeLFgn6RosdKahYgRJJ7Z7I3wFWLJfr215W3dtk%2FK3MJQuT1N47I5GsMO9M%2FH6fI%2Fy4D0%2BmUOAenmKnKJeNCI%2FIqUxDge7bm0evXZQ7X6DzfpiVedl6tI"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fd93b61-CDG

GET
H3 200 5-Foods-That-Are-Full-of-Sugar.jpg
femme4.com/wp-content/uploads/2021/09/ 162 KB
163 KB 114ms
113ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2021/09/5-Foods-That-Are-Full-of-Sugar.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e70084d69f40f0c42d4a0acee8e40fe163ad3d8168762320a607ce30ac26ef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/09/5-Foods-That-Are-Full-of-Sugar.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 613373
vary: Accept-Encoding
content-length: 165964
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 14 Sep 2021 16:22:39 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "6140cc4f-2884c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MzZMCWzca4IYLXHJVGob6Z08uJYiVJeOOJSSM4j%2F13io8mxcY0%2B5zIE4AS57nuQgyDkbT3%2FRZLi4gaElfFRR9nOQj7AGXYvWnEU9LjClAngxz2kyS6SaZOlg7nh7"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fda3b61-CDG

GET
H3 200 creamskin-care-cosmetics-lid-f1-768x524.jpg
femme4.com/wp-content/uploads/2020/08/ 54 KB
55 KB 126ms
125ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/creamskin-care-cosmetics-lid-f1-768x524.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

266e3fa269b0f59b425fac224c0220610688d10b305c82023a594717388bf24a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2020/08/creamskin-care-cosmetics-lid-f1-768x524.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 711346
vary: Accept-Encoding
content-length: 55734
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 20 Aug 2020 10:24:57 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "5f3e4f79-d9b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vEuWZQ8KajLyLOVwspw6iOufDK%2Fm5GXx%2FRRxJWhniQvb0H%2BH1TKEdT%2BaAcylwR2gOPpvGYLPsB%2BiThnAqKf05q0Y%2Ft7Ok%2FtMiY9U2NT%2Bcayw0zPhnAlj8Now6Tj8"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fdb3b61-CDG

GET
H3 200 haircut-834280_12801-768x512.jpg
femme4.com/wp-content/uploads/2020/08/ 39 KB
40 KB 131ms
130ms Image
image/jpeg 172.67.153.71
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://femme4.com/wp-content/uploads/2020/08/haircut-834280_12801-768x512.jpg

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.153.71 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed26f65f5569c36b18de98f48aad47dd6d5672addd2a82919017a8caff32923f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2020/08/haircut-834280_12801-768x512.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: femme4.com
referer: https://femme4.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 811589
vary: Accept-Encoding
content-length: 40158
x-xss-protection: 1; mode=block
pre-cognitive-push: Enabled
quantum-flux-capacity: Omega
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 20 Aug 2020 09:26:31 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "5f3e41c7-9cde"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0nEITHTUQMd5Ln4M%2B9bjUmdcLs7Mua%2B3jEysY3sPRLBxiFvfR6RAOREA1NoikM%2BfuNIIFcbgXQoMG%2Bb%2FtidoXiSKHhbGio6FMyIZ5p2AZJ7sGb6fDMEnf4ughVRn"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
cache-control: public, max-age=31535990, stale-while-revalidate=10, stale-if-error=10
accept-ranges: bytes
cf-ray: 6956f2dc8fdc3b61-CDG

GET
H2 200 liveView.php Show response
live.primis.tech/live/ 43 KB
12 KB 76ms
16ms Script
text/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 3765cb539a5f7b21ad18921c851e2b57e9aea8f4e1bed355a1c1bebd54bb1ddd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H3 200 pubads_impl_2021092101.js Show response
securepubads.g.doubleclick.net/gpt/ 336 KB
118 KB 62ms
31ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9cddc4e1c7049c1e45ebb678a8a47bb3b67dfa86009c877de6a9e6da0cfae474

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120556
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 08:37:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 27 Sep 2021 18:55:51 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 139 B
127 B 60ms
32ms XHR
application/json 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f14.1e100.net

Software

cafe /

Resource Hash

fb168c52becca15fed6f0e1d5ee52f3756fdce0f65cfecdd9e0b641ae69cf8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102
x-xss-protection: 0
expires: Mon, 27 Sep 2021 18:55:51 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame B90D 4 KB
1 KB 17ms
16ms Script
text/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1632768951&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: d1dfa129a676e4552ff817c622a8598269f7acf11dee276a9e56bcadf7ab0049

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 82ms
29ms Script
text/javascript 142.250.185.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-149428601-5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 535
date: Mon, 27 Sep 2021 18:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 27 Sep 2021 20:46:57 GMT

GET
H2 200 iab_consent_sdk.v1.0.js Show response
live.primis.tech/content/ClientDetections/ Frame B90D 19 KB
6 KB 13ms
12ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1632768951&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
etag: W/"5e441350-4be0"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 27 Sep 2022 18:55:51 GMT

GET
H2 200 DetectGDPR2.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame B90D 9 KB
3 KB 14ms
13ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1632768951&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 154212eb976f7df7c79f5844fcb356740bcb6c51edacb2e8515108e2d7effa67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:48 GMT
server: nginx
etag: W/"6024fccc-228f"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 27 Sep 2022 18:55:51 GMT

GET
H2 200 DetectGDPR.v1.1.js Show response
live.primis.tech/content/ClientDetections/ Frame B90D 8 KB
3 KB 13ms
13ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1632768951&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5bb08412d18881e3fc69fdb44226bfc6f66a77d45dfff3f10b98a100c09bc970

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
last-modified: Thu, 11 Feb 2021 09:45:49 GMT
server: nginx
etag: W/"6024fccd-1ef8"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 27 Sep 2022 18:55:51 GMT

GET
H2 200 prebidVid.4.43.0_6.min.js Show response
live.primis.tech/content/prebid/ Frame B90D 426 KB
159 KB 20ms
19ms Script
application/javascript 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_6.min.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1632768951&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 5b3a74d188f479a36d381a9618a7ffc9c34d81bc5442c4b4274a097280deb704

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
last-modified: Mon, 13 Sep 2021 07:13:04 GMT
server: nginx
etag: W/"613efa00-6a793"
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 27 Sep 2022 18:55:51 GMT

GET
H2 200 liveVideo.php Show response
live.primis.tech/live/ Frame B90D 542 KB
148 KB 54ms
54ms Script
text/html 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveView.php?s=105464&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&subId=[SUBID_ENCODED]&subId=undefined&cbuster=1632768951&pubUrlAuto=https%3A%2F%2Ffemme4.com%2F&videoType=flow&floatWidth=&floatHeight=&floatDirection=&floatVerticalOffset=&floatHorizontalOffset=&floatCloseBtn=&flowMode=&flowCloseButtonPosition=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 981102bb1cc01886e8e71b86946412ac0dffb97d55f5d35f77ca7f83d658efe4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
server: nginx
content-type: text/html; charset=UTF-8

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
711 B 58ms
29ms Script
application/javascript 104.18.14.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.14.161 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 24 Sep 2021 13:44:43 GMT
server: cloudflare
age: 277677
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1800
cf-ray: 6956f2de8c9c2181-DUS
x-amz-request-id: 2T3ADNM0NA6XVJTY
x-amz-id-2: jfJxyshidfcTxFueSvcRLpZDL5svkJH7V5xVWWKPLBAqwrRRvGkDD6FTjU7Ytu9bd2Xme4HjNt4=
expires: Mon, 27 Sep 2021 19:25:52 GMT

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 1 KB
2 KB 153ms
58ms XHR
application/json 185.86.139.96
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 75a1fae61842d6a6a202b371e14797fe9f2a11db08a2dfc9671289536dc8ad29

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 6%3b15%3b91
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 800 B
2 KB 168ms
73ms XHR
application/json 185.86.139.96
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.96 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: b179c727b4e6d5f56b358707ed9505c74e54214fcb93841ac45ed3638a33726e

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: br
vary: Accept-Encoding
x-smrt-d: 6%3b7%3b112
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
access-control-allow-origin: https://femme4.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
transfer-encoding: chunked

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 65 B
293 B 185ms
106ms XHR
application/json 34.149.20.76
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=aYHEBY2cyr64kvaKjGFx_2
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: aa2f7d8b8b08e644379fd5b98a1d28b3121979d0f99b039482a4691c84bb4962

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
status: 200 OK
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
184 B 167ms
120ms XHR
text/html 34.107.161.123
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://femme4.com
x-cloud-trace-context: 6ec7084b6f00288cdb28fc3003a865a7
access-control-allow-credentials: true
alt-svc: clear
content-length: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 230ms
186ms XHR
application/json 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

nginx/1.17.9 /

Resource Hash

8746b49089d1798c011676fe846049c7f6b0139d4e866e21b2b2eaceb366aba6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:52 GMT
X-Proxy-Origin: 216.131.111.16; 216.131.111.16; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 7ba3a449-85bb-4357-ba3c-29d6a7a2effa
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://femme4.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 64ms
27ms XHR
text/plain 35.157.32.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.32.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-32-122.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Mon, 27 Sep 2021 18:55:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 66ms
30ms XHR
text/plain 35.157.32.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.32.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-32-122.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Mon, 27 Sep 2021 18:55:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
109 B 63ms
27ms XHR
text/plain 35.157.32.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.32.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-32-122.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Mon, 27 Sep 2021 18:55:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/WYu2BXv1/ 0
110 B 45ms
9ms XHR
text/plain 35.157.32.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/WYu2BXv1/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.32.122 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-32-122.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://femme4.com
date: Mon, 27 Sep 2021 18:55:52 GMT
access-control-allow-credentials: true
vary: Origin

GET
H2 200 arj Show response
pubwise-d.openx.net/w/1.0/ 173 B
557 B 100ms
44ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pubwise-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Ffemme4.com%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=1def4cbf-eb9f-4926-bea8-0014f3520bf5&nocache=1632768952074&pubcid=d40ba5ed-1fce-4aaf-b1bd-ab9740cc1b67&schain=1.0%2C1!pubwise.io%2C6758a5%2C1%2C%2C%2C&aus=728x90%2C320x50%2C320x100&divIds=femm_adhesive&auid=545648436
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 27c6cd566af8d9334ee41b6648274f04f41dd6536c3212dbd0af20121a163e2d

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
server: OXGW/16.216.3
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://femme4.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
166 B 289ms
93ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 1
date: Mon, 27 Sep 2021 18:55:51 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://femme4.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
642 B 102ms
28ms XHR
application/json 216.52.2.39
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.40.0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.39 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 395dcb736d31d8491e9ac85c932d420802b98f69de19a221bc34e2b4b0db4875

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 27 Sep 2021 18:55:52 GMT
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://femme4.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 24

GET
H2 200 primisslate.css
live.primis.tech/content/video/css/ 17 KB
5 KB 13ms
12ms Stylesheet
text/css 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/content/video/css/primisslate.css
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 10:07:25 GMT
server: nginx
etag: W/"5f3ba85d-45c8"
content-type: text/css

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 63ms
24ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ffemme4.com%2F&domain=femme4.com&cw=1&lsw=1

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://femme4.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://femme4.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1762
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 58ms
25ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ffemme4.com%2F&domain=femme4.com&cw=1&lsw=1

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://femme4.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://femme4.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 2102
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame B90D 133 KB
36 KB 25ms
8ms Script
application/javascript 13.224.186.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.186.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-186-4.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 975b62423e82390a1b54f47625f46f5b4451a8ea69945b2e85008a194bb55edd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:47:07 GMT
content-encoding: gzip
age: 524
x-edge-origin-shield-skipped: 0
x-cache: Hit from cloudfront
timing-allow-origin: *
server: Server
x-amz-rid: 1P6GKXV3J734NXH3KH17
etag: 3900a2c2d757386fb762bfd86288f882
vary: Accept-Encoding
x-amz-version-id: 8N42zakBwOFy.ZF9LMqjmgZs3f2_X5lT
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: fxAM_f9epkZ7Ov5TK0CZ3RY7nH7hScro0jUwyJf_bUl1qPmsMw9BpQ==

GET
H3 200 css
fonts.googleapis.com/ Frame C546 2 KB
548 B 58ms
30ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 17:53:33 GMT
server: ESF
date: Mon, 27 Sep 2021 18:55:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Sep 2021 18:55:52 GMT

GET
H3 200 css
fonts.googleapis.com/ 2 KB
548 B 49ms
33ms Stylesheet
text/css 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

ESF /

Resource Hash

8c4967c13572e41e718dfbb3d84dddeacc748aa14cb2d65ad91ecdde60f50664

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 17:57:54 GMT
server: ESF
date: Mon, 27 Sep 2021 18:55:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 27 Sep 2021 18:55:52 GMT

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame B90D 355 B
621 B 53ms
19ms XHR
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ffemme4.com%2F&domain=femme4.com&cw=1&lsw=1

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_6.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

fff0bc3b1753c170e1f17b69d83d5be2c323d2e5dfc20d6164e2e92d886937fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 27 Sep 2021 18:55:51 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3433
expires: 0

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame B90D 339 B
615 B 52ms
19ms XHR
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ffemme4.com%2F&domain=femme4.com&cw=1&lsw=1

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_6.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

314dbdae1e025525c9e38cd7e0e317c816e4bb6d651de70cafa5362f3f71fd2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 27 Sep 2021 18:55:51 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3002
expires: 0

POST
H/1.1 200 212.json Show response
id5-sync.com/g/v2/ Frame B90D 213 B
528 B 35ms
10ms XHR
application/json 51.89.21.31
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/212.json

Requested by

Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_6.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.21.31 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

p22.id5-sync.com

Software

Resource Hash

492e0b14b763c0043990c1e6314bfd75d9b6864273da7b051dff95e568590a0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://femme4.com
Date: Mon, 27 Sep 2021 18:55:46 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

GET
H2 200 id Show response
id.crwdcntrl.net/ Frame B90D 77 B
825 B 110ms
38ms XHR
application/json 52.30.14.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_6.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.14.23 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-14-23.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 50125863ace6123ee10616b8a2e09a9ec37f12ffc16e11a762488b75a065b418

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://femme4.com
cache-control: no-cache
x-server: 10.45.29.216
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 77
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame B90D 109 B
540 B 102ms
33ms XHR
application/json 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=j6w8ta9&fmt=json
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/content/prebid/prebidVid.4.43.0_6.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 4b634da03501925208827e05e50a1d3e35e3d1b6328fd8b537443659acf3018b

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Wed, 27 Oct 2021 18:55:52 GMT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame B90D 2 B
295 B 31ms
30ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMTxyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMwt3NDMyMxZ2nWRyo181ZGUmOTU0ZTA4OTVuNDx5NDE1Nwt2JTJGqzyxNWY5ZDx2NWUmNzEjMDtmNwUjNmMmMC5gpDQzqzyxX2NioaRyoaRsnWQ9MTEjNDQ4MlZ2nWRsY29hqGVhqF9xZXNwPTYeRGymqHVlYzyhZlgESVxeSGFfoG93ZWVhK1NGWCgMo29eplZ2nWRsY29hqGVhqF90nXRfZT02K0Rcp3R1pzJcozpeREyZK0uuoGkiq2VyovgTRyteTG9in3MzqzyxX2NioaRyoaRsZHVlYXRco249Mmt5JzRyYaVaSW5zo3JgYXRco249Jat9NwxjJax9MmxjJaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmAmOTJEMmImNmVGMmImMTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNmE2MwZGNmQ3RDqCNTtmNwM5MmA3RDqCNTxmMmM5MmA3RDqCNwYmMTqEN0I0QmMkMmAmNmM0Mmx3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEkODtzZ2ViTG9hZm04LwY4NDMzqXNypxyjQWRxpw0lMTYhMTMkLwEkMS4kNvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTMhMC40NTp3LwYmK1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkNTIkM2I3ZTZxYmAzY2J1p3Rypw0kNwMlNmY4OTUlMTQjJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 22

GET
H2 200 vid5f9d965e36a00836507330.jpg
video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/ 20 KB
21 KB 128ms
25ms Image
image/jpeg 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/vid5f9d965e36a00836507330.jpg?cbuster=1614090882

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

9ef6bff8481268975a8f629b7a81e2d25830cf2df9212a9d9501f7b2d81eaf32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Sat, 31 Oct 2020 17:05:34 GMT
server: Tengine
etag: "5f9d995e-515e"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Thu, 07 Oct 2021 18:34:21 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 20830
x-proxy-cache: HIT

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame B90D 2 B
295 B 28ms
28ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0kJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMTxyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMwt3NDMyMxZ2nWRyo181ZGUmOTU0ZTA4OTVuNDx5NDE1Nwt2JTJGqzyxNWY5ZDx2NWUmNzEjMDtmNwUjNmMmMC5gpDQzqzyxX2NioaRyoaRsnWQ9MTEjNDQ4MlZ2nWRsY29hqGVhqF9xZXNwPTYeRGymqHVlYzyhZlgESVxeSGFfoG93ZWVhK1NGWCgMo29eplZ2nWRsY29hqGVhqF90nXRfZT02K0Rcp3R1pzJcozpeREyZK0uuoGkiq2VyovgTRyteTG9in3MzqzyxX2NioaRyoaRsZHVlYXRco249Mmt5JzRyYaVaSW5zo3JgYXRco249Jat9NTQmJax9MmA1JaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmAmOTJEMmImNmVGMmImMTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNmE2MwZGNmQ3RDqCNTtmNwM5MmA3RDqCNTxmMmM5MmA3RDqCNwYmMTqEN0I0QmMkMmAmNmM0Mmx3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEkODtzZ2ViTG9hZm04LwY4NDMzqXNypxyjQWRxpw0lMTYhMTMkLwEkMS4kNvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTMhMC40NTp3LwYmK1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkNTIkM2I3ZTZxYmAzY2J1p3Rypw0kNwMlNmY4OTUlMTU5JzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:51 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 22

GET
H2 200 liveView.php Show response
live.primis.tech/live/ Frame B90D 2 B
295 B 35ms
32ms XHR
application/json 185.220.205.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.primis.tech/live/liveView.php?hash=pm01ODA1NlZ2nWRsqzFmqFRcoWViqXQ9LTEzqzyxX3Zup3RUrXByPTMzqzyxX3BfYXyypyZypw0mLwEhMCZ2nWRsqzyyq2FvnWkcqHyTqGF0ZT0jJaZcZF9wo250ZW50X3VloD1bqHRjplUmQSUlRvUlRaZcZGViLaBlnW1cpl50ZWNbJTJGqXBfo2FxplUlRzNhMTxyMxZ2nWRyolUlRaVmZXJmJTJGY29hqzVlqGVxJTJGMwt3NDMyMxZ2nWRyo181ZGUmOTU0ZTA4OTVuNDx5NDE1Nwt2JTJGqzyxNWY5ZDx2NWUmNzEjMDtmNwUjNmMmMC5gpDQzqzyxX2NioaRyoaRsnWQ9MTEjNDQ4MlZ2nWRsY29hqGVhqF9xZXNwPTYeRGymqHVlYzyhZlgESVxeSGFfoG93ZWVhK1NGWCgMo29eplZ2nWRsY29hqGVhqF90nXRfZT02K0Rcp3R1pzJcozpeREyZK0uuoGkiq2VyovgTRyteTG9in3MzqzyxX2NioaRyoaRsZHVlYXRco249Mmt5JzRyYaVaSW5zo3JgYXRco249Jat9NTQmJax9MmA1JaB1YyVloD1bqHRjplUmQSUlRvUlRzZyoW1yNC5wo20yMxYzpzx9NxM2OTp2NwU1Mmp0NwE3NDpmN0M3MmZCMmE3QwU0MmA3RDqCNwQmMwMjMmImMTJEMmAmOTJEMmImNmVGMmImMTqEN0I3MmMkMmUmMwM1MmAmMDMkMmE3RDqCNDMmNTM3N0Q3QwUmNwQ1NmM1NxI1QTU3NUE3MDYlNxQ1NwZCNTtmMwVBNxM2MwU3MmE2QmRFNDMmNTZBNwImMwMjM0Q3RDqCNmE2MwZGNmQ3RDqCNTtmNwM5MmA3RDqCNTxmMmM5MmA3RDqCNwYmMTqEN0I0QmMkMmAmNmM0Mmx3REZFRxUznXNBpHA9MCZaZW9MYXRcPTUjLwEkODtzZ2ViTG9hZm04LwY4NDMzqXNypxyjQWRxpw0lMTYhMTMkLwEkMS4kNvZ1p2VlVUE9TW96nWkfYSUlRwUhMCfyMwuXnW5xo3qmK05UKmEjLwAyM0IeV2yhNwQyM0IerDY0JTI5K0FjpGkyV2VvS2y0JTJGNTM3LwM2KlUlOEgIVE1MJTJDK2kcn2UeR2Vwn28yMwxeQ2ulo21yJTJGOTMhMC40NTp3LwYmK1NuZzFlnSUlRwUmNl4mNvZjoGF5ZXJBpGyJZD0zY3N1qWyxPTYkNTIkM2I3ZTZxYmAzY2J1p3Rypw0kNwMlNmY4OTUlMTYjJzqxpHI9MSZaZHBlQ29hp2VhqD0znXNXZVBup3NHZHBlPTA=
Requested by: Host: live.primis.tech
URL: https://live.primis.tech/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032312D30392D32375F32317D7B7331353235303031317D7B4335377D7B536457356B5A575A70626D566B58325A6C6257316C4E43356A6232303D7D7B71626F747D7B583639307D7B593339307D7B66317D7B4C31303734397DFEFE&userIpAddr=216.131.111.16&userUA=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F93.0.4577.63+Safari%2F537.36&debugInformation=&isWePassGdpr=0&noViewableMidrollPolicy=off&isDoublePreroll=0&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=615213b7e6dc0&debugInfo=15250011_&debugPlayerSession=&pubUrlDEMO=&isAsyncDEMO=0&customPlaylistIdDEMO=&sta=15250011&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOjF9&content=plembed282bprwgvhtn&secondaryContent=&x=690&y=390&pubUrl=https%3A%2F%2Ffemme4.com%2F&contentNum=1&flow_closeBtn=0&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=bl&flow_horizontalOffset=10&flow_bottomOffset=100&impGap=1&flow_width=310&flow_height=260&videoType=normal&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.1188&geoLong=8.6843&vpTemplate=10749&flowMode=below&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.205.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://femme4.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 22

GET
H2 206 vid5f9d965e36a00836507330.mp4
video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/ 32 KB
0 799ms
718ms Media
video/mp4 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/vid5f9d965e36a00836507330.mp4
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),
Reverse DNS
Software: Tengine /
Resource Hash

Request headers

Referer: https://femme4.com/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Sat, 31 Oct 2020 17:05:34 GMT
server: Tengine
access-control-allow-origin: *
etag: "5f9d995e-18f19aa"
content-type: video/mp4
Content-Range: bytes 0-26155433/26155434
expires: Mon, 11 Oct 2021 18:55:52 GMT
cache-control: max-age=1209600
Content-Length: 26155434
x-proxy-cache: HIT, MISS

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
140 B 204ms
146ms XHR
text/plain 130.211.34.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://femme4.com
access-control-allow-credentials: true
x-bes: pw-api-v8log-53v9
alt-svc: clear

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 48ms
21ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:41 GMT
x-content-type-options: nosniff
age: 440651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:41 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C546 15 KB
15 KB 34ms
23ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://femme4.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 22 Sep 2021 16:31:41 GMT
x-content-type-options: nosniff
age: 440651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 22 Sep 2022 16:31:41 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 60ms
30ms XHR
text/plain 142.250.185.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=2088870376&t=pageview&_s=1&dl=https%3A%2F%2Ffemme4.com%2F&ul=en-us&de=UTF-8&dt=Femme4%20-%20For%20Her&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1131010106&gjid=1856005794&cid=647762398.1632768952&tid=UA-149428601-5&_gid=781528686.1632768952&_r=1&gtm=2ou9m0&z=1923708158

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://femme4.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vid5f9d965e36a00836507330_thumb.jpg
video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/ 2 KB
2 KB 40ms
30ms Image
image/jpeg 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/vid5f9d965e36a00836507330_thumb.jpg?cbuster=1614090882

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

ac7ac42934bda73a93a43b3a2664e47bb0ae1a598b2be781e033bb0ee726814f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Wed, 28 Apr 2021 18:37:10 GMT
server: Tengine
etag: "6089ab56-6c4"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Thu, 07 Oct 2021 16:16:29 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1732
x-proxy-cache: HIT

GET
H2 200 vid6066e506a6134576191257_thumb.jpg
video.primis.tech/uploads/cn1/video/users/converted/24485/video_5b3c72a92964f719964308/ 2 KB
2 KB 40ms
31ms Image
image/jpeg 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn1/video/users/converted/24485/video_5b3c72a92964f719964308/vid6066e506a6134576191257_thumb.jpg?cbuster=1617356041

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

5d9724375196747d1de0f9b5c7023dd95afb1735a01a479ac5d24e9766d695b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Wed, 28 Apr 2021 18:49:45 GMT
server: Tengine
etag: "6089ae49-7c9"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Tue, 28 Sep 2021 20:13:56 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1993
x-proxy-cache: HIT

GET
H2 200 vid5f449494701d8907058988_thumb.jpg
video.primis.tech/uploads/cn7/video/users/converted/24485/video_5b3c72a92964f719964308/ 1 KB
2 KB 40ms
31ms Image
image/jpeg 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn7/video/users/converted/24485/video_5b3c72a92964f719964308/vid5f449494701d8907058988_thumb.jpg?cbuster=1598330006

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

7acf45ed6590b429d87b7bad6d72b405c984d0551641a683e1968bb04cb57c72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Wed, 28 Apr 2021 23:48:43 GMT
server: Tengine
etag: "6089f45b-503"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Mon, 11 Oct 2021 16:58:50 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 1283
x-proxy-cache: HIT

GET
H2 200 vid60bf249613f71704931239_thumb.jpg
video.primis.tech/uploads/cn17/video/users/converted/24271/video1511884110/ 2 KB
3 KB 39ms
31ms Image
image/jpeg 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn17/video/users/converted/24271/video1511884110/vid60bf249613f71704931239_thumb.jpg?cbuster=1623139481

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

18d2b51be0cd4769ccca9e5b0226443b27c79b5564587f480e16e38422c1076e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Tue, 08 Jun 2021 08:07:40 GMT
server: Tengine
etag: "60bf254c-983"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Tue, 28 Sep 2021 20:48:05 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 2435
x-proxy-cache: HIT

GET
H2 200 vid610a53525139e490157286_thumb.jpg
video.primis.tech/uploads/cn24/video/users/converted/29874/video_6108e7c8549ae485863754/ 2 KB
2 KB 21ms
14ms Image
image/jpeg 185.167.96.211
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.primis.tech/uploads/cn24/video/users/converted/29874/video_6108e7c8549ae485863754/vid610a53525139e490157286_thumb.jpg?cbuster=1629035439

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

185.167.96.211 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, US),

Reverse DNS

Software

Tengine /

Resource Hash

00b7c30dcc17fe6b8adfb1b98edf8f9c6dddac11b2737c192d8469ab7705709a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
last-modified: Wed, 04 Aug 2021 08:45:19 GMT
server: Tengine
etag: "610a539f-81e"
x-cache-status: HIT
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
expires: Fri, 01 Oct 2021 01:17:42 GMT
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 2078
x-proxy-cache: HIT

GET
H2 200 adagio.js Show response
script.4dex.io/ 71 KB
22 KB 48ms
26ms Fetch
application/javascript 104.18.14.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.14.161 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8dce90c8d06a68d557afc87d1783527292438bda3950121393107dcb663dae07

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 273854
x-amz-request-id: CNRN2W2SHXAXAZMQ
x-amz-id-2: du06J4GOBH9W0LmMu/hbSEKbk1ccDAVZW6tR5G26YJlAAlzB7Q7Mif2a9RrxsU18UplNlSVdZys=
last-modified: Fri, 24 Sep 2021 13:44:41 GMT
server: cloudflare
etag: W/"6cbe4a566109f9ab6c378764f4c5ba22"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
cf-ray: 6956f2dfcb382187-DUS
expires: Mon, 27 Sep 2021 19:25:52 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame B90D 6 KB
3 KB 42ms
25ms XHR
application/javascript 13.224.186.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.186.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-186-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 05:33:50 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 48123
x-edge-origin-shield-skipped: 0
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 07 Sep 2021 22:15:56 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: S8kNCKkikutwvs4V44q0sFuZ4JNc9Ate
via: 1.1 34f50889bc574f1edeb41dd758962a5b.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C1
content-type: application/javascript
x-amz-cf-id: YP9i5i-AZeK-NvRcnEYh0mzvhGX5OaADOw9CQGMTDNwgrzfmKcFS5g==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 71ms
26ms Script
application/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 87ms
32ms Script
application/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=femme4.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 296ms
295ms XHR
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3888576675294511&correlator=1096466164539845&output=ldjh&impl=fif&eid=31062917%2C31062920&vrg=2021092101&ptt=17&sc=1&sfv=1-0-38&ecs=20210927&iu_parts=21700304385%3A22564129828%2Cfemme4%2Cfemm_adhesive&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C320x50%7C320x100%7C300x50&eri=5&cookie_enabled=1&cdm=femme4.com&bc=31&abxe=1&dt=1632768952383&dlt=1632768951412&idt=630&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1150&adks=637388854&ucis=1&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.femme4.com%2F&loc=https%3A%2F%2Ffemme4.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=647762398.1632768952&ga_sid=1632768952&ga_hid=2088870376&ga_fc=false&fws=516&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3805f56378f3c9d23adb61b6161394b4a99521e53257597f39b0df2624cdf48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9717
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://femme4.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FFAD 6 KB
4 KB 133ms
34ms Document
text/html 142.250.186.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 18:55:52 GMT
expires: Tue, 27 Sep 2022 18:55:52 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F131 6 KB
3 KB 55ms
24ms Document
text/html 142.250.186.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 27 Sep 2021 18:55:52 GMT
expires: Tue, 27 Sep 2022 18:55:52 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 136ms
80ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a7ad5974f3d165d1a83149795afe792e241b0e6a41078c6e14bcecc5449934e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27652
x-xss-protection: 0
server: sffe
etag: "1632310961004595"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 18:55:52 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2E1E 624 B
995 B 100ms
48ms Document
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK-IbBCetW8YvfOgpgEwAQ&v=APEucNWgc5Z9FVR-ilyqm_1pWs7DM0mCWhxy_gKTsQ-mGwwn-qhvpJ1F9R26_mCk1nGsJVO5kIuqSASV8Up9HtBcalPbzs70ff5VNEh8-bGY1CoXGpe8pjIc_m2KT5ADHiqupr7ec9XKk6CyH8C7UTBdyjtgMB3Ohxv4pqZHUrW0G7bFIFvQ5ds

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CK-IbBCetW8YvfOgpgEwAQ&v=APEucNWgc5Z9FVR-ilyqm_1pWs7DM0mCWhxy_gKTsQ-mGwwn-qhvpJ1F9R26_mCk1nGsJVO5kIuqSASV8Up9HtBcalPbzs70ff5VNEh8-bGY1CoXGpe8pjIc_m2KT5ADHiqupr7ec9XKk6CyH8C7UTBdyjtgMB3Ohxv4pqZHUrW0G7bFIFvQ5ds
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 27 Sep 2021 18:55:52 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUkrW9LIs8k5-GwkiGIpp1b7WsE93s2UJmaFBYWWVL13o_VXZVXmpB7aHRa4; expires=Sat, 22-Oct-2022 18:55:52 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 27 Sep 2021 18:55:52 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F131 12 KB
9 KB 108ms
57ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CF8iLhbrqQWigMzDSe0wmraKfMRZ1GBKoUEba_qStHl0t5ELV85RzgmYE1BGcTrLdYOLKsVFwZ2bDwsu7gP2SWRFGMnyJSydZ5Si5gD7DZx4hhSGiAv7XjXrBqYqmGbCI0U3ZIDVhnx9T7JZCOmpYMJHabBA&dbm_d=AKAmf-DZh_2mF-WBVZTL_3HNrf1OyzlrukD_fpwFoDR9WDBeVY8ts9rtMt4N5e-aPfQHJL6bNaf4s0mUfqC32_2_boPnpIqgMpgHBVUMIvRqJqfWkSegb4P4wtCzgOAep_m587Q0sNoloFOE7xVB4zzW0RMBSl4cT8fFD4gfDvNjJi7VKNq5Q-MUYCiYCua5Wl0bT6lWj-_0cSNIF33Dk5UXaAcCKF0tUAcMOC6SluM12tFMrvjbDZTfunZ8Yf4ha8jI7KUNYBgPEdcIPQv2mk2hp5c2ZX8JvupIwZ3vb5s5Lua5Jd3e3EzyHrjuqStvb2C7SdFcxgIQJgn0PEiCLpXZBMICLFW6NqwKdb_G0W36PWB7roVXS3MCkksiLb_3tc0cehIBBq2KRqzBrN_ZCSB8ZxLWiExvcwHp3lCx0cE_pqtYnSIllujJ31LRrKjajKXACvtXWnqGSaSFzHNvjlQtb329BvvcFi1PzOXOtq0oTCYD46WTnZ7kWFWFcniXLEjBmyieYAeWqlFnZ61qsmYTEeEzK20a1GIsvm_3OPsZC6hHCHPiAs0reBpYFs-RqBEZt2TVc9hTXrBaf52CA4h3bmi2VMCe80MMh0K9-UJ5GqTGqUE0ZmdJcQkwzLclgC6UFEDpTXTsC168S7DVmUDl976o13KOd4YPMsL156_ZItggQMRFPRUafzuE8lt-9s0ojomAnfX_7bqelbalknY5iJgcoO9zcDE0ZwGwAB5eB2sHY9-pYs-DFY4bqp46Y_C4k26ZvP80b1QPATuzYSVXB-7flBIn7nHD22iktMbGpvpv0OHKAVntkIjaar7RqCmKfGfh-4tlzF1UVZ40d5rmXB1ivl52k_VmLTRMbseHWLhotrCMntFvNIHpt06K2qqEAXIE0RuDyZrCG-Zv4iCQNkku8xXmS0GRwk5dyJaG4Ae-lzCNNsw29h3zcKsc1TIp5t5yHoIfsD7hCZHqSgmksgkEOk-q9du5yNxp6ZmsZkwMQkXnjvIDgrK99odEJnnKF_WvqZRKo1nrWi1McFiNQl248FTUTbDCYlsF7PPQvEGbtgRCmp6Q7NVjqWaubw2RcR6ne0xC-ncEU3FIHhVzE1HDZb7HJQ1mcD1wpFkmTjTy1wwtwSMqQBbt3jllqK5h8uOuztF6e_C_SW2DtlSzxTVi2PDUvlsc13rGfF2SxmaJvAvwjE3XN_267SBsANupA2BbF3ujIjMGICcM72P861aA_8MIQVCI8frsQOSA_NTWpfAi2mRLw884JHQOb7kC7SS1rotgEeOnYYyQGzkdb7imd3bj665moYKISWNJ7IpYOCMM8RwKFmC0Dxh_ITv2_QGfkPrrjPLJ6NpxyHmgLE-JzCa3C0ME9-fZWqxwT6Q_sVjJzyQmngxKJtO6mjI9FJs9Pr9z_zyKmuGDvyqkmrnKv393DfxwaL7rg3gxY6HpDaCTdoh__sAyWu3XccSs3nlcgE4qlZB-G9TfI4WMoYoBV6bELoQhkqvKm9h8Pg5ACz_VkL_V4OSVr7d55hW_QwWua42ISeEuL4-LEFJaIEw82ZeGM1AJXjNVKpdeSCCtXJ9SKUdcXKva2Nmn4hmhmxUbh3QRiNzKcU0HjChRrEyPHSBIbEocPWDX7fb97IUbhVbYqDZKXMJiZd5pAJ_jaMw9RQNCLsAqh7f_n9zibChTXQ0VUdm9LYpzIzrEdI29n2-t2OPscvdNLBCxtymrbHPT5zuAOtzPz2AyZzCytsLf0zObwsyj9oI1PJvQBC7kBb8upi-V2P38tWz3mWy67FiJcz2-VjSLtH3c9YH_J2IQo8OCtoG3oTQpcBsdeIIRK-FRFKFJ8SEk6UFPU93Te_rypfcE_n-50H_TTuGxEnjMz_WonyTRyZPHKHfEpZ4ahmS6mlKprpibgym_Wmq3BDctaWlsrbx_IQITXPvF-761R1EY66c0yOgLKN9zc3BG0mOWORIn_eq6SAl61FQ9DZ8PlbkKTesqWts8_kdDXFCMsGcGl5gx-9PBIPW01PlGFwgBv7o3oYvF9RthuIhhzMK0tvwwxZD-VUV_MoZeWwD2NcOKeb5YBHiaJ7e07an-yzfOrBaHldyowxSCXOUwnGxnZ10BH_TZq7gGj8gQQxQdwiD6DiufZqOhIxZclXZXpok_uDmL-W2vGi0LtmRdypX3EMsG4VvhZlI5aNRwRyO5ixBmj_yB_Zg619q7LBCW34xmRvM3oX1smJlDTXjORu87TAeWJgSEXWbgNZzc9b9GBGoWgSrsxwugxw00W2cccFgEpt3OOJF71dek_RNpBt8Ahv0xGYflmUWJclUXerUTYEsQojN3Ji96Piq8DZ_9ritMltWaIZCkbMN2iPOIqHV4XrbUj5zfQ8j9-AwuItxU-M4LsMdfGQ95_h8W1VsIsvFGRSqgvRTn8dn4k_ZR2vC61NBkHbzFaMv5AnGdcN7pXz08c4QRrO4u94Mqbtb16HE4dYVhpjzGZ9Yxw86d4NlVDSbQ-LwXllD3KqZ-AnAVAbOA6Ar5bDL8GpWyqBCxUDl7V8w&cid=CAASFeRoz12ke0cB9oH1eAqU4uMwt1jOlw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

89571f0c477a6122140de9f4d0f737036378212fc904e29fa29d3f7fe62e4d53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8846
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F131 42 B
515 B 82ms
46ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BbD8p58PIaBikbopdjx1kh55XQs627UlkKmPb3MSuzVafyiQywqqSwEpCFOa1VxYq6-MmLrVl1zd130KWd0pUvZIUHC9xczv6Go3CJG-vgAhPKKDo

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/818406/56999746/xbbe/creative/ Frame F131 236 KB
79 KB 236ms
111ms Script
application/javascript 52.18.213.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/818406/56999746/xbbe/creative/adj?p=APEucNUCTnMxPdRXmDR8hKo_KqZK_GjQ7S2-brZWU_VW8fk3uGn_elo&d=CnkAoCZ_4MU6qnPYGcHwwIfAfXiMW9iBA321sUMkhaJw8AUX6ZlyD_0OKWipqFnZ-0ihvZBEZN6xTUsO84Tg96rxs_EsimBDU8Qth_ccqZBmf6Dl9-_OYyJJIiQObqbFSVNEDdi1XIRoyBb5tS34pyqryGDSE8aoD45jEvkRAKAmf-Ab0wsA1H-Tym00Wace4oDXfUbk4cQLrJfmL6RawdsNyDpZkK_CSmOcP-wAcud8wcZ0LFrqoTL3qLo4o6pRxPuZ53nCT1WnkiZseA8ts-V1Qrpm72Yfqc_pZcHLOF5uyCDtHl1dxRr8-DQGb7cnTQujOBySnWDkRvB8W4UXPuc1RHC3ItZH1jBGatutvA7A633oC9YNgWEsoMrfQgCF9NsP3IzS0hGwrWKRIpAYy7UyTIUybWHTUN1wbZ9G-vk-mXhMV1vlobJXQr0uGMV1gr-9LjSR_6fYpl4-SJFJryEQpjEb9y600zo5KTGpNTRoVelA_Y4PbtExY88nP9Wou0BoxMdRbQHN6pE_PdlSQLSQFK8dIgF72gLVrN4QPkujoaqkFanSSnVVqnveLZpHZUSgmrTW4UPsusJOfe9KdnXEVdVbXXu4aZB-NqQOPx5ywfGi7p7cjP0eGG0YbQdEZv1HM3rlc59BkDosEK5fjgprAGZmW1U0BvZ5tDYNRa3yJGZj1bzDtYZapZfNLcZ-tXTfQhovrfq7rcF_CWIj2fze978d-g9RvX4CFBbP-2Y-PzqhBUaV1n5BrKoeJhE22LNQT6GV2rp_8IFk0xNKJ0Igr-N14khug_0v6G8cr8MpoXcNmXk6LpixulKJPFW62qeyiXttThFZQW8tGaZEAgUvs0x82K5GYRGGEY5J8QGchTrk-Rt1FZHTACxlvK1QCHCC6WNfeQj3c76HxzkVLe4CxBrzaSLBf8v6uCeXCAA_zN-1G_VILQG4LqPZTki6ZVBThq6vVY5NtpLvHIEjDaAwpVMNfOXcYEiiOjMsZky8mJcZDLGr_0w2jytZRH2EPXrOQB-hqK5AuqsFd4ZeR1nbRQYKB5HwJmXrXzcZdnYJsTAGnZ0YjS_8170vweuXMSnDE1jOWHk5nGnfynNDWt4oQHSHUQxG8_hey1ixTPuT87ANMG7jQ21BdMH_s1R1cx_rtDbNbwvtxZdn8I63RruC0crAMgEJuM9PQ7jvaVU8ptlAZqQ-DbZ84n_BXjx0YRioabeWbs8tsUAYWLaONsH8SG8RHJd7loWLhT48dCGEWxi8d3GVF1towzGPCpi7nhzGp3RTlfJr2Ui0OWFOLH2oEhYkHctwTpTZD2Nrabv7K8Lipmex6Wsq8a5SsSvGg1Hr8Fi-fOORcTPC_PMmYBCzs5pCxU6nrY_ncr3KIidPnhjwpxeWZ_jN8h8W-LL3p1y55wuheccZtj2LNs82NfqAeBrrElZH5qyZq1vHND2bc9ktc-66nTa5RHTwqlRufN3YyaoLC1gvjGQ2VUKiFkIHBKvrfKh201MZP-EkvBw8noxrgvySD250L4YURciEjapnkcTT_8dXzbOveAqLqyYCHKRmCwMZ_dr6WD_fgQdJbwhWMxH1cdj3S45BWkVkaTBOosA13vTrikStcjR-QotGOcLVe2v-6qACc3fcamlj3nWN0_PuSnsSLojOKYWOlsPFDGlGCvTEoSEXWNDxJuV2D6REFbRr2MV2M7_j75HyJwwkVy6zYGvXqL9SzB21ED0i_xjX4AKScgqCNc6iayY-G-JVtK9W1PbrUVad69dmXHdTKqwCyUUxCT_u4EVQl_DKnoRlQbuN-6QfVrpvzqQEBWNr3y6KDEIEKrr-AKLJK5dS1fFzYw7e48MNu3NDj7CR0mTAypeDPAQkf8T3M_8LGc4CJHtojRB9Lx05PSSK8R1AY_Oo_q7xTJXIR7sYlN2GrGP2MDkVl053NhaLAI0WJIGJaiEWOIOi04rYSSwfaXnGyOA0XNBb-RhPpoRIwpq6A4-aRXdMl3cNUr4gxHgrQdFP7QxUKSepSuCIDFuX2km85QYkxQFR4DfhPNHE5V8VmUoyPNlUI0VklZwl05B7Q6j7eXUYBbWWgTmJiGjDzT0LmXEQja1nx-EkRgpKszJqFIg1tekFC34hngz2ISjLEpXl_6pU_G2K-KQCMJECEuLl7wJuqt42naeCnuLKbKlGee6QRSuH0AWf2W7lkUuM2a8C8Ixh4KUFW13Ff09HthQEK2Fy0tgEODA9ogU6tqNUmdxg0L8q45yL0zndVOvOVBNxCz20ardffU4tidrUcjNKiIN24LHSCQlJLVSm2i5dVhSrSN9Smfqx6jHRjiniWDyoeL7xVYCPLBND4WyMB0F5Hb2B_4BNwl3Orweuv0u8BM7Kt4Y-aVDkbyPf1YEfSVO26NKnLo4-X7mkfp0HP-FuVZu3t6P98z2j_b0mDD14pqJNsGOQRGfWGkgbAxsDDZci-F5QGegc23GiJFqsdZud1tpCHACEpad_sOJPdooUEvD_JYY84fvCIphOpOPd4KSSercgrpCdNGA6S_MUyUvzIM8FPhgRueOANmlptNVXi3NJSqp3bb_CMxuOKYXP-7oUKTOQRScGmfLZcRqXobDYIoRjtZADlm4rr4Rz5BktWi9uG3mg24NmYCIigCC2OFbBmGOel4xvIkAccDgAMUWLsgmqIVjhzJnO4Kq5QKhaKkQ78DQ54K27GoiKhXkA2dkYt2Sa4S0_v0zzpwUBZ1y97Qe5QbU0_QfWOGIIFBKD0nrF3uBF6rOXDiJg8kAfFi42ugd7OWHF1x8BSexURicRHVLvlKi9FCwl99Xy-AH0mATK-XZ1Ek8siixLLN1hKdX_TizINc6iehQqJqcvv8-yvn8WIXAcSewbm7Awtwv6zibph1Ut-tRXvLyQRuvC3v4p83RqXeo5CKpfnPTPwR9SejhmSA0VEoDxl235iqweS-RhU8QWCfAj22S3mIiWkUfwC3ZR6UVzZfpIxg3yLZyhz4kSTupFM_4qmzFFoOLcmuOlGTu-9ilLTUY5jJKjtoLyU9M_l-sdelTzodOISeHDolfAkHv2EQ1yMxIEcny68iwQBO3GkXXT6UY9M6wzP8SzXfVHP3Z1FYWgW3dYsJ-iaeWlMeM59-x9Tpm7XFs946qgMarA7AU4KHCHc3f4QHDUz6b04a6ipclAhXWVxLaXl1JzEAAjWGMlszJy3QL15wCI-Or2FPGzejCx4XVrOUthcm4aGQgAEhXkaM9dpHtHAfaB9XgKlOLjMLdYzpdgAQ
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.213.219 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-213-219.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: be59735d1779e37f764c271bdd0220b81a086fe619ea549268676fb4718c1cbd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
x-server-name: app09.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame F131 3 KB
1 KB 75ms
26ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/window_focus_fy2019.js

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:54:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 18:54:49 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F131 128 KB
39 KB 34ms
33ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2918d0edea50f453e2143087cb6f5b232a6fef8b687e228496629f0739fc809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39662
x-xss-protection: 0
server: sffe
etag: "1632310973010379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Mon, 27 Sep 2021 18:55:52 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/ Frame F131 14 KB
7 KB 72ms
23ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210922/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8144ce2cd5918de3beabc8fd113ab560103033fae3956e093b688cda5732a50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:54:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6232
x-xss-protection: 0
server: cafe
etag: 15606800361334891596
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 18:54:52 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F131 0
0 88ms
34ms Image
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTYuCaOcbuRSO2vLLSjQroSsCgGMMAv_9Wm31bFRpY8pctbA-kNaDZ28k9VFXXm1pNfkiAj_s0-qCq4b2NaspWb6M47eQ
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.164 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F131 41 KB
15 KB 51ms
20ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CF8iLhbrqQWigMzDSe0wmraKfMRZ1GBKoUEba_qStHl0t5ELV85RzgmYE1BGcTrLdYOLKsVFwZ2bDwsu7gP2SWRFGMnyJSydZ5Si5gD7DZx4hhSGiAv7XjXrBqYqmGbCI0U3ZIDVhnx9T7JZCOmpYMJHabBA&dbm_d=AKAmf-DZh_2mF-WBVZTL_3HNrf1OyzlrukD_fpwFoDR9WDBeVY8ts9rtMt4N5e-aPfQHJL6bNaf4s0mUfqC32_2_boPnpIqgMpgHBVUMIvRqJqfWkSegb4P4wtCzgOAep_m587Q0sNoloFOE7xVB4zzW0RMBSl4cT8fFD4gfDvNjJi7VKNq5Q-MUYCiYCua5Wl0bT6lWj-_0cSNIF33Dk5UXaAcCKF0tUAcMOC6SluM12tFMrvjbDZTfunZ8Yf4ha8jI7KUNYBgPEdcIPQv2mk2hp5c2ZX8JvupIwZ3vb5s5Lua5Jd3e3EzyHrjuqStvb2C7SdFcxgIQJgn0PEiCLpXZBMICLFW6NqwKdb_G0W36PWB7roVXS3MCkksiLb_3tc0cehIBBq2KRqzBrN_ZCSB8ZxLWiExvcwHp3lCx0cE_pqtYnSIllujJ31LRrKjajKXACvtXWnqGSaSFzHNvjlQtb329BvvcFi1PzOXOtq0oTCYD46WTnZ7kWFWFcniXLEjBmyieYAeWqlFnZ61qsmYTEeEzK20a1GIsvm_3OPsZC6hHCHPiAs0reBpYFs-RqBEZt2TVc9hTXrBaf52CA4h3bmi2VMCe80MMh0K9-UJ5GqTGqUE0ZmdJcQkwzLclgC6UFEDpTXTsC168S7DVmUDl976o13KOd4YPMsL156_ZItggQMRFPRUafzuE8lt-9s0ojomAnfX_7bqelbalknY5iJgcoO9zcDE0ZwGwAB5eB2sHY9-pYs-DFY4bqp46Y_C4k26ZvP80b1QPATuzYSVXB-7flBIn7nHD22iktMbGpvpv0OHKAVntkIjaar7RqCmKfGfh-4tlzF1UVZ40d5rmXB1ivl52k_VmLTRMbseHWLhotrCMntFvNIHpt06K2qqEAXIE0RuDyZrCG-Zv4iCQNkku8xXmS0GRwk5dyJaG4Ae-lzCNNsw29h3zcKsc1TIp5t5yHoIfsD7hCZHqSgmksgkEOk-q9du5yNxp6ZmsZkwMQkXnjvIDgrK99odEJnnKF_WvqZRKo1nrWi1McFiNQl248FTUTbDCYlsF7PPQvEGbtgRCmp6Q7NVjqWaubw2RcR6ne0xC-ncEU3FIHhVzE1HDZb7HJQ1mcD1wpFkmTjTy1wwtwSMqQBbt3jllqK5h8uOuztF6e_C_SW2DtlSzxTVi2PDUvlsc13rGfF2SxmaJvAvwjE3XN_267SBsANupA2BbF3ujIjMGICcM72P861aA_8MIQVCI8frsQOSA_NTWpfAi2mRLw884JHQOb7kC7SS1rotgEeOnYYyQGzkdb7imd3bj665moYKISWNJ7IpYOCMM8RwKFmC0Dxh_ITv2_QGfkPrrjPLJ6NpxyHmgLE-JzCa3C0ME9-fZWqxwT6Q_sVjJzyQmngxKJtO6mjI9FJs9Pr9z_zyKmuGDvyqkmrnKv393DfxwaL7rg3gxY6HpDaCTdoh__sAyWu3XccSs3nlcgE4qlZB-G9TfI4WMoYoBV6bELoQhkqvKm9h8Pg5ACz_VkL_V4OSVr7d55hW_QwWua42ISeEuL4-LEFJaIEw82ZeGM1AJXjNVKpdeSCCtXJ9SKUdcXKva2Nmn4hmhmxUbh3QRiNzKcU0HjChRrEyPHSBIbEocPWDX7fb97IUbhVbYqDZKXMJiZd5pAJ_jaMw9RQNCLsAqh7f_n9zibChTXQ0VUdm9LYpzIzrEdI29n2-t2OPscvdNLBCxtymrbHPT5zuAOtzPz2AyZzCytsLf0zObwsyj9oI1PJvQBC7kBb8upi-V2P38tWz3mWy67FiJcz2-VjSLtH3c9YH_J2IQo8OCtoG3oTQpcBsdeIIRK-FRFKFJ8SEk6UFPU93Te_rypfcE_n-50H_TTuGxEnjMz_WonyTRyZPHKHfEpZ4ahmS6mlKprpibgym_Wmq3BDctaWlsrbx_IQITXPvF-761R1EY66c0yOgLKN9zc3BG0mOWORIn_eq6SAl61FQ9DZ8PlbkKTesqWts8_kdDXFCMsGcGl5gx-9PBIPW01PlGFwgBv7o3oYvF9RthuIhhzMK0tvwwxZD-VUV_MoZeWwD2NcOKeb5YBHiaJ7e07an-yzfOrBaHldyowxSCXOUwnGxnZ10BH_TZq7gGj8gQQxQdwiD6DiufZqOhIxZclXZXpok_uDmL-W2vGi0LtmRdypX3EMsG4VvhZlI5aNRwRyO5ixBmj_yB_Zg619q7LBCW34xmRvM3oX1smJlDTXjORu87TAeWJgSEXWbgNZzc9b9GBGoWgSrsxwugxw00W2cccFgEpt3OOJF71dek_RNpBt8Ahv0xGYflmUWJclUXerUTYEsQojN3Ji96Piq8DZ_9ritMltWaIZCkbMN2iPOIqHV4XrbUj5zfQ8j9-AwuItxU-M4LsMdfGQ95_h8W1VsIsvFGRSqgvRTn8dn4k_ZR2vC61NBkHbzFaMv5AnGdcN7pXz08c4QRrO4u94Mqbtb16HE4dYVhpjzGZ9Yxw86d4NlVDSbQ-LwXllD3KqZ-AnAVAbOA6Ar5bDL8GpWyqBCxUDl7V8w&cid=CAASFeRoz12ke0cB9oH1eAqU4uMwt1jOlw&rfl=1%2Chttps%253A%252F%252Ffemme4.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 17:12:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 27 Sep 2022 17:12:16 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2E1E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1&C=1

43 B
1014 B

18ms
18ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK-IbBCetW8YvfOgpgEwAQ&v=APEucNWgc5Z9FVR-ilyqm_1pWs7DM0mCWhxy_gKTsQ-mGwwn-qhvpJ1F9R26_mCk1nGsJVO5kIuqSASV8Up9HtBcalPbzs70ff5VNEh8-bGY1CoXGpe8pjIc_m2KT5ADHiqupr7ec9XKk6CyH8C7UTBdyjtgMB3Ohxv4pqZHUrW0G7bFIFvQ5ds
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:52 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 18:55:52 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:52 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Mon, 27 Sep 2021 18:55:52 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2E1E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVITuCMfbBwvH.cA1NV0BAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1&google_hm=2

43 B
1014 B

21ms
21ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK-IbBCetW8YvfOgpgEwAQ&v=APEucNWgc5Z9FVR-ilyqm_1pWs7DM0mCWhxy_gKTsQ-mGwwn-qhvpJ1F9R26_mCk1nGsJVO5kIuqSASV8Up9HtBcalPbzs70ff5VNEh8-bGY1CoXGpe8pjIc_m2KT5ADHiqupr7ec9XKk6CyH8C7UTBdyjtgMB3Ohxv4pqZHUrW0G7bFIFvQ5ds
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:53 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 27 Sep 2021 18:55:53 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENKwcGMPR7Bj_6MQfvxV5tM&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2E1E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKOBrGb6mz4BqprYbCyAEe0&google_cver=1

0
578 B

104ms
104ms

Image
text/html

185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKOBrGb6mz4BqprYbCyAEe0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK-IbBCetW8YvfOgpgEwAQ&v=APEucNWgc5Z9FVR-ilyqm_1pWs7DM0mCWhxy_gKTsQ-mGwwn-qhvpJ1F9R26_mCk1nGsJVO5kIuqSASV8Up9HtBcalPbzs70ff5VNEh8-bGY1CoXGpe8pjIc_m2KT5ADHiqupr7ec9XKk6CyH8C7UTBdyjtgMB3Ohxv4pqZHUrW0G7bFIFvQ5ds

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:53 GMT
X-Proxy-Origin: 216.131.111.16; 216.131.111.16; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9c9c89f4-a960-46e6-a7a3-d903917c11a4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKOBrGb6mz4BqprYbCyAEe0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2E1E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg4MzYwNTIwMTk1NDE0MjI3NQ%3D%3D

170 B
243 B

33ms
33ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg4MzYwNTIwMTk1NDE0MjI3NQ%3D%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:52 GMT
X-Proxy-Origin: 216.131.111.16; 216.131.111.16; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9211c3d8-2d60-4c18-922e-e0beac6155a0
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg4MzYwNTIwMTk1NDE0MjI3NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0249 22 KB
8 KB 20ms
20ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Mon, 27 Sep 2021 17:12:16 GMT
expires: Tue, 27 Sep 2022 17:12:16 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 6216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET vid5f9d965e36a00836507330.mp4
video.primis.tech/uploads/cn19/video/users/converted/28743/video_5de3954e0895a499415686/ 0
0

GET
H3 200 9iDa3dU_tFEhRumWaalqbETNN5HIIuQ-Wj77Xalf13I.js Show response
pagead2.googlesyndication.com/bg/ Frame 0249 35 KB
13 KB 38ms
16ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9iDa3dU_tFEhRumWaalqbETNN5HIIuQ-Wj77Xalf13I.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f620daddd53fb4512146e99669a96a6c44cd3791c822e43e5a3efb5da95fd772

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7584
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13370
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 16:49:29 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame F131
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/818406/56999746/xbbe/creative/adj?p=APEucNUCTnMxPdRXmDR8hKo_KqZK_GjQ7S2-brZWU_VW8fk3uGn_elo&d=CnkAoCZ_4MU6qnPYGcHwwIfAfXiMW9iBA321sUMkhaJw8AUX6ZlyD_0OKWipqFnZ...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUCTnMxPdRXmDR8hKo_KqZK_GjQ7S2-brZWU_VW8fk3uGn_elo&d=CnkAoCZ_4MU6qnPYGcHwwIfAfXiMW9iBA321sUMkhaJw8AUX6ZlyD_0OKWipqFnZ-0ihvZBEZN6xTUsO84Tg96rxs...

65 KB
21 KB

103ms
51ms

Script
text/javascript

173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUCTnMxPdRXmDR8hKo_KqZK_GjQ7S2-brZWU_VW8fk3uGn_elo&d=CnkAoCZ_4MU6qnPYGcHwwIfAfXiMW9iBA321sUMkhaJw8AUX6ZlyD_0OKWipqFnZ-0ihvZBEZN6xTUsO84Tg96rxs_EsimBDU8Qth_ccqZBmf6Dl9-_OYyJJIiQObqbFSVNEDdi1XIRoyBb5tS34pyqryGDSE8aoD45jEvkRAKAmf-Ab0wsA1H-Tym00Wace4oDXfUbk4cQLrJfmL6RawdsNyDpZkK_CSmOcP-wAcud8wcZ0LFrqoTL3qLo4o6pRxPuZ53nCT1WnkiZseA8ts-V1Qrpm72Yfqc_pZcHLOF5uyCDtHl1dxRr8-DQGb7cnTQujOBySnWDkRvB8W4UXPuc1RHC3ItZH1jBGatutvA7A633oC9YNgWEsoMrfQgCF9NsP3IzS0hGwrWKRIpAYy7UyTIUybWHTUN1wbZ9G-vk-mXhMV1vlobJXQr0uGMV1gr-9LjSR_6fYpl4-SJFJryEQpjEb9y600zo5KTGpNTRoVelA_Y4PbtExY88nP9Wou0BoxMdRbQHN6pE_PdlSQLSQFK8dIgF72gLVrN4QPkujoaqkFanSSnVVqnveLZpHZUSgmrTW4UPsusJOfe9KdnXEVdVbXXu4aZB-NqQOPx5ywfGi7p7cjP0eGG0YbQdEZv1HM3rlc59BkDosEK5fjgprAGZmW1U0BvZ5tDYNRa3yJGZj1bzDtYZapZfNLcZ-tXTfQhovrfq7rcF_CWIj2fze978d-g9RvX4CFBbP-2Y-PzqhBUaV1n5BrKoeJhE22LNQT6GV2rp_8IFk0xNKJ0Igr-N14khug_0v6G8cr8MpoXcNmXk6LpixulKJPFW62qeyiXttThFZQW8tGaZEAgUvs0x82K5GYRGGEY5J8QGchTrk-Rt1FZHTACxlvK1QCHCC6WNfeQj3c76HxzkVLe4CxBrzaSLBf8v6uCeXCAA_zN-1G_VILQG4LqPZTki6ZVBThq6vVY5NtpLvHIEjDaAwpVMNfOXcYEiiOjMsZky8mJcZDLGr_0w2jytZRH2EPXrOQB-hqK5AuqsFd4ZeR1nbRQYKB5HwJmXrXzcZdnYJsTAGnZ0YjS_8170vweuXMSnDE1jOWHk5nGnfynNDWt4oQHSHUQxG8_hey1ixTPuT87ANMG7jQ21BdMH_s1R1cx_rtDbNbwvtxZdn8I63RruC0crAMgEJuM9PQ7jvaVU8ptlAZqQ-DbZ84n_BXjx0YRioabeWbs8tsUAYWLaONsH8SG8RHJd7loWLhT48dCGEWxi8d3GVF1towzGPCpi7nhzGp3RTlfJr2Ui0OWFOLH2oEhYkHctwTpTZD2Nrabv7K8Lipmex6Wsq8a5SsSvGg1Hr8Fi-fOORcTPC_PMmYBCzs5pCxU6nrY_ncr3KIidPnhjwpxeWZ_jN8h8W-LL3p1y55wuheccZtj2LNs82NfqAeBrrElZH5qyZq1vHND2bc9ktc-66nTa5RHTwqlRufN3YyaoLC1gvjGQ2VUKiFkIHBKvrfKh201MZP-EkvBw8noxrgvySD250L4YURciEjapnkcTT_8dXzbOveAqLqyYCHKRmCwMZ_dr6WD_fgQdJbwhWMxH1cdj3S45BWkVkaTBOosA13vTrikStcjR-QotGOcLVe2v-6qACc3fcamlj3nWN0_PuSnsSLojOKYWOlsPFDGlGCvTEoSEXWNDxJuV2D6REFbRr2MV2M7_j75HyJwwkVy6zYGvXqL9SzB21ED0i_xjX4AKScgqCNc6iayY-G-JVtK9W1PbrUVad69dmXHdTKqwCyUUxCT_u4EVQl_DKnoRlQbuN-6QfVrpvzqQEBWNr3y6KDEIEKrr-AKLJK5dS1fFzYw7e48MNu3NDj7CR0mTAypeDPAQkf8T3M_8LGc4CJHtojRB9Lx05PSSK8R1AY_Oo_q7xTJXIR7sYlN2GrGP2MDkVl053NhaLAI0WJIGJaiEWOIOi04rYSSwfaXnGyOA0XNBb-RhPpoRIwpq6A4-aRXdMl3cNUr4gxHgrQdFP7QxUKSepSuCIDFuX2km85QYkxQFR4DfhPNHE5V8VmUoyPNlUI0VklZwl05B7Q6j7eXUYBbWWgTmJiGjDzT0LmXEQja1nx-EkRgpKszJqFIg1tekFC34hngz2ISjLEpXl_6pU_G2K-KQCMJECEuLl7wJuqt42naeCnuLKbKlGee6QRSuH0AWf2W7lkUuM2a8C8Ixh4KUFW13Ff09HthQEK2Fy0tgEODA9ogU6tqNUmdxg0L8q45yL0zndVOvOVBNxCz20ardffU4tidrUcjNKiIN24LHSCQlJLVSm2i5dVhSrSN9Smfqx6jHRjiniWDyoeL7xVYCPLBND4WyMB0F5Hb2B_4BNwl3Orweuv0u8BM7Kt4Y-aVDkbyPf1YEfSVO26NKnLo4-X7mkfp0HP-FuVZu3t6P98z2j_b0mDD14pqJNsGOQRGfWGkgbAxsDDZci-F5QGegc23GiJFqsdZud1tpCHACEpad_sOJPdooUEvD_JYY84fvCIphOpOPd4KSSercgrpCdNGA6S_MUyUvzIM8FPhgRueOANmlptNVXi3NJSqp3bb_CMxuOKYXP-7oUKTOQRScGmfLZcRqXobDYIoRjtZADlm4rr4Rz5BktWi9uG3mg24NmYCIigCC2OFbBmGOel4xvIkAccDgAMUWLsgmqIVjhzJnO4Kq5QKhaKkQ78DQ54K27GoiKhXkA2dkYt2Sa4S0_v0zzpwUBZ1y97Qe5QbU0_QfWOGIIFBKD0nrF3uBF6rOXDiJg8kAfFi42ugd7OWHF1x8BSexURicRHVLvlKi9FCwl99Xy-AH0mATK-XZ1Ek8siixLLN1hKdX_TizINc6iehQqJqcvv8-yvn8WIXAcSewbm7Awtwv6zibph1Ut-tRXvLyQRuvC3v4p83RqXeo5CKpfnPTPwR9SejhmSA0VEoDxl235iqweS-RhU8QWCfAj22S3mIiWkUfwC3ZR6UVzZfpIxg3yLZyhz4kSTupFM_4qmzFFoOLcmuOlGTu-9ilLTUY5jJKjtoLyU9M_l-sdelTzodOISeHDolfAkHv2EQ1yMxIEcny68iwQBO3GkXXT6UY9M6wzP8SzXfVHP3Z1FYWgW3dYsJ-iaeWlMeM59-x9Tpm7XFs946qgMarA7AU4KHCHc3f4QHDUz6b04a6ipclAhXWVxLaXl1JzEAAjWGMlszJy3QL15wCI-Or2FPGzejCx4XVrOUthcm4aGQgAEhXkaM9dpHtHAfaB9XgKlOLjMLdYzpdgAQ

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f157.1e100.net

Software

cafe /

Resource Hash

b16f38b7ad423264312bdcab5cd899645cdf8fdf6f24ac5291c52bc43c13577f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20812
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-server-name: app07.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUCTnMxPdRXmDR8hKo_KqZK_GjQ7S2-brZWU_VW8fk3uGn_elo&d=CnkAoCZ_4MU6qnPYGcHwwIfAfXiMW9iBA321sUMkhaJw8AUX6ZlyD_0OKWipqFnZ-0ihvZBEZN6xTUsO84Tg96rxs_EsimBDU8Qth_ccqZBmf6Dl9-_OYyJJIiQObqbFSVNEDdi1XIRoyBb5tS34pyqryGDSE8aoD45jEvkRAKAmf-Ab0wsA1H-Tym00Wace4oDXfUbk4cQLrJfmL6RawdsNyDpZkK_CSmOcP-wAcud8wcZ0LFrqoTL3qLo4o6pRxPuZ53nCT1WnkiZseA8ts-V1Qrpm72Yfqc_pZcHLOF5uyCDtHl1dxRr8-DQGb7cnTQujOBySnWDkRvB8W4UXPuc1RHC3ItZH1jBGatutvA7A633oC9YNgWEsoMrfQgCF9NsP3IzS0hGwrWKRIpAYy7UyTIUybWHTUN1wbZ9G-vk-mXhMV1vlobJXQr0uGMV1gr-9LjSR_6fYpl4-SJFJryEQpjEb9y600zo5KTGpNTRoVelA_Y4PbtExY88nP9Wou0BoxMdRbQHN6pE_PdlSQLSQFK8dIgF72gLVrN4QPkujoaqkFanSSnVVqnveLZpHZUSgmrTW4UPsusJOfe9KdnXEVdVbXXu4aZB-NqQOPx5ywfGi7p7cjP0eGG0YbQdEZv1HM3rlc59BkDosEK5fjgprAGZmW1U0BvZ5tDYNRa3yJGZj1bzDtYZapZfNLcZ-tXTfQhovrfq7rcF_CWIj2fze978d-g9RvX4CFBbP-2Y-PzqhBUaV1n5BrKoeJhE22LNQT6GV2rp_8IFk0xNKJ0Igr-N14khug_0v6G8cr8MpoXcNmXk6LpixulKJPFW62qeyiXttThFZQW8tGaZEAgUvs0x82K5GYRGGEY5J8QGchTrk-Rt1FZHTACxlvK1QCHCC6WNfeQj3c76HxzkVLe4CxBrzaSLBf8v6uCeXCAA_zN-1G_VILQG4LqPZTki6ZVBThq6vVY5NtpLvHIEjDaAwpVMNfOXcYEiiOjMsZky8mJcZDLGr_0w2jytZRH2EPXrOQB-hqK5AuqsFd4ZeR1nbRQYKB5HwJmXrXzcZdnYJsTAGnZ0YjS_8170vweuXMSnDE1jOWHk5nGnfynNDWt4oQHSHUQxG8_hey1ixTPuT87ANMG7jQ21BdMH_s1R1cx_rtDbNbwvtxZdn8I63RruC0crAMgEJuM9PQ7jvaVU8ptlAZqQ-DbZ84n_BXjx0YRioabeWbs8tsUAYWLaONsH8SG8RHJd7loWLhT48dCGEWxi8d3GVF1towzGPCpi7nhzGp3RTlfJr2Ui0OWFOLH2oEhYkHctwTpTZD2Nrabv7K8Lipmex6Wsq8a5SsSvGg1Hr8Fi-fOORcTPC_PMmYBCzs5pCxU6nrY_ncr3KIidPnhjwpxeWZ_jN8h8W-LL3p1y55wuheccZtj2LNs82NfqAeBrrElZH5qyZq1vHND2bc9ktc-66nTa5RHTwqlRufN3YyaoLC1gvjGQ2VUKiFkIHBKvrfKh201MZP-EkvBw8noxrgvySD250L4YURciEjapnkcTT_8dXzbOveAqLqyYCHKRmCwMZ_dr6WD_fgQdJbwhWMxH1cdj3S45BWkVkaTBOosA13vTrikStcjR-QotGOcLVe2v-6qACc3fcamlj3nWN0_PuSnsSLojOKYWOlsPFDGlGCvTEoSEXWNDxJuV2D6REFbRr2MV2M7_j75HyJwwkVy6zYGvXqL9SzB21ED0i_xjX4AKScgqCNc6iayY-G-JVtK9W1PbrUVad69dmXHdTKqwCyUUxCT_u4EVQl_DKnoRlQbuN-6QfVrpvzqQEBWNr3y6KDEIEKrr-AKLJK5dS1fFzYw7e48MNu3NDj7CR0mTAypeDPAQkf8T3M_8LGc4CJHtojRB9Lx05PSSK8R1AY_Oo_q7xTJXIR7sYlN2GrGP2MDkVl053NhaLAI0WJIGJaiEWOIOi04rYSSwfaXnGyOA0XNBb-RhPpoRIwpq6A4-aRXdMl3cNUr4gxHgrQdFP7QxUKSepSuCIDFuX2km85QYkxQFR4DfhPNHE5V8VmUoyPNlUI0VklZwl05B7Q6j7eXUYBbWWgTmJiGjDzT0LmXEQja1nx-EkRgpKszJqFIg1tekFC34hngz2ISjLEpXl_6pU_G2K-KQCMJECEuLl7wJuqt42naeCnuLKbKlGee6QRSuH0AWf2W7lkUuM2a8C8Ixh4KUFW13Ff09HthQEK2Fy0tgEODA9ogU6tqNUmdxg0L8q45yL0zndVOvOVBNxCz20ardffU4tidrUcjNKiIN24LHSCQlJLVSm2i5dVhSrSN9Smfqx6jHRjiniWDyoeL7xVYCPLBND4WyMB0F5Hb2B_4BNwl3Orweuv0u8BM7Kt4Y-aVDkbyPf1YEfSVO26NKnLo4-X7mkfp0HP-FuVZu3t6P98z2j_b0mDD14pqJNsGOQRGfWGkgbAxsDDZci-F5QGegc23GiJFqsdZud1tpCHACEpad_sOJPdooUEvD_JYY84fvCIphOpOPd4KSSercgrpCdNGA6S_MUyUvzIM8FPhgRueOANmlptNVXi3NJSqp3bb_CMxuOKYXP-7oUKTOQRScGmfLZcRqXobDYIoRjtZADlm4rr4Rz5BktWi9uG3mg24NmYCIigCC2OFbBmGOel4xvIkAccDgAMUWLsgmqIVjhzJnO4Kq5QKhaKkQ78DQ54K27GoiKhXkA2dkYt2Sa4S0_v0zzpwUBZ1y97Qe5QbU0_QfWOGIIFBKD0nrF3uBF6rOXDiJg8kAfFi42ugd7OWHF1x8BSexURicRHVLvlKi9FCwl99Xy-AH0mATK-XZ1Ek8siixLLN1hKdX_TizINc6iehQqJqcvv8-yvn8WIXAcSewbm7Awtwv6zibph1Ut-tRXvLyQRuvC3v4p83RqXeo5CKpfnPTPwR9SejhmSA0VEoDxl235iqweS-RhU8QWCfAj22S3mIiWkUfwC3ZR6UVzZfpIxg3yLZyhz4kSTupFM_4qmzFFoOLcmuOlGTu-9ilLTUY5jJKjtoLyU9M_l-sdelTzodOISeHDolfAkHv2EQ1yMxIEcny68iwQBO3GkXXT6UY9M6wzP8SzXfVHP3Z1FYWgW3dYsJ-iaeWlMeM59-x9Tpm7XFs946qgMarA7AU4KHCHc3f4QHDUz6b04a6ipclAhXWVxLaXl1JzEAAjWGMlszJy3QL15wCI-Or2FPGzejCx4XVrOUthcm4aGQgAEhXkaM9dpHtHAfaB9XgKlOLjMLdYzpdgAQ
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame E291 80 KB
21 KB 45ms
8ms Script
application/javascript 143.204.98.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-67.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 19 Aug 2021 18:55:08 GMT
content-encoding: gzip
age: 3369646
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: PRdaV53z0kTC8_LI1so1nXqqnnXMah8BGR_tRT-tjILDgDB3YwBAWw==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 315ms
92ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvlD3,pingTime:-3,time:63,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:63,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B56~0%5D,as:%5B56~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rmeas:1,rend:0,renddet:IMG.us%7D&br=c
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
216 B 313ms
92ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvlD4,pingTime:-6,time:64,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:64,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B57~0%5D,as:%5B57~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rmeas:1,rend:0,renddet:IMG.us%7D&tpiLookup=ao:femme4.com*&br=c
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 304ms
93ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvlDf,pingTime:-2,time:75,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:421,beZ:423,mfA:425,cmA:426,inA:426,inZ:430,prA:430,prZ:435,si:441,poA:442,poZ:463,cmZ:463,mfZ:463,loA:485,loZ:487,ltA:495,ltZ:496%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:75,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B68~0%5D,as:%5B68~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,sinceFw:53,readyFired:false%7D&br=c
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0249 0
20 B 52ms
52ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bh1ySuBNSYd_DM8WV9u8PtdaIiA8AAAAAOAHgBAI&bg=!nZ6lntrNAAZNQyuQTUM7ACkAdvg8WkHzEJICriBOIXUJUOLmm2cLqfs-gfRezPnjKEv7Wu3wwXh0bAIAAACZUgAAAAtoAQeZAvPiZHqc5MNACrFbYorWfDEKM3hehNhVyakIEBE8ndFm7YikdLJJ3lgwoJS434_tu1aLGZW3wHREZF-UE90WobzvqiA3E0OLkWnVdXbFi52aYGO4c2kt-GgMolSrSY5Lo8QVP2UKrqBFFdH3W_U1FVnCkkxLmVK3WpNSALKLsliOT9XBTER8WVExg4OcpZGJJVqJQOFCaA6pQhy24zrGNJdx6rfLoI7wbzVTpyP86vwOa5lhYuL6MBF1EfENB9_iLVS75hls4cd5uOgJUGv9rg4YhOgWFo7gw5aaESXHMp4P6UTT1z8rgJFQyLtlOs_pL4i8Xc5kc4RLvAAJO0lrxzh6jvumGoD89_2L7DQz5pZWQ9iEK_3h_3v5tmYwm--g-NrhRccV1Um_bYgOkYYl0Of1VuHsooG5ZqQTlT72dhmH61wdsoY7Dx89DCj6n0v7zD9LMBHmwlUcauAAxq5T4RY-1IGwICv5_TtZN6hbKNWlJBYwnU5jIuD8FF-sI3F_JlEQFcaDemMxzJIxUGoewPWHHYb1ReeQREkvZFuMIGoVX3tKzMfBJQhp9F8AZM25bkB336kRhlwBqkc_FJfmoqHjsKSeG6kFBgD2zBwdWjIdPzVrXTsbfk46ZEOEKK5TGzr4h_iXHPfIC1ICuXJHtPyHJ81B91I1WLdf93xPCkm27o_AFOvI3WQYoTLmjMREEBZCB_wXUllGLyq4LL6AAnQMjpbvtEXa0NGeQAC53lOCl3deKoTxqzyep_tM9eWkcK_XHsBUeHPAfWfWOD5X-EaBb6zrs5XXcoV5brqkTe91p1NuQql6hLyEV-_sXQWi8hzUyxm_ZYInVj64xm3gUSXTqV_x49ah_MDZ-VHvH8dfZaDCYZgR6thQM60_gBNug9Lkwy1uEMIJ5_DDoc-GW2SqrwiQP9NtL5PemlwWfrkjRfsFd6go_lGJJMFVWkZJh8Wu0sviPGgC7oix3Qa_UJX-B6lebxTOKFsZmfTHJrnTCbZoog

Requested by

Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame F131 169 KB
59 KB 50ms
14ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cff7ab03cb4e476b49ea05511c6cfcc71af6d5ed20d40e9b40ee31062149e77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
Origin: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 11:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27273
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59842
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 11:21:20 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/ Frame F131 8 KB
3 KB 17ms
17ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/818406/56999746/xbbe/creative/adj?p=APEucNUCTnMxPdRXmDR8hKo_KqZK_GjQ7S2-brZWU_VW8fk3uGn_elo&d=CnkAoCZ_4MU6qnPYGcHwwIfAfXiMW9iBA321sUMkhaJw8AUX6ZlyD_0OKWipqFnZ-0ihvZBEZN6xTUsO84Tg96rxs_EsimBDU8Qth_ccqZBmf6Dl9-_OYyJJIiQObqbFSVNEDdi1XIRoyBb5tS34pyqryGDSE8aoD45jEvkRAKAmf-Ab0wsA1H-Tym00Wace4oDXfUbk4cQLrJfmL6RawdsNyDpZkK_CSmOcP-wAcud8wcZ0LFrqoTL3qLo4o6pRxPuZ53nCT1WnkiZseA8ts-V1Qrpm72Yfqc_pZcHLOF5uyCDtHl1dxRr8-DQGb7cnTQujOBySnWDkRvB8W4UXPuc1RHC3ItZH1jBGatutvA7A633oC9YNgWEsoMrfQgCF9NsP3IzS0hGwrWKRIpAYy7UyTIUybWHTUN1wbZ9G-vk-mXhMV1vlobJXQr0uGMV1gr-9LjSR_6fYpl4-SJFJryEQpjEb9y600zo5KTGpNTRoVelA_Y4PbtExY88nP9Wou0BoxMdRbQHN6pE_PdlSQLSQFK8dIgF72gLVrN4QPkujoaqkFanSSnVVqnveLZpHZUSgmrTW4UPsusJOfe9KdnXEVdVbXXu4aZB-NqQOPx5ywfGi7p7cjP0eGG0YbQdEZv1HM3rlc59BkDosEK5fjgprAGZmW1U0BvZ5tDYNRa3yJGZj1bzDtYZapZfNLcZ-tXTfQhovrfq7rcF_CWIj2fze978d-g9RvX4CFBbP-2Y-PzqhBUaV1n5BrKoeJhE22LNQT6GV2rp_8IFk0xNKJ0Igr-N14khug_0v6G8cr8MpoXcNmXk6LpixulKJPFW62qeyiXttThFZQW8tGaZEAgUvs0x82K5GYRGGEY5J8QGchTrk-Rt1FZHTACxlvK1QCHCC6WNfeQj3c76HxzkVLe4CxBrzaSLBf8v6uCeXCAA_zN-1G_VILQG4LqPZTki6ZVBThq6vVY5NtpLvHIEjDaAwpVMNfOXcYEiiOjMsZky8mJcZDLGr_0w2jytZRH2EPXrOQB-hqK5AuqsFd4ZeR1nbRQYKB5HwJmXrXzcZdnYJsTAGnZ0YjS_8170vweuXMSnDE1jOWHk5nGnfynNDWt4oQHSHUQxG8_hey1ixTPuT87ANMG7jQ21BdMH_s1R1cx_rtDbNbwvtxZdn8I63RruC0crAMgEJuM9PQ7jvaVU8ptlAZqQ-DbZ84n_BXjx0YRioabeWbs8tsUAYWLaONsH8SG8RHJd7loWLhT48dCGEWxi8d3GVF1towzGPCpi7nhzGp3RTlfJr2Ui0OWFOLH2oEhYkHctwTpTZD2Nrabv7K8Lipmex6Wsq8a5SsSvGg1Hr8Fi-fOORcTPC_PMmYBCzs5pCxU6nrY_ncr3KIidPnhjwpxeWZ_jN8h8W-LL3p1y55wuheccZtj2LNs82NfqAeBrrElZH5qyZq1vHND2bc9ktc-66nTa5RHTwqlRufN3YyaoLC1gvjGQ2VUKiFkIHBKvrfKh201MZP-EkvBw8noxrgvySD250L4YURciEjapnkcTT_8dXzbOveAqLqyYCHKRmCwMZ_dr6WD_fgQdJbwhWMxH1cdj3S45BWkVkaTBOosA13vTrikStcjR-QotGOcLVe2v-6qACc3fcamlj3nWN0_PuSnsSLojOKYWOlsPFDGlGCvTEoSEXWNDxJuV2D6REFbRr2MV2M7_j75HyJwwkVy6zYGvXqL9SzB21ED0i_xjX4AKScgqCNc6iayY-G-JVtK9W1PbrUVad69dmXHdTKqwCyUUxCT_u4EVQl_DKnoRlQbuN-6QfVrpvzqQEBWNr3y6KDEIEKrr-AKLJK5dS1fFzYw7e48MNu3NDj7CR0mTAypeDPAQkf8T3M_8LGc4CJHtojRB9Lx05PSSK8R1AY_Oo_q7xTJXIR7sYlN2GrGP2MDkVl053NhaLAI0WJIGJaiEWOIOi04rYSSwfaXnGyOA0XNBb-RhPpoRIwpq6A4-aRXdMl3cNUr4gxHgrQdFP7QxUKSepSuCIDFuX2km85QYkxQFR4DfhPNHE5V8VmUoyPNlUI0VklZwl05B7Q6j7eXUYBbWWgTmJiGjDzT0LmXEQja1nx-EkRgpKszJqFIg1tekFC34hngz2ISjLEpXl_6pU_G2K-KQCMJECEuLl7wJuqt42naeCnuLKbKlGee6QRSuH0AWf2W7lkUuM2a8C8Ixh4KUFW13Ff09HthQEK2Fy0tgEODA9ogU6tqNUmdxg0L8q45yL0zndVOvOVBNxCz20ardffU4tidrUcjNKiIN24LHSCQlJLVSm2i5dVhSrSN9Smfqx6jHRjiniWDyoeL7xVYCPLBND4WyMB0F5Hb2B_4BNwl3Orweuv0u8BM7Kt4Y-aVDkbyPf1YEfSVO26NKnLo4-X7mkfp0HP-FuVZu3t6P98z2j_b0mDD14pqJNsGOQRGfWGkgbAxsDDZci-F5QGegc23GiJFqsdZud1tpCHACEpad_sOJPdooUEvD_JYY84fvCIphOpOPd4KSSercgrpCdNGA6S_MUyUvzIM8FPhgRueOANmlptNVXi3NJSqp3bb_CMxuOKYXP-7oUKTOQRScGmfLZcRqXobDYIoRjtZADlm4rr4Rz5BktWi9uG3mg24NmYCIigCC2OFbBmGOel4xvIkAccDgAMUWLsgmqIVjhzJnO4Kq5QKhaKkQ78DQ54K27GoiKhXkA2dkYt2Sa4S0_v0zzpwUBZ1y97Qe5QbU0_QfWOGIIFBKD0nrF3uBF6rOXDiJg8kAfFi42ugd7OWHF1x8BSexURicRHVLvlKi9FCwl99Xy-AH0mATK-XZ1Ek8siixLLN1hKdX_TizINc6iehQqJqcvv8-yvn8WIXAcSewbm7Awtwv6zibph1Ut-tRXvLyQRuvC3v4p83RqXeo5CKpfnPTPwR9SejhmSA0VEoDxl235iqweS-RhU8QWCfAj22S3mIiWkUfwC3ZR6UVzZfpIxg3yLZyhz4kSTupFM_4qmzFFoOLcmuOlGTu-9ilLTUY5jJKjtoLyU9M_l-sdelTzodOISeHDolfAkHv2EQ1yMxIEcny68iwQBO3GkXXT6UY9M6wzP8SzXfVHP3Z1FYWgW3dYsJ-iaeWlMeM59-x9Tpm7XFs946qgMarA7AU4KHCHc3f4QHDUz6b04a6ipclAhXWVxLaXl1JzEAAjWGMlszJy3QL15wCI-Or2FPGzejCx4XVrOUthcm4aGQgAEhXkaM9dpHtHAfaB9XgKlOLjMLdYzpdgAQ&adsafe_url=https%3A%2F%2Ffemme4.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Ff9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Ff9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:ba2c45c2-d1b2-c1d7-628e-99f51a0e0199,c:prvlCl,sl:outOfView,em:true,fr:false,thd:1,mn:app09ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,scm:grpm1,nbld:0,mtim:3,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rp:n,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,tt:rjss,et:20,oid:89e43ca2-1fc4-11ec-97b4-0ae761671616,v:19.8.245,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:54:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 18:54:59 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/ Frame F131 23 KB
9 KB 16ms
16ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210922/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:54:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Oct 2021 18:54:35 GMT

GET
DATA 200
OK truncated
/ Frame F131 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6fd4f349e0a0fa1de9dc6cc432207f2abfc63538c5516dcb3004b55d569a9669

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 v2r8g11er.js Show response
cdn.krxd.net/controltag/ Frame F131 6 KB
3 KB 43ms
19ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/v2r8g11er.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1f36e88343e8a880cc99c3e50d83ca3937cf8c40a2cb4f5a48c2da6d19266106

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Mon, 27 Sep 2021 18:55:53 GMT
via: 1.1 varnish, 1.1 varnish
age: 457
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 2315
x-served-by: config-service-a003-ash-prod.krxd.net, cache-bwi5128-BWI, cache-hhn4043-HHN
x-response-time: 0
x-do-esi: esi
x-timer: S1632768953.483778,VS0,VE0
etag: "eca5dbc3b63ada79b47c1307dc4bf2c764399f18"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 92

GET
H3 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/ Frame 9501 9 KB
2 KB 66ms
30ms Document
text/html 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_273.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9027ca82332082b1cc863716c3d811bd00fe1ac5f34d2ef6c43cfb1e66a2574

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 2177
date: Mon, 27 Sep 2021 18:55:53 GMT
expires: Tue, 28 Sep 2021 18:55:53 GMT
cache-control: public, max-age=86400
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F131 0
545 B 114ms
51ms Ping
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvt2AYCQbnAk_cBjDTyV0Uh6uif5mdYvchxgFscuDYYdpQDgM-Gzhea5aOs4VUSGd5WEH73vpOOuPcd_GmQrWWYfEMRljSo71iNLLGaOnlpyqhPZrhnORx4a6UjjmJzeak1&sai=AMfl-YS3iUY8jIlYDrWrPBDMHJzutAImIp6r_9f9IIzBuoB793wGEeKuI99aNFWbR3M19Jkdqs7fKrE2doFfllFOH7iUVc2JP4Q-A-cGpb0&sig=Cg0ArKJSzBjj3KG5QB-VEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=94&cbvp=1&cstd=89&cisv=r20210922.41063&adurl=

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:53 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 93ms
92ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvlI8,pingTime:-10,time:378,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85My4wLjQ1NzcuNjMgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1632768953499%7C%7C27680acecfc757de60faaff936457151%7C%7Cc7e7172c7781b034963ef5178f1479dd%7C%7Ca88b6c508f3f2521625a1d92a4439f13%7C%7Cb5953f807a68a724db0a4382d64cf3ca%7C%7Cd487249c6a8a5ceb9394304aedcd70c5%7C%7C733323aa246904816bdb642d62cfadf4%7C%7C12a4fba5f57096e3053a7c3b0b139a23%7C%7C1629390669%7D
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ Frame F131 259 KB
83 KB 11ms
9ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/v2r8g11er.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Mon, 27 Sep 2021 18:55:53 GMT
content-encoding: gzip
age: 2228877
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 911247
content-length: 84509
x-served-by: cache-hhn4043-HHN
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1632768954.517584,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 9501 110 KB
38 KB 17ms
15ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 06:56:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43164
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 06:56:29 GMT

GET
H3 200 loading.gif
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/images/ Frame 9501 4 KB
4 KB 25ms
24ms Image
image/gif 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/images/loading.gif

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c1960c94e1c5ee83bb9f6385667ce93dd64c2917b65a517daf5485de3fdee801

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 08:12:35 GMT
x-content-type-options: nosniff
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
age: 38598
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4531
x-xss-protection: 0
expires: Tue, 28 Sep 2021 08:12:35 GMT

GET
H3 200 noImage.png
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/images/ Frame 9501 95 B
119 B 18ms
17ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/images/noImage.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 08:07:44 GMT
x-content-type-options: nosniff
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
age: 38889
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
expires: Tue, 28 Sep 2021 08:07:44 GMT

GET
H2 204 ad_impression.gif
beacon.krxd.net/ Frame F131 0
338 B 389ms
28ms Image
text/plain 54.229.245.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/ad_impression.gif?campaignid=25694833&advertiserid=4405680&placementid=301811561&adid=506495391&creativeid=149552647&siteid=4017846&url=https%3A%2F%2Fbeacon.krxd.net%2Fad_impression.gif&_kpid=db52f148-c553-40d8-ac75-ecc663cd5f10&confid=v2r8g11er
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.245.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-245-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:53 GMT
cache-control: private, no-cache, no-store
x-request-time: D=51 t=1632768953
x-served-by: beacon-n015-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F131 0
23 B 77ms
53ms Ping
image/gif 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:53 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 db52f148-c553-40d8-ac75-ecc663cd5f10 Show response
consumer.krxd.net/consent/get/ Frame F131 244 B
433 B 52ms
35ms Script
text/javascript 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/db52f148-c553-40d8-ac75-ecc663cd5f10?idt=device&dt=kxcookie&callback=Krux.ns.britishairwaysuk.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 176c248846f50a543ecd4bc8f1b182e57459841ff4e00b0c321cfafd8d9fa17c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:53 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a013-dub-prod.krxd.net, cache-hhn4028-HHN
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1632768954.625831,VS0,VE26
content-length: 194
x-cache-hits: 0, 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9501 6 KB
4 KB 56ms
31ms XHR
application/json 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fac785dfcd1e39270cd58001505e271aa70237a5e5bd621ea71f9a95d01e5a72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4534
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 98ms
98ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvlL1,time:557,type:e,im:%7Bpci:%7Btdr:506%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:557,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B550~0%5D,as:%5B550~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:96,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com
URL: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:53 GMT
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9501 17 KB
6 KB 29ms
28ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 27 Sep 2021 18:55:53 GMT

GET
H3 200 9iDa3dU_tFEhRumWaalqbETNN5HIIuQ-Wj77Xalf13I.js Show response
pagead2.googlesyndication.com/bg/ Frame ED66 35 KB
13 KB 19ms
18ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9iDa3dU_tFEhRumWaalqbETNN5HIIuQ-Wj77Xalf13I.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f620daddd53fb4512146e99669a96a6c44cd3791c822e43e5a3efb5da95fd772

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:49:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7584
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13370
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Tue, 27 Sep 2022 16:49:29 GMT

GET
H2 200 optout_check Show response
beacon.krxd.net/ Frame F131 89 B
248 B 29ms
28ms Script
text/javascript 54.229.245.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.britishairwaysuk.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.245.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-245-122.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f6a39aaae12ef0a8fca1efe5b554845fda34dec2bef0bbf7456cfc3ecfa1f3f7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:53 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=39 t=1632768953
x-served-by: beacon-n004-dub-prod.krxd.net
content-type: text/javascript

GET
H3 200 styles.css
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/styles/ Frame 9501 7 KB
2 KB 15ms
15ms Stylesheet
text/css 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/styles/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8d70549895604e4b504a22b8648e4dc9e32ae96407bec18304c091fb8162327

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 14:44:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15108
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2048
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 14:44:05 GMT

GET
H3 200 tweenmax_2.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 9501 113 KB
38 KB 24ms
24ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_2.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62afec092c21b138eeb1fc55859f60c19dd12ca3c02bdfeb336a820b016a547b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38915
x-xss-protection: 0
last-modified: Tue, 19 Jun 2018 18:02:41 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 Sep 2021 18:55:53 GMT

GET
H3 200 SplitText.min.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/ Frame 9501 9 KB
4 KB 16ms
15ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/SplitText.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b12639fc87f5b28725a50369a47a4eff9d9ed4604a2fbc0af7dc70c883df7d5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:04:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31874
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3823
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Sep 2021 10:04:40 GMT

GET
H3 200 dcoConfig.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/ Frame 9501 284 B
260 B 16ms
15ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/dcoConfig.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4129ebce4e25e120a95d1cd8bc9c7955833a4220607a44b1e4dcc47e5c762a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 09:23:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34356
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 232
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 09:23:18 GMT

GET
H3 200 loadDynamicContent.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/ Frame 9501 7 KB
1 KB 17ms
17ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/loadDynamicContent.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c19f8b6fcef66ebabb1129c57fbdca1896031aa0b650694fe08f690d663bc503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:09:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9955
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1336
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 16:09:59 GMT

GET
H3 200 animateText.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/ Frame 9501 8 KB
1 KB 16ms
15ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/animateText.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46d7fa49eae4c1d85175d16e7cd46122a5e6ced1ea6cc0af95a6abb3a12c975c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:10:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9953
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1209
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 16:10:01 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/ Frame 9501 14 KB
3 KB 15ms
15ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e4adfe3161f197d2d251aca2549822608057b2c75f4205d960db63e11f3cf60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:09:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9955
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2910
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 16:09:59 GMT

GET
H3 200 setDynamicContent.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/ Frame 9501 9 KB
2 KB 16ms
15ms Script
text/javascript 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/setDynamicContent.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d5a8dfd11c11b52023d1876638c69425e4562addc63af9da4591c9722e275bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:09:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9955
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2322
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 16:09:59 GMT

GET
H3 200 logo_BA_728x90_x2.png
s0.2mdn.net/ads/richmedia/studio/pv2/82616897/dirty/BA_ROW_JanSale_728x90_200KB/images/ Frame 9501 4 KB
4 KB 16ms
15ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/82616897/dirty/BA_ROW_JanSale_728x90_200KB/images/logo_BA_728x90_x2.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e190e536abbc5b6facd57f07b4b493f1915650e65e71d7423aed12bbf4dfc647

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 01:42:02 GMT
x-content-type-options: nosniff
age: 62032
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3704
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 23:24:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 01:42:02 GMT

GET
H3 200 37207215_20200609014224686_noImage.png
s0.2mdn.net/ads/richmedia/studio/37207215/ Frame 9501 95 B
119 B 17ms
17ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/37207215/37207215_20200609014224686_noImage.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 00:41:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 09 Jun 2020 08:42:24 GMT
server: sffe
age: 65636
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
expires: Tue, 28 Sep 2021 00:41:58 GMT

GET
H3 200 37207215_20201216045241253_logo_BA_partners_noATOL_728x90_x2.png
s0.2mdn.net/ads/richmedia/studio/37207215/ Frame 9501 2 KB
2 KB 18ms
17ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/37207215/37207215_20201216045241253_logo_BA_partners_noATOL_728x90_x2.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9a6de3eec22e872d7b61d61305f4251edb52fa182ebdadad3145e3ca4c767a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 20:13:11 GMT
x-content-type-options: nosniff
last-modified: Wed, 16 Dec 2020 12:52:41 GMT
server: sffe
age: 81763
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2238
x-xss-protection: 0
expires: Mon, 27 Sep 2021 20:13:11 GMT

GET
H3 200 btnReplay_x2.png
s0.2mdn.net/ads/richmedia/studio/pv2/80198434/dirty/images/ Frame 9501 344 B
374 B 19ms
18ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/80198434/dirty/images/btnReplay_x2.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84eefe476a87483be6222803df020c74d95901f9018b4c162241c935ef8542f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 15:00:23 GMT
x-content-type-options: nosniff
age: 14131
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
last-modified: Fri, 24 Sep 2021 23:20:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 15:00:23 GMT

GET
H3 200 37207215_20210330095018449_img_redbox_728x90_x2.png
s0.2mdn.net/ads/richmedia/studio/37207215/ Frame 9501 2 KB
2 KB 20ms
19ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/37207215/37207215_20210330095018449_img_redbox_728x90_x2.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa6d85d7272e37423356cf56a86f1ad73cf00f815f18a6ce6d0e597f6a776e03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 16:27:30 GMT
x-content-type-options: nosniff
age: 8904
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2137
x-xss-protection: 0
last-modified: Tue, 30 Mar 2021 16:50:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 16:27:30 GMT

GET
H3 200 37207215_20210329095427028_img_frame_728x90.png
s0.2mdn.net/ads/richmedia/studio/37207215/ Frame 9501 235 B
264 B 19ms
18ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/37207215/37207215_20210329095427028_img_frame_728x90.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e80d83dd333939aacda5df5002f454d70f4b732d9a64cbdbd0e5b1b0b94f61dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 07:29:12 GMT
x-content-type-options: nosniff
last-modified: Mon, 29 Mar 2021 16:54:27 GMT
server: sffe
age: 41202
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 235
x-xss-protection: 0
expires: Tue, 28 Sep 2021 07:29:12 GMT

GET
H3 200 37207215_20210329095349191_ampersand_q4_728x90_x2.png
s0.2mdn.net/ads/richmedia/studio/37207215/ Frame 9501 3 KB
3 KB 19ms
18ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/37207215/37207215_20210329095349191_ampersand_q4_728x90_x2.png

Requested by

Host: femme4.com
URL: https://femme4.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51715567b94b5211113b70712417dd42d55ba2f7e576941a1005237bef1d8cff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 20:13:09 GMT
x-content-type-options: nosniff
last-modified: Mon, 29 Mar 2021 16:53:49 GMT
server: sffe
age: 81765
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3469
x-xss-protection: 0
expires: Mon, 27 Sep 2021 20:13:09 GMT

GET
H3 200 myliusmodern-bold.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/fonts/ Frame 9501 24 KB
24 KB 16ms
15ms Font
font/woff 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/fonts/myliusmodern-bold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/styles/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4c7525c01c489de9abf572955a21bf934f3a1ae5709c7225192fd88b83dfea5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/styles/styles.css
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 08:54:34 GMT
x-content-type-options: nosniff
age: 36080
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24700
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 08:54:34 GMT

GET
H3 200 MyliusModern.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/fonts/ Frame 9501 19 KB
19 KB 19ms
19ms Font
font/woff 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/fonts/MyliusModern.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/styles/styles.css

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1ac368e0e9e45826b312abf1acfac674f86a9e6101fbef24404d2e18cf0a3e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/styles/styles.css
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 09:22:55 GMT
x-content-type-options: nosniff
age: 34379
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19340
x-xss-protection: 0
last-modified: Mon, 29 Mar 2021 18:02:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Sep 2021 09:22:55 GMT

GET
H3 200 37207215_20200609014224686_noImage.png
s0.2mdn.net/ads/richmedia/studio/37207215/ Frame 9501 95 B
119 B 15ms
15ms Image
image/png 216.58.212.166
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/37207215/37207215_20200609014224686_noImage.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/js/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.166 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61751583/20210329110246166/index.html?e=69&leftOffset=0&topOffset=0&c=SF8Sucxfei&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 00:41:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 09 Jun 2020 08:42:24 GMT
server: sffe
age: 65636
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
expires: Tue, 28 Sep 2021 00:41:58 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F131 42 B
64 B 27ms
27ms Fetch
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstRt_Zbis88fvvQH04KHCyUn8H8vXmzbmzdvPb1PdljDoz7trIdJCql6kzX94i3o2Gp7jvvUjV0nC7hg_SzpumRJfI04L9PYtGJnvZK8xJACg-oLqvl_g&sai=AMfl-YRgHKl8-eyqn_ET1V52Q2LPdrFF9I06u8rli5ZCaiu4kV1JbWDlxpyiRSlbDAFqjOyMAVcxv89O-rQBmVGq1EpVz3WvbL4tuFn6NUGQN-gITOjJd1eMPVN2J8qKM2CQ&sig=Cg0ArKJSzO_EiR_09pjpEAE&cid=CAASFeRoz12ke0cB9oH1eAqU4uMwt1jOlw&id=lidar2&mcvt=1000&p=1110,436,1200,1164&asp=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210922&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=637388854&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&eosm=0&rst=1632768952701&rpt=718&isd=0&lsd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 92ms
92ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvlYH,pingTime:0,time:1405,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D,%7Bpiv:100,vs:i,r:,t:1404%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:1,o:1404,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1398~0,0~100%5D,as:%5B1398~728.90%5D%7D%7D,%7Bsl:i,t:1404,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1398~0,0~100%5D,as:%5B1398~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:114,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:54 GMT
x-server-name: dt45.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
538 B 32ms
32ms XHR
application/json 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=z9q9llu&fmt=json
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: eeeb24f4b0c2453631b7c8b952eaf6e33bc20daa46fbb5d0eb32e406df373ee7

Request headers

Referer: https://femme4.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 27 Sep 2021 18:55:55 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://femme4.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Wed, 27 Oct 2021 18:55:55 GMT

GET
H/1.1

200
OK

Cookie set us Show response
sync.go.sonobi.com/ Frame B89C
Redirect Chain

https://sync.pubwise.io/usersync2/pubwisedirect
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fsync.pubwise.io%2Fusersync%2F%5BUID%5D

0
474 B

89ms
17ms

Document
text/plain

178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fsync.pubwise.io%2Fusersync%2F%5BUID%5D

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rotterdam, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Host: sync.go.sonobi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Date: Mon, 27 Sep 2021 18:55:55 GMT
Content-Type: text/plain; charset=utf8
Content-Length: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, no-store, private
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Tcn: Choice
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
X-Xss-Protection: 0
Server: sonobi-go
Set-Cookie: HAPLB5S=s579|YVITv; path=/; domain=.go.sonobi.com

Redirect headers

server: nginx
date: Mon, 27 Sep 2021 18:55:55 GMT
content-type: text/html
location: https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fsync.pubwise.io%2Fusersync%2F%5BUID%5D
set-cookie: pubwise_uuid=%7B%22zde_uuid%22%3A%22Xpubwise_uuid4-89ba3d77-740f-4d10-994c-0b22fa4c4cfb%22%2C%22zdxidn%22%3A11%7D; path=/; expires=Wed, 27 Oct 2021 18:55:55 GMT; domain=pubwise.io; samesite=none; secure; httponly

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0CBB 52 KB
17 KB 65ms
8ms Document
text/html 2.21.141.148
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.148 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-148.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://femme4.com/
Accept-Encoding: gzip, deflate, br
Cookie: icu=ChgIvYN7EAoYASABKAEwuKfIigY4AUABSAEQuKfIigYYAA..; uuid2=5883605201954142275
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Tue, 28 Sep 2021 18:55:57 GMT
Date: Mon, 27 Sep 2021 18:55:55 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 37A9 0
0 349ms
108ms Document
text/plain 208.100.17.173
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.100.17.173 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip173.208-100-17.static.steadfastdns.net
Software: 33XP003 /
Resource Hash

Request headers

:method: GET
:authority: ssc-cms.33across.com
:scheme: https
:path: /ps/?m=xch&rt=html&ru=deb&id=aYHEBY2cyr64kvaKjGFx_2&gdpr_consent=undefined&us_privacy=undefined
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Mon, 27 Sep 2021 18:55:55 GMT

GET
H2 200 pd Show response
eu-u.openx.net/w/1.0/ Frame 939C 668 B
731 B 78ms
35ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/6758a527-c373-49a4-94e6-5a958edc9a2a/v3/dyn/pws.js?type=default
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 219c479d0f702c06c26b367cccbef03c30d410c3aed92a57fd35db0541ca3317

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
cookie: i=d40ba5ed-1fce-4aaf-b1bd-ab9740cc1b67|1632768952
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=d40ba5ed-1fce-4aaf-b1bd-ab9740cc1b67|1632768952; Version=1; Expires=Tue, 27-Sep-2022 18:55:55 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1632768955|gekin0vNiygu; Version=1; Expires=Tue, 12-Oct-2021 18:55:55 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.216.3
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 27 Sep 2021 18:55:55 GMT
content-type: text/html
content-length: 420
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0CBB 0
578 B 14ms
13ms Script
text/html 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:55 GMT
X-Proxy-Origin: 216.131.111.16; 216.131.111.16; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 54e4978c-0e64-4eed-b7ed-a5756c9aa632
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 939C
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f60e6152-13bb-4800-b5cb-c587b2041e3f

43 B
106 B

34ms
33ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f60e6152-13bb-4800-b5cb-c587b2041e3f
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
via: 1.1 google
server: OXGW/16.216.3
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 27 Sep 2021 18:55:55 GMT
Server: MT3 3984 0e3af3b master zrh-pixel-x27 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=f60e6152-13bb-4800-b5cb-c587b2041e3f
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 27 Sep 2021 18:55:54 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 939C
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=FEzjNxNOtGcPSrU2Exv7ZxFEtGMPS7RkEkVLpXJ6

43 B
106 B

35ms
33ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=FEzjNxNOtGcPSrU2Exv7ZxFEtGMPS7RkEkVLpXJ6
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
via: 1.1 google
server: OXGW/16.216.3
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=FEzjNxNOtGcPSrU2Exv7ZxFEtGMPS7RkEkVLpXJ6
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 939C
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8884494790974473561

43 B
106 B

33ms
33ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8884494790974473561
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
via: 1.1 google
server: OXGW/16.216.3
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8884494790974473561
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 939C 70 B
264 B 32ms
31ms Image
image/gif 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=07a79ab4-b649-7558-eb6b-637f24eb289a&gdpr=0
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 939C 170 B
188 B 32ms
31ms Image
image/png 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MmJjODQ5N2UtN2YzZS0yYmZjLWZlOGItMzljNmVlMDllNmZh

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 939C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEA5Cr77ghII0yAr3_S3Kn0Q&google_cver=1

43 B
122 B

48ms
33ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEA5Cr77ghII0yAr3_S3Kn0Q&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=8a7b90a1-530b-4793-beca-96f1a9def426&gdpr=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.216.3 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eu-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
via: 1.1 google
server: OXGW/16.216.3
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEA5Cr77ghII0yAr3_S3Kn0Q&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 93ms
93ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvmeQ,pingTime:1,time:2406,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D,%7Bpiv:100,vs:i,r:,t:1404%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:1002,o:1404,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1398~0,1~100%5D,as:%5B1399~728.90%5D%7D%7D,%7Bsl:i,t:1404,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:98,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=c
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
x-server-name: dt31.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame F131 43 B
215 B 92ms
91ms Image
image/gif 34.235.176.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=818406&asId=ba2c45c2-d1b2-c1d7-628e-99f51a0e0199&tv=%7Bc:prvmeR,pingTime:1,time:2407,type:c,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:19%7D,%7Bpiv:100,vs:i,r:,t:1404%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:1,slTimes:%7Bi:1003,o:1404,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:19,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1398~0,1~100%5D,as:%5B1399~728.90%5D%7D%7D,%7Bsl:i,t:1404,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:98,fm:sKeU8aS+11%7C12%7C13%7C14*.818406-56999746%7C141%7C1421%7C15,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn,metricId:grpm1,cmr:t%7D&br=c
Requested by: Host: femme4.com
URL: https://femme4.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.235.176.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-235-176-154.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f9f1e97b0f88a3adbd9aa2d8b0925eeb.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 27 Sep 2021 18:55:55 GMT
x-server-name: dt33.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 39ms
38ms XHR
application/json 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021092101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe5e2a70478d49c9c308721568976a2aa09fc09277a04060edb384a2b9f846b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 27 Sep 2021 18:55:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8699
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 43ms
42ms Script
text/javascript 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092101.js?31062917

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:55:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 27 Sep 2021 18:55:56 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0CBB 0
578 B 20ms
19ms Script
text/html 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 27 Sep 2021 18:55:56 GMT
X-Proxy-Origin: 216.131.111.16; 216.131.111.16; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 39b121b3-7202-45fd-abf5-1438a098fc13
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 0474 12 KB
5 KB 21ms
20ms Document
text/html 142.250.185.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Mon, 27 Sep 2021 17:24:01 GMT
expires: Tue, 27 Sep 2022 17:24:01 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5515
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 7C18 783 B
535 B 94ms
36ms Document
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

a5090e03c257745ce294e3f81220a9e964221cd0dea8df4d29549f5e4ddd4ea5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3wObgeRVYBxmWEWaZfqfwg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://femme4.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://femme4.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 27 Sep 2021 18:55:56 GMT
date: Mon, 27 Sep 2021 18:55:56 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-3wObgeRVYBxmWEWaZfqfwg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 9iDa3dU_tFEhRumWaalqbETNN5HIIuQ-Wj77Xalf13I.js Show response
pagead2.googlesyndication.com/bg/ Frame 0474 35 KB
13 KB 22ms
22ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9iDa3dU_tFEhRumWaalqbETNN5HIIuQ-Wj77Xalf13I.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS