nex-software.com Open in urlscan Pro
2606:4700:3032::6815:4aa6 Public Scan

Software

sffe /

Resource Hash

4790c335cf526d7cd9273c59587e22911a2f9ddfd36b9352c67c3c624870d086

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "924 / 758 of 1000 / last-modified: 1625737289"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24121
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H2 200 prebid4.19.0.js Show response
get.optad360.io/sf/ 410 KB
411 KB 7ms
6ms Script
application/javascript 2600:9000:21f3:e000:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid4.19.0.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/1a65995e-7e07-43bd-8be2-2ee136ae3c03/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:e000:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 257579348172eb9f739308373580772054c0b671f63e8f002aed9f9774a6272e

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 04 Jul 2021 10:03:32 GMT
via: 1.1 882f747f39885162595630c95dd0012d.cloudfront.net (CloudFront)
last-modified: Thu, 17 Dec 2020 09:52:06 GMT
server: AmazonS3
age: 345313
etag: "08b0612ac0c68ebf519b28323f4e2aa2"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=604800
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 420147
x-amz-cf-id: Cwl_bof1vncZrq3i8lXp_wVy4Kh8D__6SlrdUjasmQiC1do-WjplsQ==

GET
H2 200 portal-v2.html Show response
c.sharethis.mgr.consensu.org/ Frame A2F2 2 KB
1 KB 24ms
7ms Document
text/html 2600:9000:21f3:3600:c:a9b7:ddc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/portal-v2.html
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3600:c:a9b7:ddc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8bc62c9ef81390af989b3829ace60aae916e299dab9df7ec5e49db2d07a956b6

Request headers

:method: GET
:authority: c.sharethis.mgr.consensu.org
:scheme: https
:path: /portal-v2.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

content-type: text/html; charset=utf-8
content-encoding: gzip
cache-control: max-age=3600, public
date: Thu, 08 Jul 2021 09:25:19 GMT
etag: W/"865-g9QqzjbIJI1xmvSY3DM2A/8Cpl8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aab8eb1f7b95159cdf1cf139d0bbc33c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: lyyhQlYT3aGXWqK7zEX7xPnJaTwlR_iSYw8Kcxk2QI9BWE294eWJCA==
age: 2005

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210624/r20190131/ Frame C232 10 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210624/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210624/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 07 Jul 2021 23:21:00 GMT
expires: Wed, 21 Jul 2021 23:21:00 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 38264
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 csub.js Show response
js.wpushsdk.com/npc/sdk/wpu/ 6 KB
3 KB 52ms
16ms Script
application/javascript 213.174.135.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpushsdk.com/npc/sdk/wpu/csub.js
Requested by: Host: cst.wpu.sh
URL: https://cst.wpu.sh/static/adManager.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.16.1 / PHP/7.1.28
Resource Hash: 9b071145e8b79dd2326a2ef3298fa5b76167b9cc875a9e5ee48e129b87d2b390

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
server: nginx/1.16.1
x-powered-by: PHP/7.1.28
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Thu, 08 Jul 2021 10:58:44 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
943 B 16ms
15ms XHR
application/json 2a04:4e42:1b::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20210708

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid4.19.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:1b::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7de01f9988d0a2dfe0d9a6314dc46caa2690a4f6f9438478e8ac6576164b1591

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 24822
x-jsd-version: 1.0.1031
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 871
etag: W/"69c-WZRDAQQqkT3WTB+9DpOUGLfvcJY"
x-served-by: cache-fra19160-FRA, cache-hhn4030-HHN
x-jsd-version-type: version
date: Thu, 08 Jul 2021 09:58:44 GMT
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
338 B 94ms
23ms XHR
text/plain 18.198.109.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/pview?event=pview&hostname=nex-software.com&location=%2F&product=unknown&url=https%3A%2F%2Fnex-software.com%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Toda%20La%20Informaci%C3%B3n%20Acerca%20De%20Los%20Archivos%20M%C3%A1s%20Populares&cms=unknown&publisher=5c086b7ea71f090011aea084&sop=true&bsamesite=true&consent_cookie_duration=243&consent_duration=243&gdpr_domain=.consensu.org&gdpr_method=cookie&version=st_sop.js&lang=en
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.198.109.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-109-212.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:44 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Origin: https://nex-software.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H3-29 200 pubads_impl_2021070101.js Show response
securepubads.g.doubleclick.net/gpt/ 329 KB
114 KB 38ms
36ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e4f0cc2a47e98ed56d5416afb1177b7337b7dc7cf561d9297854f527a9796d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 01 Jul 2021 08:37:23 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117092
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 35 B
75 B 38ms
38ms XHR
application/json 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=nex-software.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

839d328c7c5bc3b5956499c28e474db8392368a12c32960c15d5015b9ae8180a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H2 200 integrator.js Show response
adservice.google.nl/adsid/ 107 B
166 B 15ms
14ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.nl/adsid/integrator.js?domain=nex-software.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
166 B 15ms
15ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=nex-software.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 398ms
397ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3265601537674040&correlator=3447279448140885&output=ldjh&impl=fif&eid=31061161%2C31061736&vrg=2021070101&ptt=17&sc=1&sfv=1-0-38&ecs=20210708&iu_parts=121764058%2Cnex-software.com_SF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C750x100%7C970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1625738324&dt=1625738324257&dlt=1625738323569&idt=662&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1200&adks=1675753954&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=728x-1&ga_vid=2113604504.1625738324&ga_sid=1625738324&ga_hid=1212462457&ga_fc=false&fws=640&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

343de3810b3a5417e88219a99ce3d2a7b1eb1934d4a6ffd4ceb9ff29c73680cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8216
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D58E 6 KB
3 KB 41ms
13ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 08 Jul 2021 09:58:44 GMT
expires: Fri, 08 Jul 2022 09:58:44 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 12 KB
7 KB 1897ms
1896ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3265601537674040&correlator=3447279448140885&output=ldjh&impl=fif&eid=31061161%2C31061736&vrg=2021070101&ptt=17&sc=1&sfv=1-0-38&ecs=20210708&iu_parts=121764058%2Cnex-software.com_adi_ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C970x250%7C970x300%7C728x90&cookie_enabled=1&bc=31&abxe=1&lmt=1625738324&dt=1625738324261&dlt=1625738323569&idt=662&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=214&adks=3839973153&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=970x0&ga_vid=2113604504.1625738324&ga_sid=1625738324&ga_hid=1212462457&ga_fc=false&fws=128&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9e74460859c670a43b1fbd283e39e9bd58ed5ec28221ce42da96ebf91793ef3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7430
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 49 KB
24 KB 1490ms
1488ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3265601537674040&correlator=3447279448140885&output=ldjh&impl=fif&eid=31061161%2C31061736&vrg=2021070101&ptt=17&sc=1&sfv=1-0-38&ecs=20210708&iu_parts=121764058%2Cnex-software.com_am_S1&enc_prev_ius=%2F0%2F1&prev_iu_szs=750x100%7C750x200%7C750x300%7C300x250%7C336x280%7C360x300%7C580x400&cookie_enabled=1&bc=31&abxe=1&lmt=1625738324&dt=1625738324263&dlt=1625738323569&idt=662&frm=20&biw=1600&bih=1200&oid=3&adxs=283&adys=1013&adks=2900257689&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=750x0&ga_vid=2113604504.1625738324&ga_sid=1625738324&ga_hid=1212462457&ga_fc=false&fws=128&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6c9617fd596878fcad6c7d0d7a72f96d3b49990e9ca05697732b0b7c7ecdbb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24056
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 23 KB
12 KB 767ms
766ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3265601537674040&correlator=3447279448140885&output=ldjh&impl=fif&eid=31061161%2C31061736&vrg=2021070101&ptt=17&sc=1&sfv=1-0-38&ecs=20210708&iu_parts=121764058%2Cnex-software.com_adi_W1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C200x600%7C300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1625738324&dt=1625738324265&dlt=1625738323569&idt=662&frm=20&biw=1600&bih=1200&oid=3&adxs=1123&adys=1100&adks=1612028736&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=300x0&ga_vid=2113604504.1625738324&ga_sid=1625738324&ga_hid=1212462457&ga_fc=false&fws=128&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e4b3f3213802ffec8990f8198811f89427e48a0013503c0bc7773267497b8dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11815
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 466 B
268 B 1041ms
1040ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3265601537674040&correlator=3447279448140885&output=ldjh&impl=fif&eid=31061161%2C31061736&vrg=2021070101&ptt=17&sc=1&sfv=1-0-38&ecs=20210708&iu_parts=121764058%2Cnex-software.com_adi_right&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&cookie_enabled=1&bc=31&abxe=1&lmt=1625738324&dt=1625738324266&dlt=1625738323569&idt=662&frm=20&biw=1600&bih=1200&oid=3&adxs=1123&adys=266&adks=2130749378&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fnex-software.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x0&msz=300x0&ga_vid=2113604504.1625738324&ga_sid=1625738324&ga_hid=1212462457&ga_fc=false&fws=128&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

4792482be9dc0e853af67bfde4ef5156bba58921d05ba92079ec46884d5fd3b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 238
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://nex-software.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CC56 6 KB
3 KB 23ms
7ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 08 Jul 2021 09:58:44 GMT
expires: Fri, 08 Jul 2022 09:58:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea666b0953da9928fad569dd20e99bc4900935a2ba63f82246e4d0c4012e1970

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625657948508962"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27726
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 27ms
26ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021070101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae32af51c77f39fb913cc783bdc6771f0f2563d9336866e61a6fce34a9ae8a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8516
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3736 624 B
300 B 27ms
26ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1qu1PTAB&v=APEucNWQJ7SZt8q1iTu6h_RTsfX-vBunaiw1u-RxjnTcJzKRE29BSV7RpWE3DHM9cJjJ9yjlGi2wyj8ZAZIEf0JMSP6IHigmoCzusDoDt5toqAMveCLk2dWwopcQ3F_DDslONTfZEG60G1hOlnINDavWysG3nv2uHy4P8UfBoyVyb5LkScebP7UGyysOq9KAat0wo0txPMJoD9R3ku_s0ySEJe4XeRNTFA

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY1qu1PTAB&v=APEucNWQJ7SZt8q1iTu6h_RTsfX-vBunaiw1u-RxjnTcJzKRE29BSV7RpWE3DHM9cJjJ9yjlGi2wyj8ZAZIEf0JMSP6IHigmoCzusDoDt5toqAMveCLk2dWwopcQ3F_DDslONTfZEG60G1hOlnINDavWysG3nv2uHy4P8UfBoyVyb5LkScebP7UGyysOq9KAat0wo0txPMJoD9R3ku_s0ySEJe4XeRNTFA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 08 Jul 2021 09:58:44 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUl9J0PExmMABBHGnEd0hMuRTExV6ZZJ791Og54S92Jhgg6ZQPhlAh7HOt4v; expires=Tue, 02-Aug-2022 09:58:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CC56 24 KB
12 KB 49ms
46ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DztEZ9VeZ3Mvek-ke2H8DHf3LBtjTKCZfh3oLIkvLXmMGC8HE8h0sSHD4RdVi5mWg0LMdaqVTeD7aNZQZiUbxylXuZwDofE9mQAkpukVMLanKnSvVXzt1BqPawuodviIlml_WTHOGDW9C-hyXGYQTh6aM25w&cry=1&dbm_d=AKAmf-A5yvSSFjxw94OyZC41u8xEBypOUtUwoMDSbQnbprYcYfgKnFUjHcXB9gj-i0j4Hz77AfIlMz97KyDfZBotKrm65AZow5i-xOzG3EUbHwGf4ip1Uky-ROoNDdODdcaWVzVXODbjlIPfS4yTkHDt-gMuSrVyhwIuHmMde_Xr_evVRICiBNv0_OlKzVsUgAAvnF-oTOP4YTi2xLmdeIu6gxtIHpWiJQLRD-V1SH1q77u3bNvscPTRtEfOgxBQxogRycfV06ek0wd9FCSOLnWb8DQS-nfBBF5lhOgQVIRAQTAIr5dc0q-dVGRMDGaJG1BkQZ3XPlpnleldHngCtLGjzl94Gt2zEiRt9x9QvFcbouc_58L3YcNfpgdu-8IPxqojggXokq4PPvP6HTsaYW5NY4BKyVjnCeTZBvyNZCBcT8LcGYaE6ROAWgNxZW2J-aqgANJ1Tdjds8hwG_HQhk7WL0k-jOPISKzbUUdFSWMs6ULowl0vS2LJZVmeFegcEBOA2WMSW3W6c38EcsqgqTzkX2nebCjrGLrKyuEKQxvj3PccAG4NpwELqapMTbt98lBD9-924t1q6LQR5gzjFdz1GpEHBXT_MC1-wQBy3PrB2ygFMApkswRQyg9vtg8csfHcFbj9hBNPiwO8UT9HMGkOhCcpFiE5Q_7IWn0-p0790atKvURYE0ypu-xYb-4i-ueauYFlypzUDMt3CYz_OpWy28bk9f5YRBSNX6VglOojFpAQ5pgcsqvjg7MPg0GkJbj7KXg3cm_dB389vm5ghNXjXYlrTJIcv5-XIF1zE0FDC5wF0MazJ0AFuZOlmCBq6EZNrtYRDmjquGNOCW19n4uyKAisJzqbbbSXuV6FsnXQ8GGxjqU2Gtwaa8cIcdWP_ugQ51bU-zlu2vEmozV4ucXSGoBvhxVit9DIIqCCy32kkUmeU6Plp6EVvrsYq51atQLzQhyT1slipPJg7BxuePzD46Re64ukGLVxX_424TTVlg9CS5iKCKWkYV_p5NYd9a_13_a3ZzW3kObX5iaYDSioe2m7yZPIl9H_uKsetVqTvcNXYuWwBisezF8gnBojQtoEXOV0VtfqMPnKcW2Tzfwq76xVJdMLrFRq1vn2jqWRFyC-G6ywgtT1jxF5u8m6QQlTgZYb4uGPgiZlKhL91vssxLNUq-xqQ7x6I-UBYmfnOqkvM3u0BEzyDrNjjSn76P7yc_JKwyJLn-tfu4SRH7xRfdEWT1wrLQNHwBJjRLd_zWHjhhVOmNHcqKff5cDVvHzlrTtRkim3VafWQL0ftTnbi82FJkZqH-kefUcw41_LpcUbflHNUeeThL75x6iTlbjGk5uL3S5wddtaAes-x_W6E65G2v0QO6jJWUE_Jj1WjPZZYCe11jqErN8IPXu3lOqjsE8ibDwYdLFB-6kqyWHpZleNFXRyo9qJOCqBXbFOI2zWWxGG6Bmt4dJVpDUj6rjEcVmxT8nC9X2b4qYQXC_6FkK40tGXHkbhZksIyi7WDcV4qSAdzhpWtqwhrKFcZJIVZ-Uy_qsjFjvj6ANVt_PhxeMhJuTEz6Fg2O3odlmrO4QZMWZ6Aa9gbq1IZKCZV_bx-9V95YTxzDSZSDLRdRo5TN2WaEUGzf4x1LxS3N_GVYIpAtfqK3dHW_EwBNgcAHC-ORCn7kKCT7-babbWDO_2PzKVEv23PhWoqAI0qtmFxg3I1WPHaySYKVwskdjQGq7mug3BtqWQlGsM6W16sKtdUB9VdEJrB8oSuIM0mtDZeDiLMxJOLbRrAm_QRdqfP5pSXH7-rmWZKHWDzA37269gromxgNVLvmfk8Q__QUrOOb0qbH3N0TDFe_O2sdis_LFx2mhLtZoYIMIM_eDjiKIIdhUGjXNUWkZSEqPXV-kHwe0Sy54QV8pQEiaV286FoxqxdIUb_xmxrAoU8fPrR7MUzAiakNRmhCRI76JjEOiDmvmQ3oSoLBHB3WLdhp7POrTDOvocG8LnubEFXirgWik2_3MEoSg_dOplD7CCjGBIxo-WAynD0vjQS4FxZMJ1pyTwbrq_f-4Z6KD2fROywG9f__JOTmmGj2kxuFeeppAbnHujDg1Ar0fm86iMbejoz7PSlv3C4bd-XLVt-JTK-1KAuIo6NBSt5pY3_GcoGZuU9y_aXLofteRQ3ZYA7mz8cgtMjzrPhURhT-fALwwYWAQtCp22vhD2VLd44ddh4iP4J2Q4PqZCicjTchQ1wHyOWkw8sm4mnrsw7TXS258Iz4Prt53dDvRBvRrQa0lx54cEzuglwxzvdm7XGFvRzzsXNtIqj7M_cPN9h-WZQMLjyVk3VlFhptJuYI6321xsvn1jplby3uWkCGXXN-2SHif0tAdeVOel0h1oMA4Q_HgwbTiSts7QeDzzcWP17snO6OhN9aqLeCvAZi7q5bdrt4K0M5RmUX4ZMxuqJoFUFKWee386FkX3zNcXvC1l9SAfuteSMUtDJH2okzEvrGsBaZO5L0PzLAEhOqrCbqgYniFLaRKcyG5m1jkhMXNXMOxYg5uKnEkuDWdKo_4NOdFXvzb7Cq4OjwpXRtSrGbkTmFyh6bTGq7Qmh8awTc1L7eKI9QjW5Iap-NrJ1Bl2EfTloIn1OOl-7cRwkkOUKI_Iuvi5l9lCHRoHUmKIypBjgCC8fVxuGmRTHVTOCXKHCTHdpKvXWN1PqofQZpZOjA6-S_Is1luunx2mMWbvGvcTQb0-c4yb931UqlBfX3zFcvN9YQcLqze3p99I8pDC-tZzzFJ39expGyDRW8ir97qsxTV2yR2DCYCKBm9n9cMJJmUHdEe6RVVU8AnEdGFignxKMih1WXQP9SL2_23pW14-Bgw7NPUvAVPAQp133sAcrG0PQsQS11HQrqHXR8Eo0VrXgTRNxlr5QC0N5rWCnqPxqgxkYPBxKptM5UukNn--MEZHKqz4Vr-GhxJuaMmQseN-iLWS1gzqJgLNigwyPOX9mBo418M5hZpSakdDfkKVdOUhU_mEkU8UHLGrFFvckPYoqHd1cQkdgkai0UwaA8ZPh4dU-vimuALmFmCiSSaETUAFVeq_pAV3-EsyAdmS-1QmM4RKUj9WR0G6N6mzRLk7Mo92ph3XOEWId2Ra6m8VPhKxkpL60uA9RaY5sUl5rtzzlkfoKOtxF5jN5gSRIMVfB5BeS36749sC8pOKJBo&cid=CAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA&rfl=1%2Chttps%253A%252F%252Fnex-software.com%252F%240

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

56ea5a6789735e01b00d74f20b2b35389ec5b2d4c58de2052131e4c70cfd0bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12365
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CC56 42 B
63 B 50ms
47ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CmmuZr1lRc7cU67kV1JKZ9jQokn-u-I4SfsJ7NYPi6tfQdzXBxKhEXSGzA1sOGiFEk_dFtgcIqqOA-KC3NBNg7tG_Y-wv5x51_YTb-YdYMuUiYrS8

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame CC56 3 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 241
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:54:43 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CC56 123 KB
37 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28a030a77bcecc0621b938dc08610e4c1fa0e131507a2dbd0c8007960d269253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:44 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625657928851490"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37883
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:44 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame CC56 14 KB
6 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:32 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame CC56 0
0 15ms
14ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSUZWdWtFamo1GwOVtV91WqNKZCtkZa97ls4E2Jjopv5w2kb75bT8Dl1HUN-wMhRE7MWuyfFrOQyPT0kXxN61TPcR3n0Q
Requested by: Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame BC25 12 KB
5 KB 18ms
13ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Thu, 08 Jul 2021 09:43:48 GMT
expires: Fri, 08 Jul 2022 09:43:48 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 896
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4327 783 B
531 B 19ms
17ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

17b3d3073651a7d5db3cb06d200cf7a7029c5c2ef343fd188cf5ac83c1ee3794

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NuGftcEYxKP8HOPBcrSfOQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

expires: Thu, 08 Jul 2021 09:58:44 GMT
date: Thu, 08 Jul 2021 09:58:44 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-NuGftcEYxKP8HOPBcrSfOQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3736
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBNZMBFHQtvfeDT8JRGUuxA&google_cver=1

43 B
1014 B

54ms
28ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBNZMBFHQtvfeDT8JRGUuxA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1qu1PTAB&v=APEucNWQJ7SZt8q1iTu6h_RTsfX-vBunaiw1u-RxjnTcJzKRE29BSV7RpWE3DHM9cJjJ9yjlGi2wyj8ZAZIEf0JMSP6IHigmoCzusDoDt5toqAMveCLk2dWwopcQ3F_DDslONTfZEG60G1hOlnINDavWysG3nv2uHy4P8UfBoyVyb5LkScebP7UGyysOq9KAat0wo0txPMJoD9R3ku_s0ySEJe4XeRNTFA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:44 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 08 Jul 2021 09:58:44 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBNZMBFHQtvfeDT8JRGUuxA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3736
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YObMVISs3LHMo3Wb18jhDgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1

43 B
894 B

28ms
27ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1qu1PTAB&v=APEucNWQJ7SZt8q1iTu6h_RTsfX-vBunaiw1u-RxjnTcJzKRE29BSV7RpWE3DHM9cJjJ9yjlGi2wyj8ZAZIEf0JMSP6IHigmoCzusDoDt5toqAMveCLk2dWwopcQ3F_DDslONTfZEG60G1hOlnINDavWysG3nv2uHy4P8UfBoyVyb5LkScebP7UGyysOq9KAat0wo0txPMJoD9R3ku_s0ySEJe4XeRNTFA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:44 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 08 Jul 2021 09:58:44 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3736
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPHmOU-KwP5q7jk7PojCNWI&google_cver=1

43 B
1000 B

41ms
27ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPHmOU-KwP5q7jk7PojCNWI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY1qu1PTAB&v=APEucNWQJ7SZt8q1iTu6h_RTsfX-vBunaiw1u-RxjnTcJzKRE29BSV7RpWE3DHM9cJjJ9yjlGi2wyj8ZAZIEf0JMSP6IHigmoCzusDoDt5toqAMveCLk2dWwopcQ3F_DDslONTfZEG60G1hOlnINDavWysG3nv2uHy4P8UfBoyVyb5LkScebP7UGyysOq9KAat0wo0txPMJoD9R3ku_s0ySEJe4XeRNTFA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:44 GMT
X-Proxy-Origin: 159.48.55.6; 159.48.55.6; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1ef736d4-dd62-4094-a9fb-b115788daa85
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPHmOU-KwP5q7jk7PojCNWI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3736
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1ODQ2NjIwODc5MzM5MzgyMQ%3D%3D

170 B
188 B

39ms
39ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1ODQ2NjIwODc5MzM5MzgyMQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:44 GMT
X-Proxy-Origin: 159.48.55.6; 159.48.55.6; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: cef5510c-5a17-4652-a018-02f5e57339a0
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1ODQ2NjIwODc5MzM5MzgyMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js Show response
pagead2.googlesyndication.com/bg/ Frame BC25 14 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:43:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 926
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5744
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 09:43:18 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame CC56 22 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DztEZ9VeZ3Mvek-ke2H8DHf3LBtjTKCZfh3oLIkvLXmMGC8HE8h0sSHD4RdVi5mWg0LMdaqVTeD7aNZQZiUbxylXuZwDofE9mQAkpukVMLanKnSvVXzt1BqPawuodviIlml_WTHOGDW9C-hyXGYQTh6aM25w&cry=1&dbm_d=AKAmf-A5yvSSFjxw94OyZC41u8xEBypOUtUwoMDSbQnbprYcYfgKnFUjHcXB9gj-i0j4Hz77AfIlMz97KyDfZBotKrm65AZow5i-xOzG3EUbHwGf4ip1Uky-ROoNDdODdcaWVzVXODbjlIPfS4yTkHDt-gMuSrVyhwIuHmMde_Xr_evVRICiBNv0_OlKzVsUgAAvnF-oTOP4YTi2xLmdeIu6gxtIHpWiJQLRD-V1SH1q77u3bNvscPTRtEfOgxBQxogRycfV06ek0wd9FCSOLnWb8DQS-nfBBF5lhOgQVIRAQTAIr5dc0q-dVGRMDGaJG1BkQZ3XPlpnleldHngCtLGjzl94Gt2zEiRt9x9QvFcbouc_58L3YcNfpgdu-8IPxqojggXokq4PPvP6HTsaYW5NY4BKyVjnCeTZBvyNZCBcT8LcGYaE6ROAWgNxZW2J-aqgANJ1Tdjds8hwG_HQhk7WL0k-jOPISKzbUUdFSWMs6ULowl0vS2LJZVmeFegcEBOA2WMSW3W6c38EcsqgqTzkX2nebCjrGLrKyuEKQxvj3PccAG4NpwELqapMTbt98lBD9-924t1q6LQR5gzjFdz1GpEHBXT_MC1-wQBy3PrB2ygFMApkswRQyg9vtg8csfHcFbj9hBNPiwO8UT9HMGkOhCcpFiE5Q_7IWn0-p0790atKvURYE0ypu-xYb-4i-ueauYFlypzUDMt3CYz_OpWy28bk9f5YRBSNX6VglOojFpAQ5pgcsqvjg7MPg0GkJbj7KXg3cm_dB389vm5ghNXjXYlrTJIcv5-XIF1zE0FDC5wF0MazJ0AFuZOlmCBq6EZNrtYRDmjquGNOCW19n4uyKAisJzqbbbSXuV6FsnXQ8GGxjqU2Gtwaa8cIcdWP_ugQ51bU-zlu2vEmozV4ucXSGoBvhxVit9DIIqCCy32kkUmeU6Plp6EVvrsYq51atQLzQhyT1slipPJg7BxuePzD46Re64ukGLVxX_424TTVlg9CS5iKCKWkYV_p5NYd9a_13_a3ZzW3kObX5iaYDSioe2m7yZPIl9H_uKsetVqTvcNXYuWwBisezF8gnBojQtoEXOV0VtfqMPnKcW2Tzfwq76xVJdMLrFRq1vn2jqWRFyC-G6ywgtT1jxF5u8m6QQlTgZYb4uGPgiZlKhL91vssxLNUq-xqQ7x6I-UBYmfnOqkvM3u0BEzyDrNjjSn76P7yc_JKwyJLn-tfu4SRH7xRfdEWT1wrLQNHwBJjRLd_zWHjhhVOmNHcqKff5cDVvHzlrTtRkim3VafWQL0ftTnbi82FJkZqH-kefUcw41_LpcUbflHNUeeThL75x6iTlbjGk5uL3S5wddtaAes-x_W6E65G2v0QO6jJWUE_Jj1WjPZZYCe11jqErN8IPXu3lOqjsE8ibDwYdLFB-6kqyWHpZleNFXRyo9qJOCqBXbFOI2zWWxGG6Bmt4dJVpDUj6rjEcVmxT8nC9X2b4qYQXC_6FkK40tGXHkbhZksIyi7WDcV4qSAdzhpWtqwhrKFcZJIVZ-Uy_qsjFjvj6ANVt_PhxeMhJuTEz6Fg2O3odlmrO4QZMWZ6Aa9gbq1IZKCZV_bx-9V95YTxzDSZSDLRdRo5TN2WaEUGzf4x1LxS3N_GVYIpAtfqK3dHW_EwBNgcAHC-ORCn7kKCT7-babbWDO_2PzKVEv23PhWoqAI0qtmFxg3I1WPHaySYKVwskdjQGq7mug3BtqWQlGsM6W16sKtdUB9VdEJrB8oSuIM0mtDZeDiLMxJOLbRrAm_QRdqfP5pSXH7-rmWZKHWDzA37269gromxgNVLvmfk8Q__QUrOOb0qbH3N0TDFe_O2sdis_LFx2mhLtZoYIMIM_eDjiKIIdhUGjXNUWkZSEqPXV-kHwe0Sy54QV8pQEiaV286FoxqxdIUb_xmxrAoU8fPrR7MUzAiakNRmhCRI76JjEOiDmvmQ3oSoLBHB3WLdhp7POrTDOvocG8LnubEFXirgWik2_3MEoSg_dOplD7CCjGBIxo-WAynD0vjQS4FxZMJ1pyTwbrq_f-4Z6KD2fROywG9f__JOTmmGj2kxuFeeppAbnHujDg1Ar0fm86iMbejoz7PSlv3C4bd-XLVt-JTK-1KAuIo6NBSt5pY3_GcoGZuU9y_aXLofteRQ3ZYA7mz8cgtMjzrPhURhT-fALwwYWAQtCp22vhD2VLd44ddh4iP4J2Q4PqZCicjTchQ1wHyOWkw8sm4mnrsw7TXS258Iz4Prt53dDvRBvRrQa0lx54cEzuglwxzvdm7XGFvRzzsXNtIqj7M_cPN9h-WZQMLjyVk3VlFhptJuYI6321xsvn1jplby3uWkCGXXN-2SHif0tAdeVOel0h1oMA4Q_HgwbTiSts7QeDzzcWP17snO6OhN9aqLeCvAZi7q5bdrt4K0M5RmUX4ZMxuqJoFUFKWee386FkX3zNcXvC1l9SAfuteSMUtDJH2okzEvrGsBaZO5L0PzLAEhOqrCbqgYniFLaRKcyG5m1jkhMXNXMOxYg5uKnEkuDWdKo_4NOdFXvzb7Cq4OjwpXRtSrGbkTmFyh6bTGq7Qmh8awTc1L7eKI9QjW5Iap-NrJ1Bl2EfTloIn1OOl-7cRwkkOUKI_Iuvi5l9lCHRoHUmKIypBjgCC8fVxuGmRTHVTOCXKHCTHdpKvXWN1PqofQZpZOjA6-S_Is1luunx2mMWbvGvcTQb0-c4yb931UqlBfX3zFcvN9YQcLqze3p99I8pDC-tZzzFJ39expGyDRW8ir97qsxTV2yR2DCYCKBm9n9cMJJmUHdEe6RVVU8AnEdGFignxKMih1WXQP9SL2_23pW14-Bgw7NPUvAVPAQp133sAcrG0PQsQS11HQrqHXR8Eo0VrXgTRNxlr5QC0N5rWCnqPxqgxkYPBxKptM5UukNn--MEZHKqz4Vr-GhxJuaMmQseN-iLWS1gzqJgLNigwyPOX9mBo418M5hZpSakdDfkKVdOUhU_mEkU8UHLGrFFvckPYoqHd1cQkdgkai0UwaA8ZPh4dU-vimuALmFmCiSSaETUAFVeq_pAV3-EsyAdmS-1QmM4RKUj9WR0G6N6mzRLk7Mo92ph3XOEWId2Ra6m8VPhKxkpL60uA9RaY5sUl5rtzzlkfoKOtxF5jN5gSRIMVfB5BeS36749sC8pOKJBo&cid=CAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA&rfl=1%2Chttps%253A%252F%252Fnex-software.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 111
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:53 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame CC56 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 07:31:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8828
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Jul 2022 07:31:36 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7E34 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Thu, 08 Jul 2021 07:32:57 GMT
expires: Fri, 08 Jul 2022 07:32:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 8747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK os3968sx7dh6 Show response
hal9000.redintelligence.net/zone/ Frame CC56 11 KB
4 KB 109ms
36ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/os3968sx7dh6?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCk0JUVMzmYOe4E8P47gOHzoKoBOKw3PBfjo3S-4kL8C4QASCqgMMiYJGEgID8F8gBCakCdUHgqk3Nsz6oAwGqBM8BT9CHef3bAYHNo0VJthw4QkoKa3TZe6kS7EcJWQfUCGM0-OV1NF1NEaPahtbeMhYOoy50kNhpRx7yza1xJbS96qv7_DVLNVOUZ8rdHchJgzNtFwLVmvSpOsYipfpN9YBiwEFIDCZN0kE1ZzvbAOiRJk_mDnBdadqhYnDZgg6VvwALTOTXIhIyrGxVhOqxdT3r71Wr1z-RYxljmvhWvHVwq5MbyyPxsGCE13DlKArFMBMX_aQRfz7DKsASI55tnYDoE1vOcSDLkqq0DWkM2JwiwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA%26sig%3DAOD64_37rG5IpIXGAWPCpI6xLZJP13H1pw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-AiQF06tXecF0YJ0gri8w3a-q3lpwdRVgHmty0X8BjkO9_wGMsRKttGSS_r09N1KIIhEkh1lJMrto6HbM5zPCuN6JWIpw86zgWvhMTwZfMpD6nHuHpYLIPPTPPL7jR2fHlAszW8cRNG_q275LPOnTdnvKPlJA%26cry%3D1%26dbm_d%3DAKAmf-DYomONQra4mIaUITQA9MGwQdKEy5KGCWOmI4wB-k2ny80BOkjMtRmYU9wKqdFkau-KqRUC18PwDgNJ1ss4AxrT1XSLXODyIg3hVnGqd19t4Vl0NbuCTHY8iFfT41GGtytLWgB-ZxgJqXn9AQarDoQJEE4UYIyQtawpMngTT6HsHircKcUEn4UqbWOMVu4miAej1558bUldydPjpViY9tJ4XVIqoFIp-wa5iFsopU1WrWZEiZdAbuuL8_SPmhXgEVUacL760TQ0L6ERIam0TGRpL5MMMf25U56L5UaDDGoPSs3nL3tsxRlZoLJ9VWd_e_C9Eba-Qto8hCF86rA_bYvHDxPf-UwUggMG-TCD22kGsrNMN8R4YOZI0V5qJYvf-h4stieQH5HBNQ9NXUyJoDk57LBMdAMrp4XAp1f_Q_DBBe-6q1-aOqjZi56o9ttrUps_oNjJ%26adurl%3D
Requested by: Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c840ae3a100ce5c06a66c9424798c0f6eab7b8196b81ae8563d93430542a9d7b

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:44 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3906
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js Show response
pagead2.googlesyndication.com/bg/ Frame 7E34 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:43:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 926
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5744
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 09:43:18 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
40ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021070101&jk=3265601537674040&bg=!lpWlldHNAAYo4NJEKOA7ACkAdvg8Wnv2S3LH1RtVpWlQ9HtOwBrzr6muO94HQfBbA_QTKy1pa1oTSwIAAABmUgAAAApoAQcKARfhSmEP8jPh613N--hl6msIHciPOuFtCxX7A1BAdhI1fjrd1EW5qGCV_LV0hfq_i0-2R8-yD5t8Vl_7Vt90v-f5RypkIaGLcO3KC1BdkFpFrWmu6nTtEjnr3yL0RrnTrS2InRkqxcXylQDdLOGBuDObxgjphzDovPAMtGjSgTC2SBajn9keElvrMrvDUrwuuXvOpDhUjNKdiQAwQeAm3D2s0w2OpuNQeeMyAUDyk85t9r_F5BD3xoaOCczSfw-9fkiovIEWR8jltYjb7AD3cJp_gzc0Ihl3eMGSgA_zThKOT-ja9X1pUOuAEpDDbaELl1q2DVVMajRKyJUSXN8J8n-UD3ETrOyda_7vY9m1-9rutByMb_qhfh2ZAn8UbN9nSbVtAhqoJ3N8heKU3dnKa7a63Gx3FLXcVPPKvntoM9-rNY6fpykuvjsKW-iZyMiilT3vi8m6cZuLPmzNOnqAI5k9Sco15hzd3xIOx5akCyb9mP2UVbpWf-0dHDnB9u0RWjoJ-vXTwuq2GhnVommVWsyAxOBTXyeGPSbKYZfpOApAcRXktzbMmTbDSCS_IpsEw6k_WcQnJy-0YpSV00okJcRnaWGRUNpou2u-oky4FQKsGD023YyETkPbFUogSSgJPcmrsY22ka8bvW25EmdGL6kYl-qZ3HoHjB_OvHGVhfmt3fLhx8fTnh1N1j_F4qpMbFHZUHOFeEhbD3FHNU1STif6U9fsEoJVjIWCjK6LJvkPZdLtpd28XiNAeNkOTea5zq6-GVwbgBI37o9nf0rwAFelG9ncSB75g_keXLu2WH22CpmCKyam_eINr_1Zk4K_eVz1Y40jb90SllRtEnnv4Xy0QbbxVMPXfITNpdzzsf3_p6Ix_8UlzNLuS5dIMgR0rsTpT69ChwDkz58BFkwi68Khf8h3Pf92MUr32q93DO_Qm_PUaTSa15jGBSXFc6KnZYVswQFJYhN2lBBVIsF3q1x4-BAkt4sCZdZnfQKHpvzziBo4WzvLDRe6mH6SioJtm94XLOJ75NAV2d0jZlZCUT3r0P1YWwBIiR9jAzt31aKLfCFaaHqsaFagJABHIq78QysQuhRXF3ah5FGqQomOZfohyJSSgxs-GX42X83pQ43m8uJ8bMY2PY_MR1Nrf7GmJHNryNKmrAns5kwfy9rTLr2HO7uQFfrpfDZtSLPNWOSbVYuKpZxsTIavuG5PMnD5SUtNlUbTdYBY328

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://nex-software.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal90006.redintelligence.net/ Frame CC56
Redirect Chain

https://hal90006.redintelligence.net/request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90006.redintelligence.net/request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

146ms
86ms

Script
application/x-javascript

138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCk0JUVMzmYOe4E8P47gOHzoKoBOKw3PBfjo3S-4kL8C4QASCqgMMiYJGEgID8F8gBCakCdUHgqk3Nsz6oAwGqBM8BT9CHef3bAYHNo0VJthw4QkoKa3TZe6kS7EcJWQfUCGM0-OV1NF1NEaPahtbeMhYOoy50kNhpRx7yza1xJbS96qv7_DVLNVOUZ8rdHchJgzNtFwLVmvSpOsYipfpN9YBiwEFIDCZN0kE1ZzvbAOiRJk_mDnBdadqhYnDZgg6VvwALTOTXIhIyrGxVhOqxdT3r71Wr1z-RYxljmvhWvHVwq5MbyyPxsGCE13DlKArFMBMX_aQRfz7DKsASI55tnYDoE1vOcSDLkqq0DWkM2JwiwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA%26sig%3DAOD64_37rG5IpIXGAWPCpI6xLZJP13H1pw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-AiQF06tXecF0YJ0gri8w3a-q3lpwdRVgHmty0X8BjkO9_wGMsRKttGSS_r09N1KIIhEkh1lJMrto6HbM5zPCuN6JWIpw86zgWvhMTwZfMpD6nHuHpYLIPPTPPL7jR2fHlAszW8cRNG_q275LPOnTdnvKPlJA%26cry%3D1%26dbm_d%3DAKAmf-DYomONQra4mIaUITQA9MGwQdKEy5KGCWOmI4wB-k2ny80BOkjMtRmYU9wKqdFkau-KqRUC18PwDgNJ1ss4AxrT1XSLXODyIg3hVnGqd19t4Vl0NbuCTHY8iFfT41GGtytLWgB-ZxgJqXn9AQarDoQJEE4UYIyQtawpMngTT6HsHircKcUEn4UqbWOMVu4miAej1558bUldydPjpViY9tJ4XVIqoFIp-wa5iFsopU1WrWZEiZdAbuuL8_SPmhXgEVUacL760TQ0L6ERIam0TGRpL5MMMf25U56L5UaDDGoPSs3nL3tsxRlZoLJ9VWd_e_C9Eba-Qto8hCF86rA_bYvHDxPf-UwUggMG-TCD22kGsrNMN8R4YOZI0V5qJYvf-h4stieQH5HBNQ9NXUyJoDk57LBMdAMrp4XAp1f_Q_DBBe-6q1-aOqjZi56o9ttrUps_oNjJ%26adurl%3D&documentReferer=https%3A%2F%2Fnex-software.com%2F&ancestorOrigins=https%3A%2F%2Fnex-software.com&random=395004191607&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 509a24ed0c3e5fcec6973dd35374732223c40fcdaf3fc39d1a60d5469571b0ce

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 48176700064878800719610011649006
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1003
Expires: Thu, 08 Jul 2021 10:58:45 +0200

Redirect headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCk0JUVMzmYOe4E8P47gOHzoKoBOKw3PBfjo3S-4kL8C4QASCqgMMiYJGEgID8F8gBCakCdUHgqk3Nsz6oAwGqBM8BT9CHef3bAYHNo0VJthw4QkoKa3TZe6kS7EcJWQfUCGM0-OV1NF1NEaPahtbeMhYOoy50kNhpRx7yza1xJbS96qv7_DVLNVOUZ8rdHchJgzNtFwLVmvSpOsYipfpN9YBiwEFIDCZN0kE1ZzvbAOiRJk_mDnBdadqhYnDZgg6VvwALTOTXIhIyrGxVhOqxdT3r71Wr1z-RYxljmvhWvHVwq5MbyyPxsGCE13DlKArFMBMX_aQRfz7DKsASI55tnYDoE1vOcSDLkqq0DWkM2JwiwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA%26sig%3DAOD64_37rG5IpIXGAWPCpI6xLZJP13H1pw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-AiQF06tXecF0YJ0gri8w3a-q3lpwdRVgHmty0X8BjkO9_wGMsRKttGSS_r09N1KIIhEkh1lJMrto6HbM5zPCuN6JWIpw86zgWvhMTwZfMpD6nHuHpYLIPPTPPL7jR2fHlAszW8cRNG_q275LPOnTdnvKPlJA%26cry%3D1%26dbm_d%3DAKAmf-DYomONQra4mIaUITQA9MGwQdKEy5KGCWOmI4wB-k2ny80BOkjMtRmYU9wKqdFkau-KqRUC18PwDgNJ1ss4AxrT1XSLXODyIg3hVnGqd19t4Vl0NbuCTHY8iFfT41GGtytLWgB-ZxgJqXn9AQarDoQJEE4UYIyQtawpMngTT6HsHircKcUEn4UqbWOMVu4miAej1558bUldydPjpViY9tJ4XVIqoFIp-wa5iFsopU1WrWZEiZdAbuuL8_SPmhXgEVUacL760TQ0L6ERIam0TGRpL5MMMf25U56L5UaDDGoPSs3nL3tsxRlZoLJ9VWd_e_C9Eba-Qto8hCF86rA_bYvHDxPf-UwUggMG-TCD22kGsrNMN8R4YOZI0V5qJYvf-h4stieQH5HBNQ9NXUyJoDk57LBMdAMrp4XAp1f_Q_DBBe-6q1-aOqjZi56o9ttrUps_oNjJ%26adurl%3D&documentReferer=https%3A%2F%2Fnex-software.com%2F&ancestorOrigins=https%3A%2F%2Fnex-software.com&random=395004191607&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 08 Jul 2021 10:58:45 +0200

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E34 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BezdyVMzmYI-fMMrm3wO8jYvACwAAAAA4AeAEAg&bg=!YGOlYyfNAAYo4NJEKOA7ACkAdvg8Wm-z0D_SZVRb1CbFSK-J7zzqqPnaeYj79BQgLOSSF8DpMfKPRAIAAABVUgAAAAtoAQeZAsNDo2qfyYxPzoqIOjB0bB3smye7lYzx3eQuOYh7kWcAXE4Kq3PArVDmBvadztvmsw9Dw3my2SGD8WIM_tCdXojGsaI0Hz8LYaIPdbHdNFswyNYfJy_RSDzzEoXNv91GhIGQ7J-0LsMiPTzU4W2gIDd-3fWl-SI8TT6__zRnk6IMlZ4jwF0ksNGgzRyfxnt29FBDdZnrOUJx6nBOUFZZqTG9Xk_AZDe7Z831FvklgXxQidWFW4aGjtIdVW9b4nIlxh2FwaoL4HyVW0A1OYRnCt7Lbk8M7xHdi44HkLck5_xoyqSEBx98KqaKsPR1AMRrdo5zM2O07Iwk6AV8-MzFIPCxzclGGfneB2PmTkk3JI3k2Ce3s1_Sv3l9xnbwWU8g7j3kfItDK9-DRlxG2eIbdP_a7SETsNblNMiYkyceKjf-nh1tXGmMhGAdthls0htiJ1u1J6qiR1HeWj4AyyxlPbHN2XYJKOqb1x2f8z6sELh1ECFncqs6pQiOrw8Ig1kU-u4zYzYib2qw2NvOu1ImlJ1ZKl6abQ4On27IlbZBa-eXffub5iCTovgIqLGgsg9YoQAtyX74u8wJT1DMovrS4AZmN9klu7wVAaw1W-YVXzawqzmPuISVDwungAfVIOsdXf10C6O8mXKqIVvrkflfKEm-Ll-pgnxFv6MpssB7JIla3ppbEoB-r7xiOPYrwrGSUld35Wf--GIczMHeuINHXPNuuodkWC6I43B6_zvgnzC8B0Fcp_mXdfMuTIMRC8y3mhf2lXm0fa1cqqohm5WQhOZfvTEK0PsKMBZg7cLKMn1QRcBmu3b3-ZhtXO0SYUuBSPJobYSv2bH9qOBTIdA6gqUPz9SWWa9oIYqD2LxoU4nbG03_hBTtY3hj1uY7sbtjlhiuc2z_QdnPWVStv45lbbcqqJdn79D8ni3cfnWDumxCXpkrsQ

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2F6D 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 08 Jul 2021 09:58:44 GMT
expires: Fri, 08 Jul 2022 09:58:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8B43 624 B
299 B 18ms
17ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARiD_KWkATAB&v=APEucNXqLZn5I7FFeH9AS_9pUWRE1ojXmHJMFSrTnKiAXkVj5JK-P01MmsqOgd84PnEjkXwmijuUDdPuakUcIjEaEMxMZZI4fQnRv1uof2Km42qg8E8lAcSH1vk4Xbs6WFnzDqcgSYoCelzLPykPdv7J-xaBgbm0nU889cWdfZSW_hxBYV-6ppn-yebLfkHJUi5qD4bI0xzcn8IWyCujLDVW5GJxzMIaKg

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CKSElwEQoKCcARiD_KWkATAB&v=APEucNXqLZn5I7FFeH9AS_9pUWRE1ojXmHJMFSrTnKiAXkVj5JK-P01MmsqOgd84PnEjkXwmijuUDdPuakUcIjEaEMxMZZI4fQnRv1uof2Km42qg8E8lAcSH1vk4Xbs6WFnzDqcgSYoCelzLPykPdv7J-xaBgbm0nU889cWdfZSW_hxBYV-6ppn-yebLfkHJUi5qD4bI0xzcn8IWyCujLDVW5GJxzMIaKg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmR6nCKEKOph8xG8hLclUx-VfFl5Fyzotmw-EX7ErQt8BWIdoDH4xac5O1XwAQ; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 08 Jul 2021 09:58:45 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Jul 2021 09:58:45 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2F6D 58 KB
24 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxNlYDFBSEXC1lW45XH1cRw6o68v5oYjo1jn-vHJdgr_BihEIPt1jY8qpb1T-KTPuf9QG0OS71FMxlfSo_xDXWkhfsDrqOACdj0s5xKGd1G9ZYzOXsB2qu5ELUqyoFRsAyu6GmXMoHJ7m4ZepcWJWaLDz6_A&dbm_d=AKAmf-C8KsJXHuVNTdnORREGMfmz0OC2pM6chW5xtSec6iqe5epPh-N-_MR79ZaXi2kqyLXnqPNA63Xn4-XylclHPZv2woAz6CJo3RFUC5v7VroB47u2ROIufjwQpV8wx0yCHqCQ-YMXId-VrHn1Te_pZW35lLq0PdAa2-30wwYipGZDcu8fBSTex5ynHYZj2gV_0lhOIkBw8QEbCkSfSYXUgWttBoaXIn8r4w0QdI3qx5XHuI7I6CZoLQUrJiECLkQ17TeaydbG9zMuJHi5ZhMj1Z-jUZbIiGZaBvOgpVoNiigln__2RVBZlFLv5kU0AjwHZVbncKpfm2z2lquacW0nACR3a2uzG9JAoPHYxxi86WyMYDL0fgOQi7o6yiC44SvgsLXegSOKm7msiVe7uG1yiDDy_agv1vcdP4JC8kECqaACWEaQWYJ6BgkpoNvApC5xMOazpck0FF3H3Cvyr5NKL3a2xzqrw6jhkEQ0pAJ6owFB6xCwM4gt0qtjKDaCnKvCuDIanbysDCvA5FOCkYcqc1L-9gDcbHifYbmVP3lsdq41JEkFcv1YyjMFvApbutWRvq0ti8ObI1Zpcw8gq0jcHvdNEE0gr9OP_lzFWv0Im0QYnRveL62Fiv9Yr2R3MdVeLVCrIUvzKJOayd9yNRDe0PKdjsuUO6F4RWIxopcrh5CdkLM6irVgyodPYFIwwFSgjs0VZ7JK6j_YPIWdB4IEt0mlibG2r6FcX-it5R-UDQs7MkpfW3SeyQcHHjXQf6HnAJJ_vUxtZVHPW1ZvbcnQQ0fMpTzkM8tIhEfwIY732JmYZYc-SnCD6nTKBCCA_U87CwkLwk2rV7gZfj94Cu_LTmIRu9bI7p_HMIoKq_EODWzWxglJHTMIopLVgVGFIP66ZFCIb96aY3BpkzFbhUNXfnKdQj7rWkZGG0fV6BDh5AVFKXvkbV9qHAtPGrtReDvIqECiUhj9eJ1mSAMPwPc6N-mbvppDS7FC2d_EDW4R0VK0MGAcg_Aip2mxPCAfOWL02buxIHnN021P_lJ-EnspLzs01kOnHNI4TS3YOFP89IqdusfhUUKaKa8EplRaVY8ZqZ00SXjtLYwhCgD4g48bRgky2MMUHDsYr9-lTLICJ1Jti-pFQe-LaXd2m3B-95DtYsoblaKvOdmbDQ6ecy3XhpGn_7m6-_tKltjQuK_Dokwug_KdOn3HHs_2We8Bnm5Ml-WN7j4zV6RCqczCIcJMoDaWGZehL7ZCV6fzjvin5QPy5k6SckhEBmls3UOQ8ws-0AHEVE73l84VDLg0gfYeiEo9axslOUYaNHtxwNDwhQHDTJWyYMGCLFq9h-iphgzK3QNGRsMvXWgTgUp7Iq6dojzvallbw3uwyySA4ilzeZV_ovA8VuHUXE9_YsFpqFV2FsiIavbwVcUhAa4zWGDIAnj41MEb3kHEy5DNsON9RS4hKc9rEWw_7Y5vT_iqWVtK1-rxnmKwzy7Ciglvb7_SMc-y8cUgam0xb7O7t6eY4a1yFw69HbpnRkyJm-KgvEvCaWe0waVBkSjd17KBZyaED9_KkvdFQBIQCT4MGTDr3yOgjNbuuEwQI73MoD1Hi_vhdziF8aOmRwhBPgeW-edFVuF2MHjcydjc_a2OxIfDfQ-ISyVeiyRf9VBzjOsBUoyFeGCaXiv8fyHWI7dIXZscETC8k_G-IVN1MNyqNXX-mgrDCcKRhr9JySKpwwq9fj8mHwF1s31CJBIIYVZ6Xz6RON_SnV4zr6mqopUQOnea41eWG8h5tMRZ8Hh4HkP98JcdXIe_Jxo3EbV4L0vcagsvjDKZVoTWaSFsjGxfr5UB1AThORImQQ4tWQyeBLJykqvzeoPNVdU2IppBBeo2Hdg1t4ewQV91I0ko48gEqGBi1JRJ_QBxuIoM8ckedEOnI2zGEBo4sGxdeRFcaGbuUVDGiOzWDddI97OOOypdGDLB7GPr8sCwZmhwsXUxPTB1CuR43cNl2ycaUdFxKxaxpwRgPjHD8uO5rk5AroJugSTSGI65dhXfUW7vRXsX89X76h3Sm3MKA147PEg-CJ-b5Oe7FPNgfQSveKoq82gjtpfgvtrgGccj94oygrLrtaddj99iq0mc4LGeBOvLbqMWfbzRXquN3EJ5TfKwjiii3P3O4POADFC5FBrzdKeCIltcmHVtHHag255t0R_B5iHHpbJG7LIHdudNJ2cpN0PRjvIgkWlAmJT5HqvHTwWGqopueBYCmBdtoCdYtZX-VSdN-SLcgpSjmFDzG9cJD7lzThEcyewPI4iJCY11-sXq_DCEzOdoKz1a7Fk60KGENpi3PZDXkzSMIjxbKRkIkDu01_0GkYaFQzOTfyvKAAaSuVKa5WyJjwL8-c2N-F3hHC9Bu9x1TZvMY0M2moSBaWBkSIVKTSmQ0blR2bcL_nZYSYtZMe3P2RD3NhUCITDx_zjZzqc1LFbxvAY9DTb8FYUt8cky-wEPwyNT6hMnqSYamjk1NVbKi797aXb_Ky50aSN4YRb_GHcsVuVEJRoM1eb0ovTUAY0z_GkvOvUWMGQ4sVFeBY4ekEpdXnuG7HoDh5_VgulzIotX-y8StmhrFkslAn6u2il0Vb4pBtqxF5O_t6WVg4hMKIgfbMuRc3CRFThvk5ebbi0-oyr4dEOp8QbF-o3bMDyNlhWoXRoKKLZOZhoMu6MxIu4D6Uo3Tceu4z6N2TZ9Qb8WpJilYx26OZcPMu32XFFDqgjvWJyupuglzYntteyHjJAMhZrB5nY8lsVBOznRvr1JTbosPGSUVVMTk5_Z0hVyrHt9_kfcX83GnwbN-9G-Ey5rWwTtDCnGqpGEpUdS4tn_GkfpDLztz2gbbbqAFphCi4u8vE0OTnVHwHOMC7ZrI70aNfEgPxGnr-Jo-9V7Jwy6OnC3DGZZ2usi6ZdweFNHDtHwXjgSTbY9DOZwgVQLsSSUIXS7K9WVLy2FUd_19GGnZztj2Pn_Sb4GP4Wb1o2bhwChxOt_kUXcnbtT8kiT54gLAJUGmJ6LSVeGsYRX8J8t1ocuEVykW-Jy3KQ6AaSk0qafw7EpdImF7ryh_T-I575kOeVBp_4herNikoItM50OVND7cudAsT4Uc5BDzFUetu2xA3dC-KxBEfe2t5nNCmQN19Mr3qMPAMNy76a5dcqyyj3QwvM-tl7S9nlWIQ9gfvgBq2Y&cid=CAASFeRolJWlo3IDMwHsCvCWc6KkdptZEg&rfl=1%2Chttps%253A%252F%252Fnex-software.com%252F%240

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c5e6e903f29728057f9585197e51e976b7ebe486425166a875ad474f909d724

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24097
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2F6D 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C654TOIcUJu_6pMGlThl2AK9Q7H5cYXs3lEJTlJ51-tKUbxa4BehVYjq9469BkdFyt_4DkqaZTUbCrPJpjaRtyxskpn5T7fjSu2J5egvTR46Gw9UY

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 2F6D 3 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:54:43 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2F6D 123 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28a030a77bcecc0621b938dc08610e4c1fa0e131507a2dbd0c8007960d269253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625657928851490"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37883
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 2F6D 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:32 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 2F6D 0
0 14ms
13ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaROy5txSZTv-IFm5OMMuGQcbXCIU36y_dbtt8ppntFHPhH9bFhAz0AdDlfDS8GGcZDyPnUOJhg2rxNnakePYmLlxdny0A
Requested by: Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8B43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1

43 B
894 B

28ms
27ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARiD_KWkATAB&v=APEucNXqLZn5I7FFeH9AS_9pUWRE1ojXmHJMFSrTnKiAXkVj5JK-P01MmsqOgd84PnEjkXwmijuUDdPuakUcIjEaEMxMZZI4fQnRv1uof2Km42qg8E8lAcSH1vk4Xbs6WFnzDqcgSYoCelzLPykPdv7J-xaBgbm0nU889cWdfZSW_hxBYV-6ppn-yebLfkHJUi5qD4bI0xzcn8IWyCujLDVW5GJxzMIaKg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 08 Jul 2021 09:58:45 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8B43
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YObMVISs3LHMo3Wb18jhDgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1

43 B
894 B

29ms
28ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARiD_KWkATAB&v=APEucNXqLZn5I7FFeH9AS_9pUWRE1ojXmHJMFSrTnKiAXkVj5JK-P01MmsqOgd84PnEjkXwmijuUDdPuakUcIjEaEMxMZZI4fQnRv1uof2Km42qg8E8lAcSH1vk4Xbs6WFnzDqcgSYoCelzLPykPdv7J-xaBgbm0nU889cWdfZSW_hxBYV-6ppn-yebLfkHJUi5qD4bI0xzcn8IWyCujLDVW5GJxzMIaKg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 08 Jul 2021 09:58:45 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENZNNLO6-F0k8EpHLnMKv0c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8B43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIjAvBqVfKA3Y2GqAxeejCA&google_cver=1

43 B
1000 B

23ms
23ms

Image
image/gif

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIjAvBqVfKA3Y2GqAxeejCA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKSElwEQoKCcARiD_KWkATAB&v=APEucNXqLZn5I7FFeH9AS_9pUWRE1ojXmHJMFSrTnKiAXkVj5JK-P01MmsqOgd84PnEjkXwmijuUDdPuakUcIjEaEMxMZZI4fQnRv1uof2Km42qg8E8lAcSH1vk4Xbs6WFnzDqcgSYoCelzLPykPdv7J-xaBgbm0nU889cWdfZSW_hxBYV-6ppn-yebLfkHJUi5qD4bI0xzcn8IWyCujLDVW5GJxzMIaKg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
X-Proxy-Origin: 159.48.55.6; 159.48.55.6; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 4d8d2603-983f-459d-a095-5992e86a3a36
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIjAvBqVfKA3Y2GqAxeejCA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8B43
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1ODQ2NjIwODc5MzM5MzgyMQ%3D%3D

170 B
188 B

31ms
31ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1ODQ2NjIwODc5MzM5MzgyMQ%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
X-Proxy-Origin: 159.48.55.6; 159.48.55.6; 535.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1a1020d9-8c71-4802-869a-d57b26a99cab
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODk1ODQ2NjIwODc5MzM5MzgyMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 2F6D 111 KB
38 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 05:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16359
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Jul 2021 05:26:06 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 2F6D 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DxNlYDFBSEXC1lW45XH1cRw6o68v5oYjo1jn-vHJdgr_BihEIPt1jY8qpb1T-KTPuf9QG0OS71FMxlfSo_xDXWkhfsDrqOACdj0s5xKGd1G9ZYzOXsB2qu5ELUqyoFRsAyu6GmXMoHJ7m4ZepcWJWaLDz6_A&dbm_d=AKAmf-C8KsJXHuVNTdnORREGMfmz0OC2pM6chW5xtSec6iqe5epPh-N-_MR79ZaXi2kqyLXnqPNA63Xn4-XylclHPZv2woAz6CJo3RFUC5v7VroB47u2ROIufjwQpV8wx0yCHqCQ-YMXId-VrHn1Te_pZW35lLq0PdAa2-30wwYipGZDcu8fBSTex5ynHYZj2gV_0lhOIkBw8QEbCkSfSYXUgWttBoaXIn8r4w0QdI3qx5XHuI7I6CZoLQUrJiECLkQ17TeaydbG9zMuJHi5ZhMj1Z-jUZbIiGZaBvOgpVoNiigln__2RVBZlFLv5kU0AjwHZVbncKpfm2z2lquacW0nACR3a2uzG9JAoPHYxxi86WyMYDL0fgOQi7o6yiC44SvgsLXegSOKm7msiVe7uG1yiDDy_agv1vcdP4JC8kECqaACWEaQWYJ6BgkpoNvApC5xMOazpck0FF3H3Cvyr5NKL3a2xzqrw6jhkEQ0pAJ6owFB6xCwM4gt0qtjKDaCnKvCuDIanbysDCvA5FOCkYcqc1L-9gDcbHifYbmVP3lsdq41JEkFcv1YyjMFvApbutWRvq0ti8ObI1Zpcw8gq0jcHvdNEE0gr9OP_lzFWv0Im0QYnRveL62Fiv9Yr2R3MdVeLVCrIUvzKJOayd9yNRDe0PKdjsuUO6F4RWIxopcrh5CdkLM6irVgyodPYFIwwFSgjs0VZ7JK6j_YPIWdB4IEt0mlibG2r6FcX-it5R-UDQs7MkpfW3SeyQcHHjXQf6HnAJJ_vUxtZVHPW1ZvbcnQQ0fMpTzkM8tIhEfwIY732JmYZYc-SnCD6nTKBCCA_U87CwkLwk2rV7gZfj94Cu_LTmIRu9bI7p_HMIoKq_EODWzWxglJHTMIopLVgVGFIP66ZFCIb96aY3BpkzFbhUNXfnKdQj7rWkZGG0fV6BDh5AVFKXvkbV9qHAtPGrtReDvIqECiUhj9eJ1mSAMPwPc6N-mbvppDS7FC2d_EDW4R0VK0MGAcg_Aip2mxPCAfOWL02buxIHnN021P_lJ-EnspLzs01kOnHNI4TS3YOFP89IqdusfhUUKaKa8EplRaVY8ZqZ00SXjtLYwhCgD4g48bRgky2MMUHDsYr9-lTLICJ1Jti-pFQe-LaXd2m3B-95DtYsoblaKvOdmbDQ6ecy3XhpGn_7m6-_tKltjQuK_Dokwug_KdOn3HHs_2We8Bnm5Ml-WN7j4zV6RCqczCIcJMoDaWGZehL7ZCV6fzjvin5QPy5k6SckhEBmls3UOQ8ws-0AHEVE73l84VDLg0gfYeiEo9axslOUYaNHtxwNDwhQHDTJWyYMGCLFq9h-iphgzK3QNGRsMvXWgTgUp7Iq6dojzvallbw3uwyySA4ilzeZV_ovA8VuHUXE9_YsFpqFV2FsiIavbwVcUhAa4zWGDIAnj41MEb3kHEy5DNsON9RS4hKc9rEWw_7Y5vT_iqWVtK1-rxnmKwzy7Ciglvb7_SMc-y8cUgam0xb7O7t6eY4a1yFw69HbpnRkyJm-KgvEvCaWe0waVBkSjd17KBZyaED9_KkvdFQBIQCT4MGTDr3yOgjNbuuEwQI73MoD1Hi_vhdziF8aOmRwhBPgeW-edFVuF2MHjcydjc_a2OxIfDfQ-ISyVeiyRf9VBzjOsBUoyFeGCaXiv8fyHWI7dIXZscETC8k_G-IVN1MNyqNXX-mgrDCcKRhr9JySKpwwq9fj8mHwF1s31CJBIIYVZ6Xz6RON_SnV4zr6mqopUQOnea41eWG8h5tMRZ8Hh4HkP98JcdXIe_Jxo3EbV4L0vcagsvjDKZVoTWaSFsjGxfr5UB1AThORImQQ4tWQyeBLJykqvzeoPNVdU2IppBBeo2Hdg1t4ewQV91I0ko48gEqGBi1JRJ_QBxuIoM8ckedEOnI2zGEBo4sGxdeRFcaGbuUVDGiOzWDddI97OOOypdGDLB7GPr8sCwZmhwsXUxPTB1CuR43cNl2ycaUdFxKxaxpwRgPjHD8uO5rk5AroJugSTSGI65dhXfUW7vRXsX89X76h3Sm3MKA147PEg-CJ-b5Oe7FPNgfQSveKoq82gjtpfgvtrgGccj94oygrLrtaddj99iq0mc4LGeBOvLbqMWfbzRXquN3EJ5TfKwjiii3P3O4POADFC5FBrzdKeCIltcmHVtHHag255t0R_B5iHHpbJG7LIHdudNJ2cpN0PRjvIgkWlAmJT5HqvHTwWGqopueBYCmBdtoCdYtZX-VSdN-SLcgpSjmFDzG9cJD7lzThEcyewPI4iJCY11-sXq_DCEzOdoKz1a7Fk60KGENpi3PZDXkzSMIjxbKRkIkDu01_0GkYaFQzOTfyvKAAaSuVKa5WyJjwL8-c2N-F3hHC9Bu9x1TZvMY0M2moSBaWBkSIVKTSmQ0blR2bcL_nZYSYtZMe3P2RD3NhUCITDx_zjZzqc1LFbxvAY9DTb8FYUt8cky-wEPwyNT6hMnqSYamjk1NVbKi797aXb_Ky50aSN4YRb_GHcsVuVEJRoM1eb0ovTUAY0z_GkvOvUWMGQ4sVFeBY4ekEpdXnuG7HoDh5_VgulzIotX-y8StmhrFkslAn6u2il0Vb4pBtqxF5O_t6WVg4hMKIgfbMuRc3CRFThvk5ebbi0-oyr4dEOp8QbF-o3bMDyNlhWoXRoKKLZOZhoMu6MxIu4D6Uo3Tceu4z6N2TZ9Qb8WpJilYx26OZcPMu32XFFDqgjvWJyupuglzYntteyHjJAMhZrB5nY8lsVBOznRvr1JTbosPGSUVVMTk5_Z0hVyrHt9_kfcX83GnwbN-9G-Ey5rWwTtDCnGqpGEpUdS4tn_GkfpDLztz2gbbbqAFphCi4u8vE0OTnVHwHOMC7ZrI70aNfEgPxGnr-Jo-9V7Jwy6OnC3DGZZ2usi6ZdweFNHDtHwXjgSTbY9DOZwgVQLsSSUIXS7K9WVLy2FUd_19GGnZztj2Pn_Sb4GP4Wb1o2bhwChxOt_kUXcnbtT8kiT54gLAJUGmJ6LSVeGsYRX8J8t1ocuEVykW-Jy3KQ6AaSk0qafw7EpdImF7ryh_T-I575kOeVBp_4herNikoItM50OVND7cudAsT4Uc5BDzFUetu2xA3dC-KxBEfe2t5nNCmQN19Mr3qMPAMNy76a5dcqyyj3QwvM-tl7S9nlWIQ9gfvgBq2Y&cid=CAASFeRolJWlo3IDMwHsCvCWc6KkdptZEg&rfl=1%2Chttps%253A%252F%252Fnex-software.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:50:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 475
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:50:50 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 2F6D 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 112
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:53 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2F6D 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 07:31:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Jul 2022 07:31:36 GMT

GET
DATA 200
OK truncated
/ Frame 2F6D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a36bf8e74c371bebd8d94ff57d8c1880d813eb8cfe6b17c5cfeefa3cd67020c8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 index.html Show response
s0.2mdn.net/8483882/1618411231438/ Frame F29D 4 KB
2 KB 15ms
13ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8483882/1618411231438/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

339e4bba44809e92b7b32d04c17af82f4469c8f894806a74d141796b157dadbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /8483882/1618411231438/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1730
date: Thu, 08 Jul 2021 05:03:01 GMT
expires: Fri, 09 Jul 2021 05:03:01 GMT
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 17744
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2F6D 0
593 B 115ms
63ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstRtIdBv_C12D-YDB7-eHmg2oRVfICCzIZzSk2ncdkzFrw9k2KMgLl6AJ_MhJbT1wY9KAdQJBlAtpveu9CeBmBOTEb_1SUA8BqzztHhmoxjRIH0To3X-caatxSq1MEeZOcYmFqbKTO3qoHzGMHz6fb1iym6MZUL8Ocey8OsOBjw5D9MVNArVzhklmKe4YCvk234CtjQ8-DWBpFeQd0GUZPgOQpxdnHW8vlPKPK6rfPxNnDdhiNDU2Nvllmpk-LCXwAjYCqsmJi9KcXVhFdOG_BvW6UhhGmDnCqZB1aSIC81Unpm09DO_2b7GBTk3UdCCV4rEl2etSu4ZFIj7n5h-8RK5P7KXciKPulJ3qY42HTGob3QOdXfrP5URIK8wXOrRFnrKOMnv6caes2YADxAk9grnPOGV90ZLY6oFI92Fd7ZrVG6L5O30IMh53yHjPOSFAyNU22vjkebMP8bHFCfOW9esr-qLoqUUhEcs2HqGqsmIRMM77yqUPqqTfSMyObLQBgr-YpcV3_mrSu4YtfH4OsgySJjY6YB0SwNsD5Y5uOksn6N5n4iqPFtf_lxTvlcZH9dxyvZCqplERXiwnm4Ng_-KANJtVYIyh0zFBOo5j8lbC6BEAAb0bhMqRXH_TNbEOSeMXgGQ3p9N_g6ocTbTH63EDkfn5869RhJeqzPncORGqdfM0GePnfzRWEFuMzlc2YwSQnoMbvSh8H228vcnZ5lFwTbgmHHLVOLcSMTTDBGptcbuIDTewWKxyA9tyTNUXMTOi_wMGTDXkf1RzVrspOUURieYxHdAl3vRyCFV0PiBzTQBx3_6MsLxee6tP0AkuAEDHo7T5YOoGFRBx9iZFBPReYe3EFjom7QvomzQIAWomgg0TG3l0T_fVWI7WcSAjv_yN19r2V5ldeQk_oDXOMdUk_79Ze6tpcKpSEd3UMzs13vYerkqRFVoc78TzZwhbBW3xLY8zACC8pE6DZTqS3iBS3GOg9qhyv0sM8uiwPXrUlH--eB97l65tAzH73A14W8QRuqaoy9kEkNr3RTuQzFqTFJtcDoTbM67H0YCZU8AG0X6v4r51u8MwzgSXS9woPE_7QKG6O8alwb0NM31Uctv_kkCBrpgpFYJUNp2e4PbeLOmOc20ul2mGOMfqTk3kPyl4-4M5WCwK4x0hfSjgr580XmVSn1tD-IsPcIIFIvsyDVF1urU_zz9ptrl4--cjxe7rNEGw&sai=AMfl-YR_dN0WHzLjGpmMIENZmQ6sNFwxL5sNUYrlgT-Mw1ipMS7usOf0ey7ojxboOXeQ3L5RY0Dx-Iwjt9mb5x2zuy6uCsBWO9YusUq4rroBPXQOLG4n991eWLvz7mZTNxdrvf__Wo_VeNuD1OrTPfz3EsXMey00yiEhr9TSj68&sig=Cg0ArKJSzPbeLJl7VXNBEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=67&cbvp=1&cstd=65&cisv=r20210624.68199&adurl=

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 08 Jul 2021 09:58:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5B6C 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Thu, 08 Jul 2021 07:32:57 GMT
expires: Fri, 08 Jul 2022 07:32:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 8748
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js Show response
pagead2.googlesyndication.com/bg/ Frame 5B6C 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:43:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 927
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5744
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 09:43:18 GMT

GET
H3-29 200 lottie.min.js Show response
s0.2mdn.net/8483882/1618411231438/ Frame F29D 256 KB
64 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8483882/1618411231438/lottie.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8483882/1618411231438/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f601e5ffcbdccd40c8485bd0be0ae1cb3c419fc18e7b7eeb5ff085652a0a870

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:18:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67227
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65619
x-xss-protection: 0
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 08 Jul 2021 15:18:18 GMT

GET
H3-29 200 Ontwerp_onbegrensd_300_600.json Show response
s0.2mdn.net/8483882/1618411231438/ Frame F29D 278 KB
35 KB 8ms
7ms XHR
application/json 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/8483882/1618411231438/Ontwerp_onbegrensd_300_600.json

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/8483882/1618411231438/lottie.min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cded0e327c28fe18ba634e335e3dd17dec6012ecd2ea8dfc5abfac94899481b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20813
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36219
x-xss-protection: 0
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Fri, 09 Jul 2021 04:11:52 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2F6D 0
61 B 59ms
58ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 08 Jul 2021 09:58:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK Cookie set cshow.php Show response
www.awin1.com/ Frame 4F97 43 B
702 B 108ms
56ms Document
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.awin1.com/cshow.php?s=2841812&v=19227&q=409216&r=235229&pref1=48176700064878800719610011649006&pv=1

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCk0JUVMzmYOe4E8P47gOHzoKoBOKw3PBfjo3S-4kL8C4QASCqgMMiYJGEgID8F8gBCakCdUHgqk3Nsz6oAwGqBM8BT9CHef3bAYHNo0VJthw4QkoKa3TZe6kS7EcJWQfUCGM0-OV1NF1NEaPahtbeMhYOoy50kNhpRx7yza1xJbS96qv7_DVLNVOUZ8rdHchJgzNtFwLVmvSpOsYipfpN9YBiwEFIDCZN0kE1ZzvbAOiRJk_mDnBdadqhYnDZgg6VvwALTOTXIhIyrGxVhOqxdT3r71Wr1z-RYxljmvhWvHVwq5MbyyPxsGCE13DlKArFMBMX_aQRfz7DKsASI55tnYDoE1vOcSDLkqq0DWkM2JwiwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA%26sig%3DAOD64_37rG5IpIXGAWPCpI6xLZJP13H1pw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-AiQF06tXecF0YJ0gri8w3a-q3lpwdRVgHmty0X8BjkO9_wGMsRKttGSS_r09N1KIIhEkh1lJMrto6HbM5zPCuN6JWIpw86zgWvhMTwZfMpD6nHuHpYLIPPTPPL7jR2fHlAszW8cRNG_q275LPOnTdnvKPlJA%26cry%3D1%26dbm_d%3DAKAmf-DYomONQra4mIaUITQA9MGwQdKEy5KGCWOmI4wB-k2ny80BOkjMtRmYU9wKqdFkau-KqRUC18PwDgNJ1ss4AxrT1XSLXODyIg3hVnGqd19t4Vl0NbuCTHY8iFfT41GGtytLWgB-ZxgJqXn9AQarDoQJEE4UYIyQtawpMngTT6HsHircKcUEn4UqbWOMVu4miAej1558bUldydPjpViY9tJ4XVIqoFIp-wa5iFsopU1WrWZEiZdAbuuL8_SPmhXgEVUacL760TQ0L6ERIam0TGRpL5MMMf25U56L5UaDDGoPSs3nL3tsxRlZoLJ9VWd_e_C9Eba-Qto8hCF86rA_bYvHDxPf-UwUggMG-TCD22kGsrNMN8R4YOZI0V5qJYvf-h4stieQH5HBNQ9NXUyJoDk57LBMdAMrp4XAp1f_Q_DBBe-6q1-aOqjZi56o9ttrUps_oNjJ%26adurl%3D&documentReferer=https%3A%2F%2Fnex-software.com%2F&ancestorOrigins=https%3A%2F%2Fnex-software.com&random=395004191607&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.awin1.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Thu, 08 Jul 2021 09:58:45 GMT
Connection: keep-alive
Set-Cookie: awpv19227=235229|1625738325|154c5670-dfd3-11eb-b7b7-692d03e22aaf;domain=.awin1.com;path=/;expires=Friday, 09-Jul-2021 21:58:45 UTC;Secure;SameSite=None AWSESS=409216:2841812;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H2 200 / Show response
htlp.large.nl/ Frame 9A14 3 KB
3 KB 52ms
8ms Document
text/html 2600:9000:20eb:2c00:b:a286:7800:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://htlp.large.nl/
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCk0JUVMzmYOe4E8P47gOHzoKoBOKw3PBfjo3S-4kL8C4QASCqgMMiYJGEgID8F8gBCakCdUHgqk3Nsz6oAwGqBM8BT9CHef3bAYHNo0VJthw4QkoKa3TZe6kS7EcJWQfUCGM0-OV1NF1NEaPahtbeMhYOoy50kNhpRx7yza1xJbS96qv7_DVLNVOUZ8rdHchJgzNtFwLVmvSpOsYipfpN9YBiwEFIDCZN0kE1ZzvbAOiRJk_mDnBdadqhYnDZgg6VvwALTOTXIhIyrGxVhOqxdT3r71Wr1z-RYxljmvhWvHVwq5MbyyPxsGCE13DlKArFMBMX_aQRfz7DKsASI55tnYDoE1vOcSDLkqq0DWkM2JwiwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA%26sig%3DAOD64_37rG5IpIXGAWPCpI6xLZJP13H1pw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-AiQF06tXecF0YJ0gri8w3a-q3lpwdRVgHmty0X8BjkO9_wGMsRKttGSS_r09N1KIIhEkh1lJMrto6HbM5zPCuN6JWIpw86zgWvhMTwZfMpD6nHuHpYLIPPTPPL7jR2fHlAszW8cRNG_q275LPOnTdnvKPlJA%26cry%3D1%26dbm_d%3DAKAmf-DYomONQra4mIaUITQA9MGwQdKEy5KGCWOmI4wB-k2ny80BOkjMtRmYU9wKqdFkau-KqRUC18PwDgNJ1ss4AxrT1XSLXODyIg3hVnGqd19t4Vl0NbuCTHY8iFfT41GGtytLWgB-ZxgJqXn9AQarDoQJEE4UYIyQtawpMngTT6HsHircKcUEn4UqbWOMVu4miAej1558bUldydPjpViY9tJ4XVIqoFIp-wa5iFsopU1WrWZEiZdAbuuL8_SPmhXgEVUacL760TQ0L6ERIam0TGRpL5MMMf25U56L5UaDDGoPSs3nL3tsxRlZoLJ9VWd_e_C9Eba-Qto8hCF86rA_bYvHDxPf-UwUggMG-TCD22kGsrNMN8R4YOZI0V5qJYvf-h4stieQH5HBNQ9NXUyJoDk57LBMdAMrp4XAp1f_Q_DBBe-6q1-aOqjZi56o9ttrUps_oNjJ%26adurl%3D&documentReferer=https%3A%2F%2Fnex-software.com%2F&ancestorOrigins=https%3A%2F%2Fnex-software.com&random=395004191607&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2c00:b:a286:7800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6bb77d20dd85b4bfae78affeef6ee91869bffa0ef53ed9c8ab9c2a526d0180c5

Request headers

:method: GET
:authority: htlp.large.nl
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

content-type: text/html
content-length: 2647
last-modified: Wed, 08 Jul 2020 09:51:56 GMT
x-amz-version-id: Za5k1aCF3b8ugAP1.Dh5UJVd_ViDWDOf
accept-ranges: bytes
server: AmazonS3
date: Thu, 08 Jul 2021 09:58:45 GMT
cache-control: max-age=10
etag: "81767a046d18dbeec7092a1dbdc70325"
x-cache: Hit from cloudfront
via: 1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: dKZSRtJcO6UHrzqLEnCFfuTq96sWyu3joYw1ibSWHX2GjdwlL-LLsw==
age: 1

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame CC56 12 KB
12 KB 231ms
120ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=48176700064878800719610011649006&js=1&nw=1&cp=870787413
Requested by: Host: nex-software.com
URL: https://nex-software.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 1c1debc5469ccb693fc9511fe59e04b79a98b1bfe79cd62a19226dad7fd548a0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
Last-Modified: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90006.redintelligence.net/ Frame C0EA 7 KB
2 KB 99ms
34ms Document
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request.php?zone=os3968sx7dh6&nw=20&renderingType=javascript&namespace=1f0229bdd2&subid=&uid=ebe2fcd6107c27b3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCk0JUVMzmYOe4E8P47gOHzoKoBOKw3PBfjo3S-4kL8C4QASCqgMMiYJGEgID8F8gBCakCdUHgqk3Nsz6oAwGqBM8BT9CHef3bAYHNo0VJthw4QkoKa3TZe6kS7EcJWQfUCGM0-OV1NF1NEaPahtbeMhYOoy50kNhpRx7yza1xJbS96qv7_DVLNVOUZ8rdHchJgzNtFwLVmvSpOsYipfpN9YBiwEFIDCZN0kE1ZzvbAOiRJk_mDnBdadqhYnDZgg6VvwALTOTXIhIyrGxVhOqxdT3r71Wr1z-RYxljmvhWvHVwq5MbyyPxsGCE13DlKArFMBMX_aQRfz7DKsASI55tnYDoE1vOcSDLkqq0DWkM2JwiwATb87331AHgBAOQBgGgBk2AB-vn6F6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTkxNjE4NjM2ODU4MjY5NTaACgOYCwHICwGADAGwE5flsgrQEwDYEwOIFAHYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA%26sig%3DAOD64_37rG5IpIXGAWPCpI6xLZJP13H1pw%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-AiQF06tXecF0YJ0gri8w3a-q3lpwdRVgHmty0X8BjkO9_wGMsRKttGSS_r09N1KIIhEkh1lJMrto6HbM5zPCuN6JWIpw86zgWvhMTwZfMpD6nHuHpYLIPPTPPL7jR2fHlAszW8cRNG_q275LPOnTdnvKPlJA%26cry%3D1%26dbm_d%3DAKAmf-DYomONQra4mIaUITQA9MGwQdKEy5KGCWOmI4wB-k2ny80BOkjMtRmYU9wKqdFkau-KqRUC18PwDgNJ1ss4AxrT1XSLXODyIg3hVnGqd19t4Vl0NbuCTHY8iFfT41GGtytLWgB-ZxgJqXn9AQarDoQJEE4UYIyQtawpMngTT6HsHircKcUEn4UqbWOMVu4miAej1558bUldydPjpViY9tJ4XVIqoFIp-wa5iFsopU1WrWZEiZdAbuuL8_SPmhXgEVUacL760TQ0L6ERIam0TGRpL5MMMf25U56L5UaDDGoPSs3nL3tsxRlZoLJ9VWd_e_C9Eba-Qto8hCF86rA_bYvHDxPf-UwUggMG-TCD22kGsrNMN8R4YOZI0V5qJYvf-h4stieQH5HBNQ9NXUyJoDk57LBMdAMrp4XAp1f_Q_DBBe-6q1-aOqjZi56o9ttrUps_oNjJ%26adurl%3D&documentReferer=https%3A%2F%2Fnex-software.com%2F&ancestorOrigins=https%3A%2F%2Fnex-software.com&random=395004191607&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7eecb787938464be88e7345aa6c1f53374c844ca8a7af2871257cbf38f17f66f

Request headers

Host: hal90006.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=cceb4e75e95c5466
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 08 Jul 2021 10:58:45 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2128
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame CC56 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6899925b77c64e6ba17703723a174045b25f18cd5461bb2e578e6e182443bbae

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 img_0.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 13ms
7ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_0.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28402291e54ff8739e3a374d40c3cbdd816f8f43e270d6ffc669030e19c38f7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 16:08:56 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 64189
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5869
x-xss-protection: 0
expires: Thu, 08 Jul 2021 16:08:56 GMT

GET
H3-29 200 img_1.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 14ms
8ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_1.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30b7f8d1086048be80a12e146fc66f5cbf024839cd6e54a09e4a5b9efdb8306b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5745
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_2.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 21ms
15ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_2.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7a87e7376c586c40b18007bcff18e9f647629b6f63bb1a268975bc8a41ca56d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 06:52:09 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 11196
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5746
x-xss-protection: 0
expires: Fri, 09 Jul 2021 06:52:09 GMT

GET
H3-29 200 img_3.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 20ms
14ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_3.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b86df383df6b04eba18e7de655fd41fc196d2b471f3b3c83ae90c800d38e1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 17:24:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 59648
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5809
x-xss-protection: 0
expires: Thu, 08 Jul 2021 17:24:37 GMT

GET
H3-29 200 img_4.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 5 KB
6 KB 20ms
14ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_4.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ce7ec6422c2d79ccfb999277af58c55a817ecaaa96bc788a2fcfbd542cb5179

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5629
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_5.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 19ms
13ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_5.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0076e67bb5a186ecfcb47c342b6acfca1beb1f505f1010894c758d06d93e04dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 18:48:20 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 54625
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5925
x-xss-protection: 0
expires: Thu, 08 Jul 2021 18:48:20 GMT

GET
H3-29 200 img_6.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 18ms
12ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_6.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95c32bf2414e27fac06ef4668a874d6073643ab3723c38007f8f8c46a8528994

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 18:05:16 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 57209
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5682
x-xss-protection: 0
expires: Thu, 08 Jul 2021 18:05:16 GMT

GET
H3-29 200 img_7.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 5 KB
5 KB 18ms
11ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_7.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6126ea1be99195aeff2aba0d752d16c5b57742efb60258bb9c3e599921b148b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 11:18:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 81612
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5577
x-xss-protection: 0
expires: Thu, 08 Jul 2021 11:18:33 GMT

GET
H3-29 200 img_8.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 5 KB
5 KB 27ms
20ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_8.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a547a4b4b4edf0183e6272d19d8ea782ebf4ea2dab98f092da799d4ec8a369bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 11:59:03 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 79182
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4991
x-xss-protection: 0
expires: Thu, 08 Jul 2021 11:59:03 GMT

GET
H3-29 200 img_9.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 26ms
20ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_9.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13bfbdb13692e04a3791b9644d3a598d448df115a603b4ade3ea2277860ff5c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 13:21:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 74215
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5927
x-xss-protection: 0
expires: Thu, 08 Jul 2021 13:21:50 GMT

GET
H3-29 200 img_10.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 24ms
18ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_10.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0218fd1a3a34f2414fde93e102c55184565ccae23e2a945746ad67c9bda7d016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5795
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_11.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 25ms
20ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_11.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edc39baffdb403ed1475d693f3d58f3634e4cbdc6f4432e05571291c047f83c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5862
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_12.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 5 KB
5 KB 25ms
19ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_12.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f249a119822525ccf80d757c5d355543b2725bc635f13c2cf184918fa8b412b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:44:42 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 18843
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5163
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:44:42 GMT

GET
H3-29 200 img_13.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 25ms
19ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_13.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

34db5f66c0dd11a9e94739d9aed71d9f3ff68c7a4a767cb8f820031237955344

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5806
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_14.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 5 KB
5 KB 23ms
18ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_14.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06d3fdfce5b5cc3d40ab25cf242288e17acf032da0eaf1b9a74b80b8077e4519

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 07:38:42 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 8403
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4939
x-xss-protection: 0
expires: Fri, 09 Jul 2021 07:38:42 GMT

GET
H3-29 200 img_15.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 23ms
17ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_15.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

380206aa62d52fb9897fa2eae7d0bdd1389891fff052de1b9a1d7fc0cbe5fa16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 18:48:20 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 54625
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5743
x-xss-protection: 0
expires: Thu, 08 Jul 2021 18:48:20 GMT

GET
H3-29 200 img_16.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 21ms
17ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_16.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e87f7dc0b302961e88a14f82423730ad5c3a2351aa5acc175fc16c50f4eb8d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 15:38:24 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 66021
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5733
x-xss-protection: 0
expires: Thu, 08 Jul 2021 15:38:24 GMT

GET
H3-29 200 img_17.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 21ms
16ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_17.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b61a6dc412030f469e12048d32d76eef05ab210a5cf551198dd0bf009db83dc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 07:08:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 10199
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5820
x-xss-protection: 0
expires: Fri, 09 Jul 2021 07:08:46 GMT

GET
H3-29 200 img_18.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 20ms
16ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_18.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48472c8a07b51fbffef77d89d70588e7901bf8d5adf99a2c3ffa0d0a82197bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 08:46:47 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 4318
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5793
x-xss-protection: 0
expires: Fri, 09 Jul 2021 08:46:47 GMT

GET
H3-29 200 img_19.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 6 KB
6 KB 20ms
16ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_19.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b7269e43dd9eb0f9d9ed2a4cf1168952a04760a580770ba9fe63bab404d7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5811
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_20.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 27 KB
27 KB 18ms
15ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_20.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e2c4a8f092ff7e0787ff317c5e1ee91303a2de7525dd135ba54a0729d4a154e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 08:53:03 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 3942
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27176
x-xss-protection: 0
expires: Fri, 09 Jul 2021 08:53:03 GMT

GET
H3-29 200 img_21.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 18 KB
18 KB 25ms
21ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_21.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1367dfba35126724bf4765c569f3234ebba8732d74e66298e51d81528b3d8df2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 13:21:50 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 74215
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18313
x-xss-protection: 0
expires: Thu, 08 Jul 2021 13:21:50 GMT

GET
H3-29 200 img_22.png
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 598 KB
598 KB 24ms
21ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_22.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a4130969852a275300381cf1b549ebe040d7c36fac7c726a44952ff3124d13b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 04:11:52 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:32 GMT
server: sffe
age: 20813
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 612112
x-xss-protection: 0
expires: Fri, 09 Jul 2021 04:11:52 GMT

GET
H3-29 200 img_23.jpg
s0.2mdn.net/8483882/1618411231438/images/ Frame F29D 10 KB
10 KB 17ms
14ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/8483882/1618411231438/images/img_23.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7216b9b6061f98e15407c00c10ca9b71b5467732b967fc1527bba15ff22c3eaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/8483882/1618411231438/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 18:34:44 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 14:40:31 GMT
server: sffe
age: 55441
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10094
x-xss-protection: 0
expires: Thu, 08 Jul 2021 18:34:44 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C0EA 4 KB
747 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 08 Jul 2021 09:08:24 GMT
server: ESF
date: Thu, 08 Jul 2021 09:58:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Jul 2021 09:58:45 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame C0EA 17 KB
17 KB 149ms
88ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/56175/creativesup/1200x627.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 3af714ac2fed9c233986eb3baece74526a90beabdb759423e988be5b0cb8d903

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 17088
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame C0EA 15 KB
15 KB 225ms
164ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/58593/creativesup/1200x627.jpg
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 6e893fd46786e3e2f82c1532a9fc57fc319f062431f460a5ed32461b6cc48a39

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:45 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15621
Vary: Accept-Encoding
Content-Type: image/png

GET
H2

200

43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif
static.tradetracker.net/nl/material_image/9a/ Frame C0EA
Redirect Chain

https://ti.tradetracker.net/?c=4693&m=1371425&a=70002&r=48176700064878800719610011649006&t=html
https://static.tradetracker.net/nl/material_image/9a/43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif

6 KB
6 KB

35ms
17ms

Image
image/gif

2600:9000:21f3:3c00:1a:7c92:efc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.tradetracker.net/nl/material_image/9a/43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:3c00:1a:7c92:efc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 1a2748bc84c0cdf421b952cc9a8c32ff0024c463c254b1cbbdd5ef6368bfff74

Request headers

Referer: https://hal90006.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:21 GMT
via: 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
last-modified: Thu, 28 Jun 2018 08:43:53 GMT
server: nginx
age: 24
etag: "5b349fc9-16b8"
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 5816
x-amz-cf-id: dIDmTpyApVKEOEhfcw6bu_2jbvccc74hz6OLGyIjp1szmouEYsylig==

Redirect headers

location: https://static.tradetracker.net/nl/material_image/9a/43dfd3e64b35ec0827ef7b0642be3f7fa9695f.gif
date: Thu, 08 Jul 2021 09:58:45 GMT
cache-control: no-cache, must-revalidate
server: nginx
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90006.redintelligence.net/ Frame C0EA 0
150 B 91ms
31ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/viewability?s=48176700064878800719610011649006&a=3b0227d5&vb=m
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame C0EA 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal90006.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 21:40:42 GMT
x-content-type-options: nosniff
age: 217083
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 21:40:42 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame C0EA 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal90006.redintelligence.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Jul 2021 21:40:42 GMT
x-content-type-options: nosniff
age: 217083
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Jul 2022 21:40:42 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame CC56 59 KB
60 KB 77ms
28ms Script
application/javascript 13.225.87.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=48176700064878800719610011649006&js=1&nw=1&cp=870787413
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-101.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a91a21b8a5843a8d8fac4d3916d5eb926ea4917b7d27dbee00ae068f4dd9d07e

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 9gxRQLkEbSwlqYx89yHTPWBPBM9yYdWx
via: 1.1 286eb4b50e0acf373dd03645aee00b7f.cloudfront.net (CloudFront)
last-modified: Mon, 28 Jun 2021 16:00:47 GMT
server: AmazonS3
age: 15055
etag: "edfa65aada7c65cbe3a78f39f8444ab3"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Thu, 08 Jul 2021 05:47:51 GMT
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-length: 60765
x-amz-cf-id: YqbN330vFYz2X3-CI0LiT-L2e75kCRbYeJczgzyCzdAW6MXhcB9wgQ==

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame CC56 79 B
374 B 126ms
41ms Script
text/javascript 81.29.72.47
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=7ta44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6STpjB9TjQDKMhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt.gEngMQEjZr_WhXTA2s.XTVV26y8GGEDd5ihORoVyFGh8cmvSuCKzIlnY6xljQlpRDuxfTNJxTqRejPm8LKfAaZ4ySy.aPjftckWmb002KmwmAklV07IwEDecIIieIFmpTQDJztEqwhMBxEYYdtt_xvtqpI92PIbJlpMpwoNSUC56MnGWpwoNN5uQ32SCVc45_Ipu25JatQVD_DJhCizgzH_y3EjNpmVWN9dPBSpMk.Nk4Jl9SpDK1civm_Uaujkay85icCmVWN9e4WX3NlY5DtThuy.6tS&wgcookie=%7B%22wgifp270885%22%3A%5B%221519435%22%2C%22270885%22%2C%222685811%22%2C%22%22%2C%221625738325%22%2C%22https%253A%252F%252F4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com%252F%22%2C%22%22%2C%22%22%2C%221633514325%22%2C%2248176700064878800719610011649006%22%5D%7D&wgchecksum=d3928760ee0bd2cb1724c3629efbf6e2&userIP=159.48.55.6&doAffectv=1&wgtime=1625738325
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2685811&wgcampaignid=1519435&viewref=48176700064878800719610011649006&js=1&nw=1&cp=870787413
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.29.72.47 Brixton, United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 81-29-72-47.servers.dedipower.net
Software: Apache /
Resource Hash: 17b47a1ed2cd2e1ec86f4735497e2956eb34be0a66fc20b427148f65c6ebaca5

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame CC56 3 KB
4 KB 85ms
32ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1519435&viewref=59238600069034700719610011649019&wglinkid=2685811
Requested by: Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: a1228bc3c791388213864420c6e03b15f847aa80793dd6d507926a701ec3b9d6

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 08 Jul 2021 09:58:45 GMT
Last-Modified: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 3191
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5B6C 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B4Kt2VczmYOm1BbShlQeal67ABgAAAAA4AeAEAg&bg=!3t2l3ZnNAAYo4NJEKOA7ACkAdvg8WmGa5VYCXU3-Jfyqip1rbJMAYJICdi2FtTHd3ypyEtNNPi3J_gIAAAEVUgAAABRoAQeZAsK0xqCTMtF1dQNKo6VFnVyBrEPi1I_iuOw7aWotLFF0uHoZvBYDDjoppigvbC0XJ4XwAn2BSKlDG1r9-mmgttyVCeJkuzb0I4-oQZbjKax6fOhrbEAX6JeDcNsrMPy4JkotLPv4bxBalRbzgR0naK4BtUeMehLdoLrBWlB7RE0ACacnLngPZPvSEUV_JIxFgv3y7j3m2rpTtEC54uLL0mEXjwpT7g5oLELaZ8Z-IhjAKJ5Bp624YiKEMYluBe2xwRQbmA7_HqCReI_UoGucV3yRBLXz2Zago5Lk2MuQnrNDMxVlvTHfuTq19g-LRAgPKRkGXeHuD2TSmi5XdH1YVu6uUJ1UjDNntVLbScTkG9pQCfVDwYd3M8SNvIYRxlIxk2oFtjsl31Oq8HpaBORE0PTr3uRGG7u9VOkW6SAf6ThWCcJ6BHuYg8Ai000rea_0JZuqiEgEa1fp_bSUl5FSLjh3gZNQv9kMY24LhWevow0xGccRFV1OLEefx6kY9fQ4Vcuf0cpHXqWa3DkNXOriX4NHJE9xk8FJ2NtrMUjiUQrCrWq2tUVv3pCn3lK4zmOmXVLBCZ8xZl9LgZenTwmv5LmWfo9nJIzdOgnbTe7zjdyggy9ES8YiNgBcUV_FEtGYM9p1A_Z0JhbO2QNFmegS7V5OXpytUaXTOvOlhl8WFKa5bb33sPHkIMPgIRmg9mdcQwK6dHZk45y-3p0MiWCJ9RvrHXtogFcEG-oroiGYiNUi187dTO78OiQCAEysOlPfGvXqsSHMymTdu69ru-5dxF_Hb2wbsPmnHT8mDJD9c99ZS7GD7GsTYeFdLZgqPcbUqnmBhxGzsJhaQYe-pktdgGGmzqCTxJfSj8zcxTIQUcjCIltsgMDSCBDiOi5bIBVT-F8XhJTLe34ldEJucti-uoNG1ujv9s-jiNxdnNrrOkrcPzgP

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK fp_decode.html Show response
track.webgains.com/ Frame CC56 63 B
270 B 153ms
51ms Fetch
application/json 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/fp_decode.html?wgpayload=7ta44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6STpjB9TjQDKMhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt.gEngMQEjZr_WhXTA2s.XTVV26y8GGEDd5ihORoVyFGh8cmvSuCKzIlnY6xljQlpRDuxfTNJxTqRejPm8LKfAaZ4ySy.aPjftckWmb002KmwmAklV07IwEDecIIieIFmpTQDJztEqwhMBxEYYdtt_xvtqpI92PIbJlpMpwoNSUC56MnGWpwoNN5uQ32SCVc45_Ipu2.J1tQVD_DJhCizgzH_y3EjNpmVWN9dPBSmrk.Nk4Jl9SpDK1civm_Uaujkay85icCmVWN9e4WX3NlY5DtThuy.69S
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 84f8704bdc07ab2809b5a9dd028ef0c9e0001bd0b21c32fc06c18231069a581e

Request headers

Accept: application/json
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 08 Jul 2021 09:58:45 GMT
Server: Apache
Connection: close
Keep-Alive: timeout=1, max=100
Content-Length: 63
Content-Type: application/json

GET
H3-29 200 container.html Show response
4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1BD8 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 08 Jul 2021 09:58:44 GMT
expires: Fri, 08 Jul 2022 09:58:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D8E5 640 B
318 B 22ms
21ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-ilAIQ-r2ZAhi3z6-tATAB&v=APEucNVEnzYt_Xq0Cr0S8Ucjw4CPFTmhBYhgdAzuZDqq1pY-muI0atA6hwnzRF08Wl6P1Nky415kLITImRW6D5iRBq9eqSNjmbpU19REyuVsPzfrkD5VRKOSUEQl0vBfTIFE4ETfMKoeRTrY1mR6cAVeg8khi5jmqmuu6vqtrlXeBZ4UG1x7YKS6sK67icK0dJgAuB165gf2M5ZPnokpR9iIX87xJQIU2Q

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-ilAIQ-r2ZAhi3z6-tATAB&v=APEucNVEnzYt_Xq0Cr0S8Ucjw4CPFTmhBYhgdAzuZDqq1pY-muI0atA6hwnzRF08Wl6P1Nky415kLITImRW6D5iRBq9eqSNjmbpU19REyuVsPzfrkD5VRKOSUEQl0vBfTIFE4ETfMKoeRTrY1mR6cAVeg8khi5jmqmuu6vqtrlXeBZ4UG1x7YKS6sK67icK0dJgAuB165gf2M5ZPnokpR9iIX87xJQIU2Q
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmR6nCKEKOph8xG8hLclUx-VfFl5Fyzotmw-EX7ErQt8BWIdoDH4xac5O1XwAQ; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 08 Jul 2021 09:58:45 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Jul 2021 09:58:45 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 1BD8 17 KB
7 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite_fy2019.js

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

013bec3910ad3d4838f46d1a0095d9e6f0ea3e676e786daf0147dce032b651b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 420
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7112
x-xss-protection: 0
server: cafe
etag: 12276874145846594193
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:51:45 GMT

GET
H3-29 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 1BD8 6 KB
3 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0dc4093b6b9286ebfc6c728ddd3a70812a726d79d6f41d60a506fd5b93c4929c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 06:05:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14001
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2661
x-xss-protection: 0
server: cafe
etag: 7752240862628680351
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 06:05:24 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1BD8 0
24 B 105ms
73ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvq53hyZvsQk4GZzr9v3X66lmKx_74OYmMPeBNpz-W3xnz_V_p8VK-8mMqrFn1u5EIf6OqJkpPlybrA2vvePKeAGTpQbW_5pNP6iKTlhELs9meR2kF9RRLxSzDpU95JnjDFSvRrlDNwK5fE0sqTM5W4cG3boVAK5tHD3DxL789EBhO50QPmoqgUNh1beINKewwnMGlSk5diSGYxhlJ4E2Bcn1rvkPRXcKI_xsjXWh7aaUn_dfTrCIuyMB7CAx16VWu34idHHHjgcagxOGaSUPRp3aM7FNlXnMVS3rUUowjhsH7_oPV17tlzKy4a_5rDqvpvCvgpWcCxCh0wDVVWL2QAMnkchhfHImsIC7kBmMZyXRFgGesr1PVKtbuZ1RGYXIbGwFA1S4qzH5x_HTgXb42jpSJHG87DtGdSWnQxqGDq8O5KRmDAF1s5771ira8EEwWmYzQ8LGmtdc5R__ufdCVxgvW0YrrsH8fY8WjfruKH0_jNsRC2BdHG23V6QNcpG9jX8SZmjvrQtKfZ2NMzp36XRVkWY7sUv9yl7k9m2aRigTPSHZvSUjP49JD7Ve3nMx03Pe5m44gTMCXLnwEIZ4EAEM4a-XwMjGpDW5wmlPmBf5fglBYJiN8OjWSCSOcvb30wXimWdF4uC6sAi0GhM708iA3X1miSef-nE3GsLAvKO69m_Ex6AZo908btgOs9zUyqL2HVLOPsCdZj4LHCbYdrJSDt8xasmXObGb7mm32G1DdcEqXgEVAyYmK873oHZIYcbj4n_TTAOJUgRrOTeccV7w2vfM6SLGscrmMQdJSWY6yiHURjxxcr_dxnl5zUo0OxL19IXd5DNlAxOe8PQgU6pqYlriwEc0CjTPMGWGKB3NBQj4ZtgVWtA_ZjU0fsVmzE2SnS7l3YNQWPz0MJ75e0sZeru5YjnYRJFvyTfIyd_b0hkAHYqAf8RN2LzWK5F_ChqiP1MMo10OKeA_RixjCynPDbB0VKLxNVG4Es4UzA_JmtFuJBlhr5TRdAstaVCAF6aWEje4pqN92c19we_A1ry-v5uz3R7p5LcVsl5DWnkgABEnb5oPSAejXidlcBox4xKjLcUfY5s5aYjRhq4C-jpCBGtukaRG5VU4ASf2kA1b1ohQPu3gH5nMB1iVSCn8bdTaehBWsD-MyPcPsNxPngHmzgnvDVBqWEAjl9xoDxseAOh4JBQjLBTQ&sai=AMfl-YS3pzIWN4QOQOZEU-DIAiUcMpcnq_YXyN-YLv16sjRgEa8c1r4Syc9q5G2u-qijOsQrI5bZM3IGuArQMxKzOW6MIxa18rbJpjP2BHSOb6lo5ujJetHzNUis5ZNdgnh-ICsfS2fsydYKwys3C2vjJSBXBTZdOz1X8f4K8nagbh_0cK6Bg1E1cJbShdochZmW_5JuubHWhHZfqdNK_4PbqMTN6xkp-PICkgsXABZTnBlfx31in_DIfTcSook17uw22TJUE6sluhmBg8iPcw3vj22OgdgD8nM4H2NZFhBf9GVQ8y11l8xmsuirrbGIsdH6jwfQIfYI-yf-oif5SFkaVKgBKVBYxNl-66ccqNgwVY81yE7XAhJ9wT7OXa09YaaCajbr2hLv&sig=Cg0ArKJSzJ0O5azNjalcEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20210624.47053&adurl=

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 08 Jul 2021 09:58:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1BD8 41 KB
15 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 07:31:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Jul 2022 07:31:36 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1BD8 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Du_uRYt0rR2wAHZiS7NaeA6drQLQrPM5QEKW3ujqERRa7y54djvtbOPp1sTzFEhsozW4bGzJKZHIHa_A6hrSkwaoyCNPRjr0BVSp3OyhNY2J7AfHM

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 1BD8 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 242
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:54:43 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1BD8 123 KB
37 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28a030a77bcecc0621b938dc08610e4c1fa0e131507a2dbd0c8007960d269253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625657928851490"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37883
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:45 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 1BD8 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:32 GMT

GET
H3-29 200 7400709250379855599
s0.2mdn.net/simgad/ Frame 1BD8 533 KB
533 KB 15ms
14ms Image
image/gif 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7400709250379855599

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eab4639ea4e73a9fcada6c5b35b9c4fab5901ab0d78bf57d9f611b066e06ba72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 06:11:45 GMT
x-content-type-options: nosniff
age: 186420
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 545763
x-xss-protection: 0
last-modified: Wed, 16 Jun 2021 08:48:32 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 06:11:45 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3678 22 KB
8 KB 9ms
9ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Thu, 08 Jul 2021 07:32:57 GMT
expires: Fri, 08 Jul 2022 07:32:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 8748
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame D8E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELQEK8Y4akkaox7VbaAZ-sY&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESELQEK8Y4akkaox7VbaAZ-sY&google_cver=1

43 B
181 B

22ms
21ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESELQEK8Y4akkaox7VbaAZ-sY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-ilAIQ-r2ZAhi3z6-tATAB&v=APEucNVEnzYt_Xq0Cr0S8Ucjw4CPFTmhBYhgdAzuZDqq1pY-muI0atA6hwnzRF08Wl6P1Nky415kLITImRW6D5iRBq9eqSNjmbpU19REyuVsPzfrkD5VRKOSUEQl0vBfTIFE4ETfMKoeRTrY1mR6cAVeg8khi5jmqmuu6vqtrlXeBZ4UG1x7YKS6sK67icK0dJgAuB165gf2M5ZPnokpR9iIX87xJQIU2Q
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.210.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
via: 1.1 google
server: OXGW/16.210.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESELQEK8Y4akkaox7VbaAZ-sY&google_cver=1
date: Thu, 08 Jul 2021 09:58:45 GMT
via: 1.1 google
server: OXGW/16.210.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame D8E5
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDI0NzdkYTEtM2Y5My0yYTA5LWQxZjQtNjhiM2JhZjI1MmE1

170 B
188 B

34ms
34ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDI0NzdkYTEtM2Y5My0yYTA5LWQxZjQtNjhiM2JhZjI1MmE1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-ilAIQ-r2ZAhi3z6-tATAB&v=APEucNVEnzYt_Xq0Cr0S8Ucjw4CPFTmhBYhgdAzuZDqq1pY-muI0atA6hwnzRF08Wl6P1Nky415kLITImRW6D5iRBq9eqSNjmbpU19REyuVsPzfrkD5VRKOSUEQl0vBfTIFE4ETfMKoeRTrY1mR6cAVeg8khi5jmqmuu6vqtrlXeBZ4UG1x7YKS6sK67icK0dJgAuB165gf2M5ZPnokpR9iIX87xJQIU2Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 08 Jul 2021 09:58:45 GMT
content-encoding: gzip
server: OXGW/16.210.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDI0NzdkYTEtM2Y5My0yYTA5LWQxZjQtNjhiM2JhZjI1MmE1
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame D8E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEJG_izMAIE8iI76lfLVgl9E&google_cver=1

23 B
174 B

74ms
50ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEJG_izMAIE8iI76lfLVgl9E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-ilAIQ-r2ZAhi3z6-tATAB&v=APEucNVEnzYt_Xq0Cr0S8Ucjw4CPFTmhBYhgdAzuZDqq1pY-muI0atA6hwnzRF08Wl6P1Nky415kLITImRW6D5iRBq9eqSNjmbpU19REyuVsPzfrkD5VRKOSUEQl0vBfTIFE4ETfMKoeRTrY1mR6cAVeg8khi5jmqmuu6vqtrlXeBZ4UG1x7YKS6sK67icK0dJgAuB165gf2M5ZPnokpR9iIX87xJQIU2Q
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 08 Jul 2021 09:58:45 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEJG_izMAIE8iI76lfLVgl9E&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame D8E5 23 B
174 B 116ms
56ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-ilAIQ-r2ZAhi3z6-tATAB&v=APEucNVEnzYt_Xq0Cr0S8Ucjw4CPFTmhBYhgdAzuZDqq1pY-muI0atA6hwnzRF08Wl6P1Nky415kLITImRW6D5iRBq9eqSNjmbpU19REyuVsPzfrkD5VRKOSUEQl0vBfTIFE4ETfMKoeRTrY1mR6cAVeg8khi5jmqmuu6vqtrlXeBZ4UG1x7YKS6sK67icK0dJgAuB165gf2M5ZPnokpR9iIX87xJQIU2Q
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:45 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 08 Jul 2021 09:58:45 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame 1BD8 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0384fa887ddb8203d8a6f5333a3a0a53a264ec3726ab609210cd3f744e1c9ff4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js Show response
pagead2.googlesyndication.com/bg/ Frame 3678 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yXHsSCk3YzWUbRvqoZHyxkpI6JVLQi3qNywtkCkXe5s.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c971ec4829376335946d1beaa191f2c64a48e8954b422dea372c2d9029177b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 07:16:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 182514
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5747
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 06 Jul 2022 07:16:51 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1BD8 0
23 B 61ms
61ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-34-249-16-73.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 08 Jul 2021 09:58:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3678 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BsUh2VczmYPKxEvPFx_APybunmAIAAAAAOAHgBAI&bg=!KimlKW3NAAYo4NJEKOA7ACkAdvg8WusjxhZeULqfCzsrz4fAXZauDC3vpywEhMcHhAYUvLPHuUAqWQIAAABcUgAAAAloAQeZAsVH-e3xHCtazA5vHM3ITkR6WIQ-_Pb_P_pbqCgvv-SVlv4aZA_mbCtGoABwWK-ov9Vo0HltlwyKGT0piL8WURdnyJ0k0d0i7vj5Y1mu12ijttOEG85-WSlj1cxewAGLyARzY-mLksh0HuIKJnjALOykY2hFPESfKAiJpeHYTgwvzaSxAyNI3ah_lQ_Uh42DSOvAPfK5CZnvarWTslijp9DSRkrNbkrAZnAxdBudaq0YwlAIW7fwruI0d5bHCwRvz48mhESnyxouxId_-iPKORl0CrLLE8C6nDjOLo8cV5FWLM3bGNwNaF6WLsgOk0KFyDx8dLMsINMYqBcKWYL5XZQZa8c5AXS56fWfwaKDILPmMzlX_vOpov1c7kPvdJ9-SYmH4NwiJOE43LJlfTu7THF3ibEAAsZ_JQImQJ8Bg7QUW4-vLvhZM4Doa3GosIDRccSaf-awgGH48QohTouMw_UdMEOzI5aPFJhrSYv3Vjfzdf6JlZY3DTVwmaLoqJed5o4zCzazxcKPXzfb3nZN5z0xjJS7oN_IJzo_PsARccUFOaxNkV5ujivjsz_cTT9JOeBhJAkYPTjGRrWm0fOQU_EDlPfUCgy7hVwMdGZgL5onQ8-YFwpbnGhll-Bl0_M550JIpKzpbWw_hTVc9Z_i10pJlCrP0FPxRNHtnhZIEkgbyZWqct4WrfrhcRPhi_y2HyaePhpeT3NYsh1cPZcfukKeAzEYFE712ZB2CsERA_DH72DtQmq9at26EVmFvzCyfFzl_B8IJB1Ys7my1IZwY3nZE1xdnovD-dNFMklqLAhhj46UqWWRjF8m-lA-8so0oeDVYdu51kqEP8YCR4pOBWFEIQELanpR4B1Tz0uKi5KooXqrBjeSksdv0LCpYCJ_bkMmxlca66u9AreLl91V6BcOvRSWWeMG_ykvOPJYsHtQBVneZa6x

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2B3D 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021070101.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://nex-software.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://nex-software.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Thu, 08 Jul 2021 09:58:44 GMT
expires: Fri, 08 Jul 2022 09:58:44 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2F6D 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstIgVtQCq-_PNSVlO45iECt8s-aaooAdO5QH46QXhYzshY4j-lorfAxm1C-pGbPmSmkn0PBhDyWTiCCSaxRc8s3E8RweHCFg-pcxWOjQDNy8a4K865ZdF7MDNE9aw&sai=AMfl-YQAXnvRpr_BzwzziiSCT6keSfRF6V9xKJNleJDDUeB2vw1_SvHtQKfvnDCCBRgGj5HNa6IfrAwRLlVTXRS3oFelk5ZRezeDIIXuNksQS-i1d_KEiW4u1FFB0CmAd9s&sig=Cg0ArKJSzJsqmmr5ffvOEAE&cid=CAASFeRolJWlo3IDMwHsCvCWc6KkdptZEg&id=lidar2&mcvt=1088&p=1084,1382,1124,1423&mtos=1088,1088,1088,1088,1088&tos=1088,0,0,0,0&v=20210707&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1612028736&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1625738325057&dlt=8&rpt=0&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CC56 42 B
64 B 42ms
41ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv8jzN_idf6U4vVLWtELMhQsv-KmYCyuPAZBWgv2w2QWjPZk8nG4ZB92ALovMnYh-V1IoN3yidZKJr5J1bFR3NUZItq7i4eOoAKS4j1M0rzxgsc&sai=AMfl-YQ8HTCJfxDSbKhznJ4-absporHNLYUFZ_qf9GAPpMtS0QMDthjzNXJuuGKP9umvUs4i5wEascILH73JHo5IOfm7ja2i3R_ifDV1fUO01I0CFz6vvDIT2mJtIiB5fFE&sig=Cg0ArKJSzCe72NrQ--PkEAE&cid=CAASFeRoF-IlwsHP9-gicMtgDnK4HQ2UzA&id=lidar2&mcvt=1029&p=1110,315,1200,1285&mtos=1029,1029,1029,1029,1029&tos=1029,0,0,0,0&v=20210707&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1675753954&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1625738324686&dlt=39&rpt=38&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2BFB 499 B
336 B 20ms
18ms Document
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCNZxCDtmkYl82WrwEwAQ&v=APEucNWBugKxcIBsfQpH3_kwI1kQ8OMBrF04UUavm07stLbemnodfQbj63Moc1rcCiKpuqzGDoipmH2YyLm8yMEvpUbynX7DOEst9giQG6zYlSGE4msNuk2yLyDR_FDaxE3V0ITA0-FbNDCGUQ2eCRtxdFNoBYHso9ZumkYdGJ0f7Hswftkfb1o20sIjnDnCDgvvTWuC6QIs_JsuxtSCucuZmmPK40ZmUQ

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

583eda12fed77c078f7391866e53eedd80aec5b9b178a3537a3c4c3b09575485

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJCNZxCDtmkYl82WrwEwAQ&v=APEucNWBugKxcIBsfQpH3_kwI1kQ8OMBrF04UUavm07stLbemnodfQbj63Moc1rcCiKpuqzGDoipmH2YyLm8yMEvpUbynX7DOEst9giQG6zYlSGE4msNuk2yLyDR_FDaxE3V0ITA0-FbNDCGUQ2eCRtxdFNoBYHso9ZumkYdGJ0f7Hswftkfb1o20sIjnDnCDgvvTWuC6QIs_JsuxtSCucuZmmPK40ZmUQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmR6nCKEKOph8xG8hLclUx-VfFl5Fyzotmw-EX7ErQt8BWIdoDH4xac5O1XwAQ; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 08 Jul 2021 09:58:46 GMT
server: cafe
cache-control: private
content-length: 313
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 08 Jul 2021 09:58:46 GMT

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2B3D 58 KB
24 KB 40ms
37ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DWG5O2GRQgPIL48aGtUf3cEgItWOmljolflwvtiuQhRq1ieIVHdP2iHbi5T3TUNIOKVH9AF-z_9eRyl5q64puc9l_JBy9dJl6jMZvVwCRnOzubK7b33_ALseODBj68GVJfjVd5R0a53YUp0MBwCbxcwerEGg&dbm_d=AKAmf-CPf0VABHBGiw0ICHaaOTNMd0n_TsooVRHq_O6abTLbQPBCJiD14ngGY7_rdKMf0cy6NiJo_fSMIyLTcz7zUOE1lBw_meOIAxQ3h3iWPJtC5BYwmyU5M_8zVvo5UVPLHIfvqyn2V5slYgAuR8EchYRAfkS3xArRZNJo-9y3APkB0_jzDNsYIi2WbZ_g14jizbGdKUghKS_No4JYcuwX9gifZMXYppkBh8P-UGst0JCSetmodjDSMyfLluzQutG-RM06EBmFNVEKxU_0rNOVXExgKGodG9Qt4739-ri2IAFnfMrVl-dq6NGqbBK9RAmI2AYVSirC-aq06OmRXrfCZBeNPMQADhubonpSniue3lT8pmObzyS1rBlk1-8U71hkLq_bPp_Pmd1SpNMec7cwrrU8J2FLtio4y68qFZguMWRlMQ57n1ScfHGvrXR6NdLvUzzkRthnPOA18CPMvbs9hRyygWO0T7lLvAj159cJs07IbEqstXhMWp9-vmBwZFJ41hWpzq0fSSxdWb5eaUuKPfSw0l9J4VmGiU_tGx1BqikN_H3RqEl8hfXnVu7b0oH3oXqc6quFAgVMSaO7C7jaxw4MnGwdKmVIlv4AIBcuVoz2wsLi3tF_EC-Rd32BiFUlRCHItUgMhzx-sCVqPptWaVLZkx3vBjbcF3I-XprfgP2MD668c1EJgV1vUdGSlY0HpKG_X85_ZgB4J-0vZvO4kokPvH05k1Zn1HxfiDYjsYk38Nlnb12UNA5QQZqqBAfTUnsVmNEn_NQaja5m53ZnwVChdqR1SBEHO_KTfLMY_Gn20uOhAvVG3fnyLmmA0PDg7D_Xl3gEsUXR2WM4wYn89xNRKrVzwZdgQstpvqS4fjKLtkhOQtEM3km9Fz6T86TMChaAosuDXSdjNoOfqa8IRc_Rl5qezougb4vp44vgXtm96fGUiJXbhTdvOANfHYSRrfzhdw_VLSfZYFQBOVMjhtJbpLewe7XF0PYxbNs8jVsFcUYT2R9mDyWGMGyBDdZHgT8gG2-sZ-RICCTfyt0Ws65xRtfRjUqgpcP814IaHSQ1hXjWjSwJP8tYS7IEiuC3ylfg9T6_7bRVhcUqpTDOlo78aVg4IhJCLcpwI81CwkCZct05jCiD7ulFL_rV9jHvfkPJNyT07eVkr8FL6l1svhfIK4ulkwQpDmB-8LX_W985gM4x7sUQfvuy5VogLQtxSo8tVZK4tFdEU0bgYcw7MvofDhtA9iQcYMCJg08nWWGhIQBVdQSr8tY2D5Y9Lrkil2IxWInCp260PffcNEjQZVz1gc0DMVtDhrUadEo-N5B5clE2L9rahIFjX1_Tif9tcZArqz7bHUbxqdMsS1S-sH4yeb8JDEDWp7mI-6VdxlZ1H3S0SiBG9k0ibhBR5_J3l6qSDFBMboWrnFAxYKocCD_UduniRtafcPYr4KqNQkF6OtLA_JFhjsMLGUUhAv5SB_o_ms1_S1OEF1srDPDDnFFC0-W8F1XzinQKlf4POF0dcC1Fsx42iKmaWp7ekzGTTyhcMcx55RGFu_3nAKCPTXCV9XLQHU93686cU6YOXxtFRcRwUqoOzaUAiQp_hV40lHWOYo5FMpr5NIusx-P_BR8mGrEJGyebpJf86RrehR2rRWhX-GPDzoRXQ6upUgOB14xXjdX2ct10Otnllf4CRLMoEs7LB0EYbj_fR_0JKldGdm-gVu9gZcKZqXtKomiyR-lwLZtsmUzPP-4NrnRIUFbKaXV1-ko2baPcs887CO-xn6bTbw9druaGrYK-EB8D9x3DJYxoK6N6oPL5HQ_rMO8mHweCtf5GPWdl24BO2O6wA0tI2V9tn5J14EaKvgsfzLYLb6682rqWwVgc0mlqJTEolsZVWbR4Ws2F1c-SWDTXCn6vs2MwPi_XBKSDbJEWfE02ZucC3Bc6ckF-u5NPAxS-5iaMSAb282tc8SHDOSbs5DIvCQMkROkRXpkzZm-lk9ORkO0yi_SNANvUQ3kIImXaIOt7R7FgyXeaIQ-D3e-V6rXEHlEEd7j5y_3jRjE9-R4E-M4-hufih5ghSET8sj5lDgmD3xyprEamUUs-k10sDD9zTtyzeMSfSCUCAyjjQrkqHC8_TED5qx5o5tJQnT1RtahUY7p9EVlMglBi2pmkEuApPjr-7scyJypaqmEXExUHHe4YT1W7spyE6yb-Hf17pXtpxR-kIyDZ4erXAiIfq-j6yVq4stQMe4i57duUZHqtNjCNHtf5qPZY0HiEU9a_FiD3PNxtiQcS6f4XHQrGPv0T6UySPFjYC-i-YAU50gthl_1gs910dH-UePie9uBNuwXV2nbqgTKsONtzMWXn24zABHVIJU3drJH-O87N06e8tbSfbiZD4BY85VrH-TIP-EUngGddtdgdxzfh5Nxnvv991wF--QZLI32LOgeYhbRliXRRVhf5zzfyWNgc1YMj1u34uHgLKnASjEqM6rlP906kQ9FZS5x1jPKgzkHy8jw60wboeT1JgMjMkbv1KdVLcCRerqf9DMObCiwveWz2dVdH9WnOhi_GoLj732-t_whyZ9DdKU9rs-ljwUXBO7jCj3mrP0ncM0jaiwlDXBSKklYUeG4Gc69mYuHvktMjWpHWjykLyVowlVS4nmxtx2onHPQVI-45dhIIhKQ97zbqZhzgB3Q09dkyD3-1gIoWmkKcxkFybmX82sA8rZBa2hudchRQbBO9PRQfrur78jePJGEq15L8ihMzIuEV6w6RYx9BrpW_BM8Ayh5O68HnNZviRcBE5pTs8zh3qLndkBAlddOXQANBlNPUDiTEnOVKrbi5OeD6QBkD5J5U5TS1HX3mFmFYmPbAU3PbKr8ljvszYl_KLfXvLntxOgdv4tpJoq867ZD7iCkF8WO-iT3yTo7bukS7uwlSTI2egRd0KiXJWRBbBEwDeo9ijbS_y4vKwXmQuWlLXPQSZARI7j7mwNsjLA_T0Ol1CBX784AlkZASRvdX6AOQrmhkChN78rErvnt6UDPYFUQz8GMmCOLB_DZRc60pnTJfI1rfHyBRtMDj0ihJZK1S3pocG2_zwYSA1yZFtPn_u5oFqI9IYem3ErjnDBPXABTs6MexYfTivLCiLjhVcmhsB41T97seum6w8x_pihJ5&cid=CAASFeRoEfdiOhOv2n8yzpwpzOFckuk3_A&rfl=1%2Chttps%253A%252F%252Fnex-software.com%252F%240

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

06bcad5ed0098825cb73320e3dd48542cdca37dd30e1bfe6a521c420324ec32c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:46 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24480
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2B3D 42 B
63 B 41ms
38ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CnPDMAvWO9-lhYb7TPqyX8ApAhNiE2GiSSwUmg7UG9zH004UgG1VrnaJbFyJLxZL_z45KPommEvuYmQT9Ve5OGMhgU6vzZfFn_Zo2Z_GUoTLbXY1w

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 2B3D 3 KB
1 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/window_focus_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 243
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1385
x-xss-protection: 0
server: cafe
etag: 10711834930267210186
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:54:43 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2B3D 123 KB
37 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28a030a77bcecc0621b938dc08610e4c1fa0e131507a2dbd0c8007960d269253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:46 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1625657928851490"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37883
x-xss-protection: 0
expires: Thu, 08 Jul 2021 09:58:46 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/ Frame 2B3D 14 KB
6 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210624/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a029ad1de22249db15e4a05e5e168cf70b256ce05cdef7f7e7927c2df030f57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 134
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6207
x-xss-protection: 0
server: cafe
etag: 17140096307539089235
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:32 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 2B3D 0
0 15ms
13ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS_ZwfBLBASrPGFc47TgVEs_BQuZO2tKWycp4ks_0c35536HpDadCF6K-a6TIiAzISCfHMtEqj-q3AFTLlKoKiuf3is9w
Requested by: Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame CC56 16 B
233 B 75ms
75ms Fetch
application/json 34.249.16.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.16.73 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.19

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Jul 2021 09:58:46 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.19
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 112ms
32ms Preflight 34.249.16.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Server: 34.249.16.73 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-16-73.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 08 Jul 2021 09:58:46 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 2BFB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEF93zSKn6jqynifYNQKW1tc&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEF93zSKn6jqynifYNQKW1tc&google_cver=1&__user_check__=1&sync_id=15f1cc31-dfd3-11eb-b8de-1e8b65530306

43 B
549 B

18ms
18ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEF93zSKn6jqynifYNQKW1tc&google_cver=1&__user_check__=1&sync_id=15f1cc31-dfd3-11eb-b8de-1e8b65530306
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCNZxCDtmkYl82WrwEwAQ&v=APEucNWBugKxcIBsfQpH3_kwI1kQ8OMBrF04UUavm07stLbemnodfQbj63Moc1rcCiKpuqzGDoipmH2YyLm8yMEvpUbynX7DOEst9giQG6zYlSGE4msNuk2yLyDR_FDaxE3V0ITA0-FbNDCGUQ2eCRtxdFNoBYHso9ZumkYdGJ0f7Hswftkfb1o20sIjnDnCDgvvTWuC6QIs_JsuxtSCucuZmmPK40ZmUQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:46 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 144
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Thu, 08 Jul 2021 09:58:46 GMT
Server: nginx
Location: /partner?adv_id=7025&uid=CAESEF93zSKn6jqynifYNQKW1tc&google_cver=1&__user_check__=1&sync_id=15f1cc31-dfd3-11eb-b8de-1e8b65530306
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 107
Connection: keep-alive
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 2BFB
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MTVlZGRkY2EtZGZkMy0xMWViLTg2YzctMWFiMGFkOGQwMjA2

170 B
188 B

31ms
31ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MTVlZGRkY2EtZGZkMy0xMWViLTg2YzctMWFiMGFkOGQwMjA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCNZxCDtmkYl82WrwEwAQ&v=APEucNWBugKxcIBsfQpH3_kwI1kQ8OMBrF04UUavm07stLbemnodfQbj63Moc1rcCiKpuqzGDoipmH2YyLm8yMEvpUbynX7DOEst9giQG6zYlSGE4msNuk2yLyDR_FDaxE3V0ITA0-FbNDCGUQ2eCRtxdFNoBYHso9ZumkYdGJ0f7Hswftkfb1o20sIjnDnCDgvvTWuC6QIs_JsuxtSCucuZmmPK40ZmUQ

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Jul 2021 09:58:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 08 Jul 2021 09:58:46 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MTVlZGRkY2EtZGZkMy0xMWViLTg2YzctMWFiMGFkOGQwMjA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 85
Connection: keep-alive
Content-Length: 0

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 2BFB 0
446 B 21ms
6ms Image
text/plain 2a00:1288:80:800::7000
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~b04e41039133c73fafd60e0ed8cb49a70ecfb061&nwid=10000483131&sigv=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7000 Frankfurt am Main, Germany, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:46 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H3-29 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 2B3D 111 KB
38 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 05:26:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16360
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Jul 2021 05:26:06 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/ Frame 2B3D 8 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DWG5O2GRQgPIL48aGtUf3cEgItWOmljolflwvtiuQhRq1ieIVHdP2iHbi5T3TUNIOKVH9AF-z_9eRyl5q64puc9l_JBy9dJl6jMZvVwCRnOzubK7b33_ALseODBj68GVJfjVd5R0a53YUp0MBwCbxcwerEGg&dbm_d=AKAmf-CPf0VABHBGiw0ICHaaOTNMd0n_TsooVRHq_O6abTLbQPBCJiD14ngGY7_rdKMf0cy6NiJo_fSMIyLTcz7zUOE1lBw_meOIAxQ3h3iWPJtC5BYwmyU5M_8zVvo5UVPLHIfvqyn2V5slYgAuR8EchYRAfkS3xArRZNJo-9y3APkB0_jzDNsYIi2WbZ_g14jizbGdKUghKS_No4JYcuwX9gifZMXYppkBh8P-UGst0JCSetmodjDSMyfLluzQutG-RM06EBmFNVEKxU_0rNOVXExgKGodG9Qt4739-ri2IAFnfMrVl-dq6NGqbBK9RAmI2AYVSirC-aq06OmRXrfCZBeNPMQADhubonpSniue3lT8pmObzyS1rBlk1-8U71hkLq_bPp_Pmd1SpNMec7cwrrU8J2FLtio4y68qFZguMWRlMQ57n1ScfHGvrXR6NdLvUzzkRthnPOA18CPMvbs9hRyygWO0T7lLvAj159cJs07IbEqstXhMWp9-vmBwZFJ41hWpzq0fSSxdWb5eaUuKPfSw0l9J4VmGiU_tGx1BqikN_H3RqEl8hfXnVu7b0oH3oXqc6quFAgVMSaO7C7jaxw4MnGwdKmVIlv4AIBcuVoz2wsLi3tF_EC-Rd32BiFUlRCHItUgMhzx-sCVqPptWaVLZkx3vBjbcF3I-XprfgP2MD668c1EJgV1vUdGSlY0HpKG_X85_ZgB4J-0vZvO4kokPvH05k1Zn1HxfiDYjsYk38Nlnb12UNA5QQZqqBAfTUnsVmNEn_NQaja5m53ZnwVChdqR1SBEHO_KTfLMY_Gn20uOhAvVG3fnyLmmA0PDg7D_Xl3gEsUXR2WM4wYn89xNRKrVzwZdgQstpvqS4fjKLtkhOQtEM3km9Fz6T86TMChaAosuDXSdjNoOfqa8IRc_Rl5qezougb4vp44vgXtm96fGUiJXbhTdvOANfHYSRrfzhdw_VLSfZYFQBOVMjhtJbpLewe7XF0PYxbNs8jVsFcUYT2R9mDyWGMGyBDdZHgT8gG2-sZ-RICCTfyt0Ws65xRtfRjUqgpcP814IaHSQ1hXjWjSwJP8tYS7IEiuC3ylfg9T6_7bRVhcUqpTDOlo78aVg4IhJCLcpwI81CwkCZct05jCiD7ulFL_rV9jHvfkPJNyT07eVkr8FL6l1svhfIK4ulkwQpDmB-8LX_W985gM4x7sUQfvuy5VogLQtxSo8tVZK4tFdEU0bgYcw7MvofDhtA9iQcYMCJg08nWWGhIQBVdQSr8tY2D5Y9Lrkil2IxWInCp260PffcNEjQZVz1gc0DMVtDhrUadEo-N5B5clE2L9rahIFjX1_Tif9tcZArqz7bHUbxqdMsS1S-sH4yeb8JDEDWp7mI-6VdxlZ1H3S0SiBG9k0ibhBR5_J3l6qSDFBMboWrnFAxYKocCD_UduniRtafcPYr4KqNQkF6OtLA_JFhjsMLGUUhAv5SB_o_ms1_S1OEF1srDPDDnFFC0-W8F1XzinQKlf4POF0dcC1Fsx42iKmaWp7ekzGTTyhcMcx55RGFu_3nAKCPTXCV9XLQHU93686cU6YOXxtFRcRwUqoOzaUAiQp_hV40lHWOYo5FMpr5NIusx-P_BR8mGrEJGyebpJf86RrehR2rRWhX-GPDzoRXQ6upUgOB14xXjdX2ct10Otnllf4CRLMoEs7LB0EYbj_fR_0JKldGdm-gVu9gZcKZqXtKomiyR-lwLZtsmUzPP-4NrnRIUFbKaXV1-ko2baPcs887CO-xn6bTbw9druaGrYK-EB8D9x3DJYxoK6N6oPL5HQ_rMO8mHweCtf5GPWdl24BO2O6wA0tI2V9tn5J14EaKvgsfzLYLb6682rqWwVgc0mlqJTEolsZVWbR4Ws2F1c-SWDTXCn6vs2MwPi_XBKSDbJEWfE02ZucC3Bc6ckF-u5NPAxS-5iaMSAb282tc8SHDOSbs5DIvCQMkROkRXpkzZm-lk9ORkO0yi_SNANvUQ3kIImXaIOt7R7FgyXeaIQ-D3e-V6rXEHlEEd7j5y_3jRjE9-R4E-M4-hufih5ghSET8sj5lDgmD3xyprEamUUs-k10sDD9zTtyzeMSfSCUCAyjjQrkqHC8_TED5qx5o5tJQnT1RtahUY7p9EVlMglBi2pmkEuApPjr-7scyJypaqmEXExUHHe4YT1W7spyE6yb-Hf17pXtpxR-kIyDZ4erXAiIfq-j6yVq4stQMe4i57duUZHqtNjCNHtf5qPZY0HiEU9a_FiD3PNxtiQcS6f4XHQrGPv0T6UySPFjYC-i-YAU50gthl_1gs910dH-UePie9uBNuwXV2nbqgTKsONtzMWXn24zABHVIJU3drJH-O87N06e8tbSfbiZD4BY85VrH-TIP-EUngGddtdgdxzfh5Nxnvv991wF--QZLI32LOgeYhbRliXRRVhf5zzfyWNgc1YMj1u34uHgLKnASjEqM6rlP906kQ9FZS5x1jPKgzkHy8jw60wboeT1JgMjMkbv1KdVLcCRerqf9DMObCiwveWz2dVdH9WnOhi_GoLj732-t_whyZ9DdKU9rs-ljwUXBO7jCj3mrP0ncM0jaiwlDXBSKklYUeG4Gc69mYuHvktMjWpHWjykLyVowlVS4nmxtx2onHPQVI-45dhIIhKQ97zbqZhzgB3Q09dkyD3-1gIoWmkKcxkFybmX82sA8rZBa2hudchRQbBO9PRQfrur78jePJGEq15L8ihMzIuEV6w6RYx9BrpW_BM8Ayh5O68HnNZviRcBE5pTs8zh3qLndkBAlddOXQANBlNPUDiTEnOVKrbi5OeD6QBkD5J5U5TS1HX3mFmFYmPbAU3PbKr8ljvszYl_KLfXvLntxOgdv4tpJoq867ZD7iCkF8WO-iT3yTo7bukS7uwlSTI2egRd0KiXJWRBbBEwDeo9ijbS_y4vKwXmQuWlLXPQSZARI7j7mwNsjLA_T0Ol1CBX784AlkZASRvdX6AOQrmhkChN78rErvnt6UDPYFUQz8GMmCOLB_DZRc60pnTJfI1rfHyBRtMDj0ihJZK1S3pocG2_zwYSA1yZFtPn_u5oFqI9IYem3ErjnDBPXABTs6MexYfTivLCiLjhVcmhsB41T97seum6w8x_pihJ5&cid=CAASFeRoEfdiOhOv2n8yzpwpzOFckuk3_A&rfl=1%2Chttps%253A%252F%252Fnex-software.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:50:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 476
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:50:50 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/ Frame 2B3D 22 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210624/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

598a6c545ec2b27cf7388041cb424a0f4ecc1884dc06e37781b927fbd3cd58fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:56:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8676
x-xss-protection: 0
server: cafe
etag: 11618055936852703379
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 22 Jul 2021 09:56:53 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2B3D 41 KB
15 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com
URL: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 07:31:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8830
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 08 Jul 2022 07:31:36 GMT

GET
DATA 200
OK truncated
/ Frame 2B3D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 565588c5203bdcc43b89e7c0164fa5dc12bde2930f45a660184753a994b79344

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 23F8 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Thu, 08 Jul 2021 07:32:57 GMT
expires: Fri, 08 Jul 2022 07:32:57 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 8749
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 index.html Show response
s0.2mdn.net/5762573/1625493399198/ Frame B63F 82 KB
16 KB 7ms
7ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/5762573/1625493399198/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca48874997c0a6d6e044d16d8045684795f1e31d6c54dfbf2afbc15d9ef7b1ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /5762573/1625493399198/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 16653
date: Thu, 08 Jul 2021 08:35:12 GMT
expires: Fri, 09 Jul 2021 08:35:12 GMT
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 5014
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2B3D 0
24 B 64ms
64ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuSFxsuUsf7vWXbLcJplhA7EU4gtsy0aG11AHlns8cV_CiXAb5ixLWizWD5zHbakVZXlU51V2G0VDAHlAbs_0uKhDHbnh3hWUmxoCDZL4MMfZA2viVhS_rtGwqo4pdLlpXjL1-iFW9HVxFmNSCuVM9aW0i1ahcFFdoI8G6lYDOADuHd6WM2jMCAZAAbQtcctFwj3-P7WPczfRDLkdFjnvYalxobTRjH6Xiw-vzM0_e2DXCnIiJElZ3q4pwi_v0BW5vWcq8MtwJDvRGGR8ViUQRqhgzCZPQgVQ5ZpAq98LNaA1KjzbN-kx-pw41nsSNwSXUXacWYIPhi2e5_m2JMOYKZxzrdYarLCGiw_pPJ_BKWOovybMbBB0QS1a4QnZVR-rfaUUiElMYBKlP58H8DClZiI1zrMGyvp7CIkikdnPerAI-_GUW0ESSojgsrFPJtFQkXp0PP5mWT2UsYsCY8s8i76Gv5Eqtp6yBnuQ7C2Rqna3z1biss2Sn116dMzu4Bu07ozCC4iTwNGFzbvxYFvx3NO2cmiY_jEw9A4JTTFw6IvoYOTSlyX5ZzoA4hZf44CXq_gOvOfB40lNo-wNkXJc31DZvQF5UN4S5a_pXNvXMB-G8lC1RLjM9xoz0-OmT6f1bymNzodJ5XHYFmCUdDFuRowdDNwrBt5ON3a55vZ3Fd5ko8d4r3gHl3aeZZeZMSCX0sDD_h5l9vYrX4V0i8XVm3P6X-Fu5SVVC86vEUp5TBbNSt-yqJTmzomp23TCPGDgAdj-uK4XdRnrZQdlTITLYNYKpzsWjkt-zURr6QJQAYPPmpeqxmlEPSc1LtainPh3gVFnNTgPOqZyAxkHCAj-o6J9Ol5bcIM8vC1lIRh2WWvV38vbeY6o-YXZ0WtnSHoh_Dg3-7QP8cCmmIIcHLB2hXzrC6gByU4rB-iOGZhk-06vH_aOZEGSwvii5gMQuzFp6KfTsT039YqNejt3b0MvnXk1cTxbUj3kNW2EJDyW3D5KAzaHFzhO9GMX-miRiPyd41heu6yfkpgReFB7NCpRkpXfI_ShNqcugbB3n9pWf40Yms4gK3yD40oT6qBuQTdlm2ZPRb0Y7-Gl9EeG7wX5t60dmvopPecKWTW29SCbM931zMbw9PPI74wCzM9xzvdwcjoRkF8BGK15ywEvHookUYkAi1rV0aEkHKJteaVw&sai=AMfl-YTMglRT72bZmmDItUXc6hZCvH8KivuX5RzdRl6JjkAIi3yMmPhcoDuIBEGnezhfQK8lAZ_8VjYcOUfakzPfjehjutRag_XKzH7CnLihFcJzOsIf6ia3yzyOA9CsEP3idc-8_5AoFaxLFkgQ-Hcs2pijFAWCxAELi8ltXBk&sig=Cg0ArKJSzIa0RJ3IxjH1EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=44&cbvp=1&cstd=43&cisv=r20210624.73774&adurl=

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4ad460b7ea1e556401f4e8205d83507b.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 08 Jul 2021 09:58:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js Show response
pagead2.googlesyndication.com/bg/ Frame 23F8 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/mGzIkP9MbilhhXayH-4FXVj5Hth0Auc0RFP8Od1UZbs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

986cc890ff4c6e29618576b21fee055d58f91ed87402e7344453fc39dd5465bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:43:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 928
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5744
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 08 Jul 2022 09:43:18 GMT

GET
H3-29 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame B63F 57 KB
23 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:58:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 08 Jul 2021 09:58:46 GMT

GET
H/1.1 200
OK viewability Show response
hal90006.redintelligence.net/ Frame C0EA 0
150 B 93ms
32ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90006.redintelligence.net/viewability?s=48176700064878800719610011649006&a=3b0227d5&vb=v
Requested by: Host: hal90006.redintelligence.net
URL: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Lingenfeld, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal90006.redintelligence.net/request_content.php?s=48176700064878800719610011649006&a=e4ca2aaa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 08 Jul 2021 09:58:46 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 imagesxqkq4mihc7kqqavopjdi.jpg
s0.2mdn.net/5762573/1625493399198/ Frame B63F 1 KB
1 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/imagesxqkq4mihc7kqqavopjdi.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57094f413279468aec48e27575d858ea7979a867788ed1120f6192e2fe7140ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 08:35:13 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 5013
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1083
x-xss-protection: 0
expires: Fri, 09 Jul 2021 08:35:13 GMT

GET
H3-29 200 0c0038f2551e64f681b79220206f2b3b.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 253 B
280 B 8ms
7ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/0c0038f2551e64f681b79220206f2b3b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcde6a369b021ac90be3fa93ee878276a1730bdd9401391ce0f3c8f0c894df27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 20:01:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 50251
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0
expires: Thu, 08 Jul 2021 20:01:15 GMT

GET
H3-29 200 34690739a47d11ff1e601e09692a774d.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 253 B
280 B 9ms
8ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/34690739a47d11ff1e601e09692a774d.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcde6a369b021ac90be3fa93ee878276a1730bdd9401391ce0f3c8f0c894df27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 20:01:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 50251
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0
expires: Thu, 08 Jul 2021 20:01:15 GMT

GET
H3-29 200 02bb9aa9bc270bdc3f27ac52aa067bd2.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 253 B
280 B 9ms
8ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/02bb9aa9bc270bdc3f27ac52aa067bd2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bcde6a369b021ac90be3fa93ee878276a1730bdd9401391ce0f3c8f0c894df27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 08:35:13 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 5013
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 253
x-xss-protection: 0
expires: Fri, 09 Jul 2021 08:35:13 GMT

GET
H3-29 200 b9ba09273be1711b8b25cc615ac386d6.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 50 KB
50 KB 8ms
7ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/b9ba09273be1711b8b25cc615ac386d6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32c46f8a8406f194bc9c05d577f171155b0849f625578d7b5ed7c7b90603628c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 06:30:36 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 12490
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51001
x-xss-protection: 0
expires: Fri, 09 Jul 2021 06:30:36 GMT

GET
H3-29 200 86f831e57eb4ab8b5e20fdfcd5d3e7aa.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 249 B
276 B 6ms
6ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/86f831e57eb4ab8b5e20fdfcd5d3e7aa.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de9f2d2ccf182160c791086793b0ab920138b1b724524937ec5876bcd4eb24e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 20:01:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 50251
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
expires: Thu, 08 Jul 2021 20:01:15 GMT

GET
H3-29 200 d2c44b3b3916187a66af173dee764b9f.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 249 B
276 B 14ms
11ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/d2c44b3b3916187a66af173dee764b9f.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de9f2d2ccf182160c791086793b0ab920138b1b724524937ec5876bcd4eb24e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 20:01:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 50251
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
expires: Thu, 08 Jul 2021 20:01:15 GMT

GET
H3-29 200 imagesbfbmmuwohnzwkdkly8hk.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/imagesbfbmmuwohnzwkdkly8hk.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b6937b543330ca4379d705795cc3d7992134d4745294049c022d3768bc53b19e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:02:12 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 3394
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2415
x-xss-protection: 0
expires: Fri, 09 Jul 2021 09:02:12 GMT

GET
H3-29 200 43edd9c5a83f9e2e870b47ca28d9c11b.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 50 KB
50 KB 13ms
11ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/43edd9c5a83f9e2e870b47ca28d9c11b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc31c8b0e2312dc9cc40ae380e9a7dcb423e4f9abf62ae72293697be17cf8d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 20:01:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 50251
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51009
x-xss-protection: 0
expires: Thu, 08 Jul 2021 20:01:15 GMT

GET
H3-29 200 fc788fd8f2099aa7026c990aca7be4d8.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 60 KB
60 KB 13ms
12ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/fc788fd8f2099aa7026c990aca7be4d8.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

087232e2389589682a7869df003dd5e2946f08e24f3b1284e40c960c023181ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Jul 2021 09:02:12 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 3394
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61875
x-xss-protection: 0
expires: Fri, 09 Jul 2021 09:02:12 GMT

GET
H3-29 200 10e04ae5e5c8daa79d9d6ce4fc8c3c7c.png
s0.2mdn.net/5762573/1625493399198/ Frame B63F 41 KB
41 KB 13ms
12ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/5762573/1625493399198/10e04ae5e5c8daa79d9d6ce4fc8c3c7c.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/5762573/1625493399198/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28deeb65eb5d74955b7883aa9900d75cae997f9ab38800b3f769a1fb4aee673d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/5762573/1625493399198/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Jul 2021 20:01:15 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Jul 2021 13:56:39 GMT
server: sffe
age: 50251
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42216
x-xss-protection: 0
expires: Thu, 08 Jul 2021 20:01:15 GMT

GET
DATA 200
OK truncated
/ Frame B63F 12 KB
12 KB Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19d3b716a605870bd79c5405a5fb264a2b64aea1211fcc144e5681cb74c49de2

Request headers

Origin: https://s0.2mdn.net
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: font/truetype;charset=utf-8

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2B3D 0
23 B 58ms
57ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: nex-software.com
URL: https://nex-software.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS