www.familyfriendpoems.com Open in urlscan Pro
173.203.184.140 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.familyfriendpoems.com/
Effective URL:
https://www.familyfriendpoems.com/
Submission Tags: falconsandbox
Submission: On February 13 via api (February 13th 2022, 2:20:48 am UTC) from US — Scanned from DE

Summary HTTP 171 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 34 IPs in 6 countries across 22 domains to perform 171 HTTP transactions. The main IP is 173.203.184.140, located in United States and belongs to RACKSPACE, US. The main domain is www.familyfriendpoems.com. The Cisco Umbrella rank of the primary domain is 226601.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 6th 2021. Valid for: a year.

This is the only time www.familyfriendpoems.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 20	173.203.184.140 173.203.184.140	27357 (RACKSPACE) (RACKSPACE)
3	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
37	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	23.37.38.181 23.37.38.181	16625 (AKAMAI-AS) (AKAMAI-AS)
3 7	37.252.173.27 37.252.173.27	29990 (ASN-APPNEX) (ASN-APPNEX)
4	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
9 12	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
6 12	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
12	2a00:1450:400... 2a00:1450:4001:800::2006	15169 (GOOGLE) (GOOGLE)
4	138.201.63.145 138.201.63.145	24940 (HETZNER-AS) (HETZNER-AS)
1 3	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
1 4	138.201.64.38 138.201.64.38	24940 (HETZNER-AS) (HETZNER-AS)
5	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2 2	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
2	46.236.13.147 46.236.13.147	12703 (PULSANT-AS) (PULSANT-AS)
1	54.76.176.197 54.76.176.197	16509 (AMAZON-02) (AMAZON-02)
1	104.111.239.217 104.111.239.217	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	52.48.8.1 52.48.8.1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:206... 2600:9000:206f:8c00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
5	54.149.146.0 54.149.146.0	16509 (AMAZON-02) (AMAZON-02)
1	143.204.215.49 143.204.215.49	16509 (AMAZON-02) (AMAZON-02)
2	3.248.87.88 3.248.87.88	16509 (AMAZON-02) (AMAZON-02)
171	34

20 173.203.184.140 (United States) 1 redirects

ASN27357 (RACKSPACE, US)
PTR: 643795-web3.familyfriendpoems.com

www.familyfriendpoems.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

feeds.feedburner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.38.181 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-38-181.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 37.252.173.27 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.186.66 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2.18.234.21 (Frankfurt am Main, Germany) 6 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:800::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.145 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.145.63.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.64.38 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.38.64.201.138.clients.your-server.de

hal900011.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.193.130 (France) 2 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.198.250.30 (Baienfurt, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.236.13.147 (United Kingdom)

ASN12703 (PULSANT-AS, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.76.176.197 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com

ad-server.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.239.217 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-217.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.48.8.1 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-8-1.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:206f:8c00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.149.146.0 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-146-0.us-west-2.compute.amazonaws.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-49.fra53.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.248.87.88 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-87-88.eu-west-1.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 92 a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 120	483 KB
36	doubleclick.net 10 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 159 stats.g.doubleclick.net — Cisco Umbrella Rank: 67 googleads.g.doubleclick.net — Cisco Umbrella Rank: 37 cm.g.doubleclick.net — Cisco Umbrella Rank: 175 ad.doubleclick.net — Cisco Umbrella Rank: 167 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 276 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 70120	310 KB
20	familyfriendpoems.com 1 redirects www.familyfriendpoems.com — Cisco Umbrella Rank: 226601	315 KB
13	casalemedia.com 6 redirects htlb.casalemedia.com — Cisco Umbrella Rank: 427 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 488	11 KB
12	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 246	1018 KB
9	adsafeprotected.com 1 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 671 static.adsafeprotected.com — Cisco Umbrella Rank: 502 dt.adsafeprotected.com — Cisco Umbrella Rank: 465	101 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 31122 hal900011.redintelligence.net — Cisco Umbrella Rank: 270322	60 KB
8	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 59	2 KB
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 146	211 KB
7	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 210	7 KB
4	google.de www.google.de — Cisco Umbrella Rank: 6342 adservice.google.de — Cisco Umbrella Rank: 9027	2 KB
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 19741 api.webgains.io — Cisco Umbrella Rank: 54493	51 KB
3	gstatic.com www.gstatic.com	13 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	2 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
2	webgains.com track.webgains.com — Cisco Umbrella Rank: 41085	2 KB
2	medialead.de 2 redirects pv.medialead.de — Cisco Umbrella Rank: 46456	1 KB
1	awin1.com www.awin1.com — Cisco Umbrella Rank: 14416	702 B
1	ad-server.eu ad-server.eu — Cisco Umbrella Rank: 70137	312 B
1	media01.eu pb.media01.eu — Cisco Umbrella Rank: 65528	607 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 741	424 B
1	feedburner.com feeds.feedburner.com — Cisco Umbrella Rank: 13436	2 KB
171	22

	Domain	Requested by
26	pagead2.googlesyndication.com	www.familyfriendpoems.com pagead2.googlesyndication.com a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com ad.doubleclick.net www.googletagservices.com
20	tpc.googlesyndication.com	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com pagead2.googlesyndication.com
20	www.familyfriendpoems.com	1 redirects www.familyfriendpoems.com
12	s0.2mdn.net	www.familyfriendpoems.com s0.2mdn.net
12	dsum-sec.casalemedia.com	6 redirects googleads.g.doubleclick.net
12	cm.g.doubleclick.net	9 redirects googleads.g.doubleclick.net
11	googleads.g.doubleclick.net	pagead2.googlesyndication.com a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com www.familyfriendpoems.com googleads.g.doubleclick.net
7	www.googletagservices.com	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com s0.2mdn.net
7	ib.adnxs.com	3 redirects www.familyfriendpoems.com googleads.g.doubleclick.net
5	dt.adsafeprotected.com	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
5	googleads4.g.doubleclick.net	www.familyfriendpoems.com
4	hal900011.redintelligence.net	1 redirects a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com hal900011.redintelligence.net
4	hal9000.redintelligence.net	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com hal900011.redintelligence.net
4	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net 5994599.fls.doubleclick.net
4	www.google.com	1 redirects www.familyfriendpoems.com a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com tpc.googlesyndication.com
4	securepubads.g.doubleclick.net	www.familyfriendpoems.com securepubads.g.doubleclick.net
3	www.gstatic.com	googleads.g.doubleclick.net
3	fonts.googleapis.com	googleads.g.doubleclick.net hal900011.redintelligence.net
3	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
3	www.google-analytics.com	www.familyfriendpoems.com www.google-analytics.com
2	api.webgains.io	analytics.webgains.io
2	static.adsafeprotected.com	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
2	fw.adsafeprotected.com	1 redirects www.familyfriendpoems.com
2	5994599.fls.doubleclick.net	1 redirects www.familyfriendpoems.com
2	track.webgains.com	www.familyfriendpoems.com a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
2	pv.medialead.de	2 redirects
1	analytics.webgains.io	track.webgains.com
1	www.awin1.com	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
1	ad-server.eu	a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
1	pb.media01.eu	hal900011.redintelligence.net
1	ad.doubleclick.net	www.googletagservices.com
1	htlb.casalemedia.com	www.familyfriendpoems.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.google.de	www.familyfriendpoems.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	feeds.feedburner.com	www.familyfriendpoems.com
171	37

This site contains links to these domains. Also see Links.

Domain
forums.familyfriendpoems.com
play.google.com
feedburner.google.com
www.facebook.com
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
familyfriendpoems.com Sectigo RSA Domain Validation Secure Server CA	`2021-04-06` - `2022-05-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
misc.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
redintelligence.net R3	`2022-01-27` - `2022-04-27`	3 months	crt.sh
*.media01.eu RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-05-27` - `2022-05-27`	a year	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-20` - `2022-06-20`	a year	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
fw.adsafeprotected.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
static.adsafeprotected.com Amazon	`2021-09-05` - `2022-10-04`	a year	crt.sh
dt.adsafeprotected.com Amazon	`2021-11-19` - `2022-12-18`	a year	crt.sh
*.webgains.io Amazon	`2022-02-10` - `2023-03-11`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://www.familyfriendpoems.com/
Frame ID: E5F71C1FE47EB7D19735FDE0B72ED081
Requests: 45 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20190131/zrt_lookup.html
Frame ID: F83991A989313C89B2CCEB278B832D80
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8221325168996967&output=html&adk=3046330955&adf=2044148826&lmt=1644718842&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644718842639&bpp=2&bdt=479&idt=142&shv=r20220209&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=621288975108&frm=20&pv=2&ga_vid=238457712.1644718842&ga_sid=1644718843&ga_hid=272553796&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064037%2C31064772&oid=2&pvsid=1931289875523854&pem=877&tmod=294462064&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=154
Frame ID: D42F14491A7CAB90392132EF15B9EE8B
Requests: 1 HTTP requests in this frame

Frame: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: D39FC620487F6E209ECB917C9C2E9784
Requests: 1 HTTP requests in this frame

Frame: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: FF2014EACE90FFE621DBEB2030F6D342
Requests: 14 HTTP requests in this frame

Frame: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 6E616AB84FE6AD154D7D5AAB1C0B4C86
Requests: 18 HTTP requests in this frame

Frame: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 1A82C69E3EE6E1644206490AAEA1CE8F
Requests: 26 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Frame ID: 2850F38F1E89F7D5C4424E92147CD3FE
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ4KTvAhjZv9K7ATAB&v=APEucNX25suH0TnKLvFNUuJP_0adZpCtCw8rAOd8EgOqhI0Bg4qgngNk90zUISH6UIbOQCjzWv4yq4d1sMBiPre86c6JVRiJna6wAuRxsitHJi20m8AyxJ703EU3Pf3jBrp38sVDQq1b06yRBtYF2yKFFNVJ3qeQGiYkSk-SY1oeVZGV0ltOI4c
Frame ID: 85DCEA29C2410FD40C5A432832C87A69
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNUSNUuZrUJepXyKgiN2E5t23SJW4JgTViHd0DEIt-3zsXPpI7s1NIHg_n69jGcKv2spaHxzgoqKhQeBHEDa9lHyDWShUf9pHuDqEPXIjWY9BcDFWWo47iDp62X_V-aVyTTIYTB5ceV8eOr8j92B2fkOheynCfBRlp9naRifF86VCf6tmRM
Frame ID: 5D292DFBC16C80571BDC12F5E8F07B85
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ9YDEhgIYnOrUwQEwAQ&v=APEucNXo1bNzcbgQaVfZ1K1s_hKqjXanDxoicU49nh-k0k1hvxHvsm0fq4gKO7WCz76QmVUjKoJr7y9u8cuS0xFOs5oc2J2aQj3zjvryiZnitLjYzzb5no7iFqxjjz7EJ8eBajVwV00LCAPVS4OxjUFD7nICg2bP6sF15TBuGBL3wnnPa_Ds9v8
Frame ID: 18C0CA0151C1C334A4B687B190DCC5CC
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: B5981018204F2DA5F208F8140C5789A7
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: F807A7C13D61F2A05BFE5647092BF46F
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: BE7C4FCC45A74D9DBE2CE2D17AF9985C
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: DD3E9805AE23D37AA35426848CC342BF
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B5F6B49678014391094DA41429994298
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js
Frame ID: D299513332770C24E81A9AD75838E107
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
Frame ID: DE8E425621A5EFBEC9D73A381BEA306C
Requests: 7 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89722800015453200710580011869011&actionid=981741&produktid=&dt_url=
Frame ID: 3C0CAED6A9339D98303A4BAEF97908CC
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637
Frame ID: EE41FBB69FA65E57CBB28788B7C7420E
Requests: 2 HTTP requests in this frame

Frame: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
Frame ID: 50B2A0E55E9923D09E92B2E7BDA771EC
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 044A6D5F2878D1707CB9C764B160C90C
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.html
Frame ID: 2A26D1EAE8F7750D0A5059C207680810
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: EF5329002D911F4E4080A669A6264CBE
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F743419A197335614B5261F5E3954B07
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 40D1174BC833DE3B48D21C3FD6ABA322
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Family Friend Poems - Heartfelt Popular Poems

Page URL History Show full URLs

http://www.familyfriendpoems.com/ HTTP 301
https://www.familyfriendpoems.com/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

Page Statistics

171
Requests

91 %
HTTPS

44 %
IPv6

22
Domains

37
Subdomains

34
IPs

6
Countries

2599 kB
Transfer

5657 kB
Size

26
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: http://forums.familyfriendpoems.com/
Title: FFP Poetry Forums

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.familyfriendpoems&referrer=utm_source%3DFFP%26utm_medium%3DPOD-signup%26utm_campaign%3DPOD-settings-screenshot

Search URL Search Domain Scan URL

URL: https://feedburner.google.com/fb/a/mailverify?uri=poem_of_the_week
Title: Poem of the Week

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.familyfriendpoems&referrer=utm_source%3DFFP%26utm_medium%3Dapp-install-banner%26utm_content%3Dbottom%26utm_campaign%3Dfootericon

Search URL Search Domain Scan URL

URL: https://www.facebook.com/familyfriendpoems

Search URL Search Domain Scan URL

URL: https://twitter.com/FamFriendPoems

Search URL Search Domain Scan URL

URL: https://www.instagram.com/familyfriendpoems

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.familyfriendpoems.com/ HTTP 301
https://www.familyfriendpoems.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1

Request Chain 73

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yghq.xG0B-h8s0nBZ2HzIAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2

Request Chain 74

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

Request Chain 75

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

Request Chain 76

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1

Request Chain 77

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yghq.xG0B-h8s0nBZ2HzIAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2

Request Chain 78

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

Request Chain 79

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

Request Chain 80

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1

Request Chain 81

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yghq.xG0B-h8s0nBZ2HzIAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2

Request Chain 82

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

Request Chain 83

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

Request Chain 105

https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ancestorOrigins=https%3A%2F%2Fwww.familyfriendpoems.com&random=4156681561085&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ancestorOrigins=https%3A%2F%2Fwww.familyfriendpoems.com&random=4156681561085&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 109

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 115

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=89722800015453200710580011869011&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89722800015453200710580011869011&actionid=981741&produktid=&dt_url=

Request Chain 117

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637

Request Chain 119

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=89722800015453200710580011869011 HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 145

https://fw.adsafeprotected.com/rfw/st/902187/60813169/4.js?ias_dspID=64&adContainerId=brand_safety_-2oIYrToO9n53gOe-ZOQBQ&cbFunctionName=goog_wrapCb_-2oIYrToO9n53gOe-ZOQBQ&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fwww.familyfriendpoems.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Fa0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fa0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:f4d18962-11bc-9db0-a291-6a96b595c507,c:4401ZJ,sl:outOfView,em:true,fr:false,thd:1,mn:app05ie,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,scm:publ1,nbld:0,mtim:2,fm:sXhCELB+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C155%7C16*.902187-60813169%7C161%7C162%7C163%7C164%7C1711%7C1712,idMap:16*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:INS,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:17,oid:8c26c004-8c73-11ec-8e62-02bf2b86cc68,v:19.8.288,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4a.js

171 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.familyfriendpoems.com/
Redirect Chain

http://www.familyfriendpoems.com/
https://www.familyfriendpoems.com/

46 KB
12 KB

472ms
176ms

Document
text/html

173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 5dca751abec71004424b020d757d387ac905a1420956f406b0cd4b534e5d27e6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Sun, 13 Feb 2022 02:20:41 GMT
Server: Apache
Vary: User-Agent,Accept-Encoding
Cache-Control: max-age=0
Expires: Sun, 13 Feb 2022 02:20:41 GMT
Content-Encoding: gzip
Content-Length: 10734
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sun, 13 Feb 2022 02:20:41 GMT
Server: Apache
Location: https://www.familyfriendpoems.com/
Cache-Control: max-age=0
Expires: Sun, 13 Feb 2022 02:20:41 GMT
Content-Length: 242
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK 1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
www.familyfriendpoems.com/css/cached/ 96 KB
17 KB 101ms
101ms Stylesheet
text/css 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 1952a00a2605e0af064e425c4cb845ae4b30da722859c84fd411e65e85e11a53

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 20 Jan 2022 19:24:07 GMT
Server: Apache
ETag: "180a2-5d608722a9477-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 17133
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 123ms
39ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2748
date: Sun, 13 Feb 2022 01:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sun, 13 Feb 2022 03:34:54 GMT

GET
H/1.1 200
OK prebid6.6.0.js Show response
www.familyfriendpoems.com/js/ 201 KB
62 KB 513ms
109ms Script
text/javascript 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/js/prebid6.6.0.js
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: c9d1e528e46e684559d434c27a826ed1b6e5a35126260944f8e15078578d0dbf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Jan 2022 18:40:45 GMT
Server: Apache
ETag: "3249b-5d4ee354e504a-gzip"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 139ms
52ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

4ae689a5b37c61962b7f8702568778b5fe5afa464b5d7e21646cd6e75cdd0153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27131
x-xss-protection: 0
server: sffe
etag: "1130 / 370 of 1000 / last-modified: 1644620882"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 13 Feb 2022 02:20:42 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 153 KB
53 KB 183ms
70ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e534e723aa28b9ff18c42c2f8e6d301fa90ace9cc87c9ed923f3c6e463365117

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53995
x-xss-protection: 0
server: cafe
etag: 9997375569701806277
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 02:20:42 GMT

GET
H/1.1 200
OK ffp-heart.png
www.familyfriendpoems.com/images/ 642 B
983 B 530ms
97ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/ffp-heart.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 0831e68e6ebdae08410ffa346828128f67988382bc5e6862061847efa06c5f55

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:33 GMT
Server: Apache
ETag: "282-565ab972d53d6"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=95
Content-Length: 642
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H2 200 poem_of_the_week
feeds.feedburner.com/~fc/ 1 KB
2 KB 173ms
49ms Image
image/gif 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://feeds.feedburner.com/~fc/poem_of_the_week?bg=f89829&fg=000099&anim=0

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0ef7e58b602943799da91b3f53f11ea3fc37389925c0c10198ee88487aea2e88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:42 GMT
x-content-type-options: nosniff
server: GSE
content-type: image/gif
cache-control: max-age=7200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1294
x-xss-protection: 1; mode=block
expires: Sun, 13 Feb 2022 04:20:42 GMT

GET
H/1.1 200
OK 1570203466-alljs-ae966df076b66e29221b55831160980e.js Show response
www.familyfriendpoems.com/js/cached/ 138 KB
45 KB 167ms
105ms Script
text/javascript 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/js/cached/1570203466-alljs-ae966df076b66e29221b55831160980e.js
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 3979995a36a2edbae5d6ec4be23befcbe5efac4ae3d7b24dd45919b594866722

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Mar 2021 18:01:24 GMT
Server: Apache
ETag: "228a3-5bd1e56ae6359-gzip"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 46165
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK 1583773282-alljs-39b48bbffb5df883569a7cabfedd214c.js Show response
www.familyfriendpoems.com/js/cached/ 37 KB
9 KB 489ms
98ms Script
text/javascript 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/js/cached/1583773282-alljs-39b48bbffb5df883569a7cabfedd214c.js
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 89acce40b15a6519387a29be4b031638240cfecd67ae5c9a3cbfbaae6ca6d88c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Mar 2021 18:01:24 GMT
Server: Apache
ETag: "9425-5bd1e56ae3479-gzip"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 8690
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK logo.png
www.familyfriendpoems.com/images/ 2 KB
3 KB 534ms
100ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/logo.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 940ce4ed0c250ce6fed03f695f77279a7baa88c80c1571ab4f8c9cc99f8d5b73

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:33 GMT
Server: Apache
ETag: "8d6-565ab972d3c66"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 2262
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK nunito-light-webfont.woff
www.familyfriendpoems.com/css/fonts/ 19 KB
20 KB 228ms
100ms Font
font/woff 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/css/fonts/nunito-light-webfont.woff
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: b69352d7b888db81332b7c4c290ef3496e90c2a4c8771c565ebfa40922acb976

Request headers

Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Origin: https://www.familyfriendpoems.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Wed, 16 Sep 2015 21:22:23 GMT
Server: Apache
ETag: "4dd8-51fe3e4f741c0"
Content-Type: font/woff
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 19928
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK fontello.woff2
www.familyfriendpoems.com/fonts/ 8 KB
9 KB 276ms
97ms Font
font/woff2 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/fonts/fontello.woff2?23286575
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 5925c3bf9adbd1b35895ea0fc354215f781f558720325a181f4d906c42a0f3b5

Request headers

Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Origin: https://www.familyfriendpoems.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Wed, 17 Apr 2019 19:13:06 GMT
Server: Apache
ETag: "2120-586beace7f2d2"
Content-Type: font/woff2
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 8480
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK nunito-bold-webfont.woff
www.familyfriendpoems.com/css/fonts/ 21 KB
21 KB 280ms
97ms Font
font/woff 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/css/fonts/nunito-bold-webfont.woff
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 29ed2d9bbcbb0a34542a3c066940cad97782254ffcf48d6268a9ac701a5b7e4d

Request headers

Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Origin: https://www.familyfriendpoems.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Wed, 16 Sep 2015 21:21:59 GMT
Server: Apache
ETag: "5404-51fe3e3890bc0"
Content-Type: font/woff
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 21508
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK aleo-bolditalic-webfont.woff
www.familyfriendpoems.com/css/fonts/ 39 KB
39 KB 281ms
97ms Font
font/woff 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/css/fonts/aleo-bolditalic-webfont.woff
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 77e6bfd29cfbee30689f7c22fee27499a4bc1b7a6f796c5504cec00789f5e69c

Request headers

Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Origin: https://www.familyfriendpoems.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Wed, 16 Sep 2015 21:27:18 GMT
Server: Apache
ETag: "9c50-51fe3f68c9980"
Content-Type: font/woff
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 40016
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 26
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 13 Feb 2022 03:20:16 GMT

GET
H/1.1 200
OK tear-bottom.png
www.familyfriendpoems.com/images/ 2 KB
2 KB 258ms
97ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/tear-bottom.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 66ba4a1d18086b0c3465db8c6c5c33d9f912d6ff8450fa5752bb4c40df650cbe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:37 GMT
Server: Apache
ETag: "6d2-565ab975fc9f3"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=97
Content-Length: 1746
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK wave-inside.png
www.familyfriendpoems.com/images/ 2 KB
2 KB 360ms
100ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/wave-inside.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: b78424594851ca53dee0fdfbac774f618630b4b8ae8266910fafc2eabb2a3dcc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:33 GMT
Server: Apache
ETag: "7da-565ab972d4fee"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 2010
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK sprites.png
www.familyfriendpoems.com/images/ 2 KB
3 KB 307ms
97ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/sprites.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: d7a4008ea38aa8b6839151dae7fae0de0acb0e8626802a6ded249d07b74d9f93

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:35 GMT
Server: Apache
ETag: "9f6-565ab974b0964"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 2550
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK logo-sm.png
www.familyfriendpoems.com/images/ 5 KB
5 KB 97ms
97ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/logo-sm.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 92ac4b2f47e19784ca2a37c2c2b760a4822108fd3cb3ded48db87ad7e0e4e44f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:33 GMT
Server: Apache
ETag: "1393-565ab972d3c66"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 5011
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK callout-bg.png
www.familyfriendpoems.com/images/ 434 B
775 B 97ms
97ms Image
image/png 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/callout-bg.png
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 56bb11adc01f24c79fc0cea049df77f003785136a5db244bb1ba8c7909b8b5ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Tue, 20 Feb 2018 21:35:35 GMT
Server: Apache
ETag: "1b2-565ab974b151c"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=97
Content-Length: 434
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK aleo-bold-webfont.woff
www.familyfriendpoems.com/css/fonts/ 38 KB
38 KB 257ms
100ms Font
font/woff 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.familyfriendpoems.com/css/fonts/aleo-bold-webfont.woff
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 17296e933f90761a59195bd4cb364e51d4d95e4782aebca753c2f5559ee5c294

Request headers

Referer: https://www.familyfriendpoems.com/css/cached/1642706646-allcss-853f6a6313011cde6221f0a201524c31.css
Origin: https://www.familyfriendpoems.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Wed, 16 Sep 2015 21:22:04 GMT
Server: Apache
ETag: "96d0-51fe3e3d55700"
Content-Type: font/woff
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 38608
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK app-main-cats-small.jpg
www.familyfriendpoems.com/images/media/ 19 KB
20 KB 141ms
97ms Image
image/jpeg 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/media/app-main-cats-small.jpg
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: f1a3ee3aeb132df9dcbaacf413ba639f0f93d62035578cace11636ce60155d16

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Wed, 07 Jul 2021 19:27:00 GMT
Server: Apache
ETag: "4dd9-5c68d85c58265"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=96
Content-Length: 19929
Expires: Mon, 13 Feb 2023 02:20:42 GMT

GET
H/1.1 200
OK google-play-badge-200.jpg
www.familyfriendpoems.com/images/media/ 5 KB
5 KB 189ms
97ms Image
image/jpeg 173.203.184.140
RACKSPACE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.familyfriendpoems.com/images/media/google-play-badge-200.jpg
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.203.184.140 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS: 643795-web3.familyfriendpoems.com
Software: Apache /
Resource Hash: 53dc927e128903785e0766870ab1173dece35778a580d42a59ced928597ee6e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:42 GMT
Last-Modified: Mon, 01 Apr 2019 20:08:04 GMT
Server: Apache
ETag: "12f8-5857d940ecee8"
Content-Type: image/jpeg
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 4856
Expires: Mon, 13 Feb 2023 02:20:42 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 46ms
45ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=272553796&t=pageview&_s=1&dl=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ul=en-us&de=UTF-8&dt=Family%20Friend%20Poems%20-%20Heartfelt%20Popular%20Poems&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAAEAjAAAAAC~&jid=869935650&gjid=357796717&cid=238457712.1644718842&tid=UA-304822-1&_gid=1010363008.1644718842&_r=1&cd3=65&cd7=2&cd8=2&cd9=4&cd4=False&cd6=standard&z=105209

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.familyfriendpoems.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.familyfriendpoems.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
449 B 57ms
18ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-304822-1&cid=238457712.1644718842&jid=869935650&gjid=357796717&_gid=1010363008.1644718842&_u=aGBAAEAiAAAAAC~&z=721179673

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.familyfriendpoems.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 13 Feb 2022 02:20:42 GMT
content-type: text/plain
access-control-allow-origin: https://www.familyfriendpoems.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_2022020801.js Show response
securepubads.g.doubleclick.net/gpt/ 357 KB
119 KB 86ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

8f4b70778aa21c1c093c6acbad70c70b2e69d4d22e47d9405ee137db16ca050b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 19:18:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25360
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122244
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 09:34:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 12 Feb 2023 19:18:02 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 102 B
116 B 93ms
47ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.familyfriendpoems.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ab314ed29cdc0d67c715e9cb78055f04af7fcf02c0a8b8028228719ef90ec094

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91
x-xss-protection: 0
expires: Sun, 13 Feb 2022 02:20:42 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 136ms
50ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-304822-1&cid=238457712.1644718842&jid=869935650&_u=aGBAAEAiAAAAAC~&z=1086833150

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 162ms
49ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-304822-1&cid=238457712.1644718842&jid=869935650&_u=aGBAAEAiAAAAAC~&z=1086833150

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/ 290 KB
104 KB 75ms
74ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8221325168996967&plah=www.familyfriendpoems.com&bust=31064772

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

a233318e5d99cea088aad43dcdad12b3d4763f9c108df13d73588e60db0cc14a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 106757
x-xss-protection: 0
server: cafe
etag: 4276271751027202278
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 02:20:42 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220209/r20190131/ Frame F839 10 KB
5 KB 125ms
38ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220209/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Sat, 12 Feb 2022 23:18:13 GMT
expires: Sat, 26 Feb 2022 23:18:13 GMT
cache-control: public, max-age=1209600
age: 10949
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 225 B
424 B 61ms
46ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.familyfriendpoems.com&callback=_gfp_s_&client=ca-pub-8221325168996967

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8221325168996967&plah=www.familyfriendpoems.com&bust=31064772

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

75744f4b7e439c639ff4c7b585fff954008d490314235582b6c8ad20ea3d0c90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 209
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 162ms
48ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.familyfriendpoems.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 144ms
46ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.familyfriendpoems.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D42F 156 KB
44 KB 654ms
607ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8221325168996967&output=html&adk=3046330955&adf=2044148826&lmt=1644718842&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644718842639&bpp=2&bdt=479&idt=142&shv=r20220209&mjsv=m202202070101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=621288975108&frm=20&pv=2&ga_vid=238457712.1644718842&ga_sid=1644718843&ga_hid=272553796&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C31064037%2C31064772&oid=2&pvsid=1931289875523854&pem=877&tmod=294462064&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=154

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1ed21303fdf573dc0123dccf0db7322f8836aa7b88249dbff33a6ff576b4136

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 02:20:43 GMT
server: cafe
content-length: 44518
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 02:20:43 GMT
cache-control: private

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
339 B 97ms
62ms XHR
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=197431&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22167b61f1073474%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.familyfriendpoems.com%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fwww.familyfriendpoems.com%2F%22%2C%22domain%22%3A%22familyfriendpoems.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22familyfriendpoems.com%22%7D%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%226.6.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2225861cd1b75ebe%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22197431%22%2C%22sid%22%3A%22728x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%223e0be5fbed3249%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22197433%22%2C%22sid%22%3A%22728x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%224a8811e20bda1a%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A160%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22197432%22%2C%22sid%22%3A%22160x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22user%22%3A%7B%7D%7D
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/js/prebid6.6.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 556d18f5a17ad490dee80246818799d88162528229c2c1c25f8f1f3970242ecd

Request headers

Referer: https://www.familyfriendpoems.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
x-ak-initial-geo: CC:[DE], RC:[HE], CN:[EU], CIP:[185.213.155.169], XFF:[]
server: Apache
content-type: application/json
access-control-allow-origin: https://www.familyfriendpoems.com
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 36
x-ak-client-geo: 12
expires: Sun, 13 Feb 2022 02:20:43 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 376 B
1 KB 110ms
81ms XHR
application/json 37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/js/prebid6.6.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.27 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

553af7add02828c043d774c8648a9fcb449d223d83e148cd797bf4bb200a7502

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.familyfriendpoems.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6c47d77f-0bb5-41e3-b8d6-1feaf4595028
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.familyfriendpoems.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 376
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 95ms
47ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.familyfriendpoems.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 90ms
45ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.familyfriendpoems.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 47 KB
17 KB 283ms
282ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1931289875523854&correlator=1870580768358847&output=ldjh&eid=31060437%2C44755509&output=ldjh&gdfp_req=1&vrg=2022020801&ptt=17&impl=fifs&sc=1&sfv=1-0-38&ecs=20220213&iu_parts=1010111%2CFFP_728_90%2CFFP_728_90_2%2CFFP_160_600&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=728x90%2C728x90%2C160x600&eri=5&cust_params=PC%3D1%26SC%3D65%26SC2%3D2%26SC10%3D2%26SC20%3D4%26VC%3D1%26geoip%3DDE%26page_id%3Dhome.home%26page_url%3D&cookie=ID%3D56b50e07652a35f5-220fa2bb3dcd001a%3AT%3D1644718842%3ART%3D1644718842%3AS%3DALNI_Mbo5aATr2_MecvSUKLtFHMexBcEsA&bc=31&abxe=1&dt=1644718843142&dlt=1644718842159&idt=586&frm=20&biw=1600&bih=1200&oid=2&adxs=172%2C172%2C1256&adys=253%2C3552%2C253&adks=3947869073%2C3540239263%2C2390760339&ucis=1%7C2%7C3&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fwww.familyfriendpoems.com%2F&vis=1&scr_x=0&scr_y=0&psz=728x90%7C728x564%7C184x0&msz=728x0%7C728x0%7C152x0&ga_vid=238457712.1644718842&ga_sid=1644718843&ga_hid=272553796&ga_fc=true&fws=4%2C4%2C4&ohw=1600%2C1600%2C1600&btvi=0%7C1%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

3a4ac7408ba9885a3baf64eabf5890519618c7a5bcd106f98f805c7e8f1d1e3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17116
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.familyfriendpoems.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D39F 6 KB
4 KB 185ms
47ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 13 Feb 2022 02:20:43 GMT
expires: Mon, 13 Feb 2023 02:20:43 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FF20 6 KB
3 KB 87ms
39ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 02:20:43 GMT
expires: Mon, 13 Feb 2023 02:20:43 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6E61 6 KB
3 KB 85ms
42ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 02:20:43 GMT
expires: Mon, 13 Feb 2023 02:20:43 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1A82 6 KB
3 KB 82ms
43ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 02:20:43 GMT
expires: Mon, 13 Feb 2023 02:20:43 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/ 150 KB
53 KB 55ms
55ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202070101/reactive_library_fy2019.js?bust=31064772

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e106aa0d2157ff986c6aa212dbc5a7b486c92ea70c0d22d374e996e9e6219314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54646
x-xss-protection: 0
server: cafe
etag: 1639472950226417161
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 48ms
48ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.familyfriendpoems.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 45ms
45ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.familyfriendpoems.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/ Frame 2850 10 KB
5 KB 39ms
38ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Sat, 12 Feb 2022 23:43:07 GMT
expires: Sat, 26 Feb 2022 23:43:07 GMT
cache-control: public, max-age=1209600
age: 9456
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 85DC 624 B
300 B 51ms
51ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ4KTvAhjZv9K7ATAB&v=APEucNX25suH0TnKLvFNUuJP_0adZpCtCw8rAOd8EgOqhI0Bg4qgngNk90zUISH6UIbOQCjzWv4yq4d1sMBiPre86c6JVRiJna6wAuRxsitHJi20m8AyxJ703EU3Pf3jBrp38sVDQq1b06yRBtYF2yKFFNVJ3qeQGiYkSk-SY1oeVZGV0ltOI4c

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 02:20:43 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FF20 75 KB
31 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DdSgxpfQy2OwzDN7DR0zsnJ9scNL2cinO5BO00NH6AmLS4ifej9T36NdExjqYUJ2_uScwhD3tkdYK2ZcZNlNnJrKGrQ6Mf3beG5yXJ6ABKtbTZKYcBQoxTWBGCvfqKYaZD2UE-W-eV4mCf75Uv2wmm5wPBYQ&dbm_d=AKAmf-ArcanTxvp3vPzPI3HsVt7K5hJYxpU5LBzTfzv_PKl4jaTGPKOx_VrxF9AeeZS98_H2Y6gzkVG6KBPujBSeJNOzUvPdxWxbuX0HeZdX9fLkMNHxvVyEVbI8sryomO1tXJVfXZMXS-XtFx7n1cEk-8WKO9Jhzrfv6bTXRJ8YtCYCtoqcPFwPtNBeFvDhKsCJfbuIScRskeizFCCNsRsOyc6RMBTLvGezK4fHvsLfTOj5sgFN9q1c7MIf6uCFCwYGLgM3Cgfb0b1lLn45B1f0CZK4IhE2CczLGvEZCrWKQHs564BNzNnXI40UVrQU4dW_Hv8kuCEc3z0qGc1fcwEWSux2HLM4ZaPEzB_ezB6PGXLkCOCJhJVB2Mh-VRZ0n-9YftzGvkI3WSZC14TjgawoYyu3C9OTin2KwGkrmE7Z3PbbOj9e0Fvb9w3Vm33K13ujuIml3ENqoXCGCn0lUD6tsQBTla_cm9PR2Aj6qHduUL1quhHr3kSUWhWLELbDJlqZTNKNNYRJyJ_19aLGAYRqnj0WDUXZVJv5n1XcrPH9lcf4Kq8fsTa1GJRShwhWGCXPXiLlRRvRWWdoUuKZtFVrypM_6SQjqDDEbRJaGtJs6j3CYXbZHhjaWI-AzSvj7myQg4RykFCGqjl8gCPYF0dQcFcE7YceNIY5ycd2QpcohI9MIyPnryQ6PmOYd3e9NY_Dmk_H66CM68j3amJoYiV3UkQ3LbCe5FhN-Bm56vfTAbBL1smWbF0ZDgTQnb2etGIRuUV0ahwEVbXSAVjyJM4WwEV6YchTRGMJJuru6K6iIO3HvIn4we2qA6KB6ejH3BQPL722BkFVzXaQnvvLdbapnBhYqRh7U--9Cg9SokoGFWEu8WOTnRT9H83IH4JroGDQ-AH6n0t8C9QzITPN4lWxO7o0vZTw4nl9TBL35_pdXGyI7_Ij61b-Dej3c5qfLQ9LRHcUS7MwmDEde7c4Tks1KAiI69wukousGfyKJngm-Vuom-5wDczLRnj_qm4QiymbHCcizA-8v6zY9QRf6kwr2iJjRdDG3Dpt5xdt3cafB1YipgiWLMZt-dU0BzKAcLGiiDgNyP63P__I2PeGdgWqrYcxQowFxao6oEibkuRhRplOM_BPjjjK8lBTuyCT-0QNEM3gHRWU4bubZXrZV4fx_pjrv9UyNsFg_pDcspakY55860cILltXWjvjwk1Mz1tHBota0lNcbKlet5_G9kIg3sT9GIBOFXuNNdRttq2X3LteHzy9mOmn8xLX5ga7fpbhkUybtLpFOEXsa1NV4eeh2wCjKKuHh455536HjTeNIs9XAtUbGnG8IFUiWEtD8X_U5lt0XS9gvr-P8v-9Tg8nRBoxhOyk493LH2B8LgTIrqeWMOb-hDjbd0zSpkf4bDxyZWZlVrxSf89PQp_8WdWEKulqbQixDce3FaVyGXh5ma49lHw8WKiIQdXNTKiOIyshuUCjmko0Vic3HdD3wZEuiGdHOcaWCyM7bst3r1FKrlorTge-Ognbv5_NSi3yus1Sj_npmDSAXV1SL973dgrIrOTTuxc0vSbGyJAR0rZiauKAVO8kB7YaSTCnuRlnKElqvD79ewon0H2Nj4al1MK0OgweY5zMJDlzURL_ZkivFQplyz26RT5HdApOftd2LCca0cbZmBbQr5jq2fYDu60xvsrrPWMuUnohqalVdX0_OEkJfI3Y8_F6k5vonOKRD-cAm6MpJ0ykM_FxlcOtrluZxlUKok0CBOTS-8GpanTZt_jW4xiE7L9Sb3NuoR50k7m3EXfnFXfICgtrad_nGbYPNN_0PbeFuPeV9V2gaamccx8zcrPnMAleXKonSxwJhV6lkJNudkD-HdWXsZqx5nwm3Jip4KQv-0_Fuw551DN7EvOISWkc7bPR58TabCp1FbFUyNngIkt2IaRaBe_fDCCia7yfgorT5phwERdWECDm8JmGSDR2hRU9zY8l_e4lmpdhRQxQXIOtp1ouQ8CEmJCnOrBByCvcyWOFLxHRczvosJ9vy0Bul4fv2tIxJ6IkvoU4BGk0AEqxbAarJxuNFhVrW0xXEGDZCa3i8l4GzuWmFXAlFHAB8Us58HVM5vQj_2i99M1RLLCTxyz5qUomt_S99DcOWbu24eKC2K8AXCRJaLCKwPasqBD6jawUvMQIKA-tHkgvJ_ACbkqvE7r3YwBoi2iZdPinswuYudxmsb5ev6j423mKzAUPiQ-TAmA7ePqGfAnOjoMQ46J_kNLGKY2uo10xv8-qddqqNjXyWVqaeJxBYT1VMrBgxKPbYhzrViylNA2Hne8-uSD0U5SuUf87p9MNy64v70UmgkFTOqUmXSgWsChCFj09WwPAdJyxWqBRtwgRg_oxnxs2IHrTecKVY85OZn5-GE_YriEyDyqm2Ti1uL75NSEqAdQULNpdKrYxB79TwJiiqtY1pYKSYTCIse2YLgSJxt4A4lq4xx0ElFP_cGPgogXaATO5RvtGQ15aHXhEn5ft2v2JxZMSiJ0qPiVjYOme_V_yV_Tv0CY4xa1fAVY0Lydo0XwT72K5uWfvGk_l97RWIrmh2spHGobEDJEGoWRa1XgX1K93T-cxDbecFfFu9B0Xwb_gXZ-koQefyiicTt_0HFFaUCZr09CIEYznsrMQyc8XdmhYH9QskwIRQa_H9mtrA2czMKn9GUFAiU0zLu2NsDLc5Ft1X0WkFYWXN3pUMXoya0fgXcvjQiLFZpdRcFu4lSP9FvKcdQKtc38CnNhxuv9b0nAq-5HasDjoS-jBpRASO2N1psCrSvcZizXo7axpLlv57JLd6fgOX6wONxYGzjKxgIfHW7wKDLr-hh86-oLsm9Wy1mzGqHkAhhcR0RFfy3Wirlt134DXRAmY66Q2WaQSS1m8uAXdGFU9F1I0RivIvaZkMkDcEu9N0o-F4baOQYJ_8SZMTgIL5ZYFFoC9aJYZBuMVRmvmwKrZFdrz_VoUvdGkiNojY6d8CC50VDIrnYOwQk9XliMBJMjMVuH2l7g9FVn3BY_wqWpR_ZzwyJTo8XcXRMZsSdAvW2dlrG19uCYUsvTRjaorNpzD9bNqLq93yzAAw-hiHOlALlG-8dlcOem0HRsJkLILRqqzBV5uiybyNxu75CUAA55po_FLcQBO9cHq_9t9pwvpZebGeTfg8ji__Fu8I9VrDNMeZ_vDOSVkSA9S10oBDYR608XkmR665JFJReYLzVOOFEeydcJA9S-J0BYXScKiDcJ4_RA&cid=CAASFeRo9mp5j3gVUDq1VTQMAWAayDe-jg&rfl=1%2Chttps%253A%252F%252Fwww.familyfriendpoems.com%252F%240

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90136edfb6bc105f7a191a67b3e09ac9533086e7bc55232697011dd5ef2305f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31804
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FF20 42 B
63 B 48ms
47ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BGLthMsRAnXHekskodRnlk6UTsoblTGBEGinGuyzE-O0U3p0XUfD8EUi3ZHJUNK0qBqwe-eCxkAsZf8p6BvNK1QUt0zJJ9LHPf2c8xpN_HdIVEq6Q

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame FF20 2 KB
1 KB 179ms
80ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:58:07 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame FF20 15 KB
7 KB 137ms
38ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:16:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:16:22 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FF20 124 KB
38 KB 98ms
69ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5D29 624 B
300 B 50ms
49ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNUSNUuZrUJepXyKgiN2E5t23SJW4JgTViHd0DEIt-3zsXPpI7s1NIHg_n69jGcKv2spaHxzgoqKhQeBHEDa9lHyDWShUf9pHuDqEPXIjWY9BcDFWWo47iDp62X_V-aVyTTIYTB5ceV8eOr8j92B2fkOheynCfBRlp9naRifF86VCf6tmRM

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 02:20:43 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6E61 25 KB
15 KB 100ms
100ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AquO8rwo_3FJRdWWZbKUHgvt0l3S_uEPHxARcJV2tWHA6GspX-8o6UABj3NTObqHUs8fKqBPVpTuPPyVj5gveUcFQJVBv8k8HIGvYfo8eoKGJ1TV26VKCvSJZLeefeD12t9k6zTOg5iZzsNfNs1ktEFFOmMQ&cry=1&dbm_d=AKAmf-BGvJJG_HpaIqpVUwp7GX9l_zCHV8IlHYiTOD5VYXrjX7dg-BetcRFiMxKrT8oWPFu3INKKzjPAsjBdwn7a59gtMIY01zvzw8Dvc1gGp2M7IiIhnXt0tB5yFwXdOorjHEaiTHW17NxFDpJAJu5NewwMhSzJTB9MuAumFbxXuvkudn3g438lryLrNg12PsWlx_zH4U5YiFxe-GWGrfRRnSiODQKSiNo06fc6L4qisIKdoC9rM6B6qtmVLF847td6cO4uw59PdoHxpGJs433zzEPvJF_Qm36b1yvcY65WpLxcF8ZOo4pewqeiZl-upm4xWhARUvAQ_dFUdMS4vSG-qKMos557J5XScYFvCvkKiM8sgWDro3ewjl-TsSFZbPnBAfxtBc4peelEMuNtdfbnNzmEP2VdJiQfk_i0TIOojKYHN9LIikzJoSHPj5NStkdin3EHIjAYWD7jBFrHmdmrRXHo2-YJlMEG2AGmM9s8zvbk0WV-HeFFG319pEfVn6Ky6kKDWEjuYU7bRuOpr0NJyvXo5chVvwmL99rebhxLuGfT3QnajWgScjcZXJ0Luv91x4y1jmYiWndJgpxKnDYgFUT6RDFIYcfg00Kh9l95rvf0rqUdJ5Lc6sRsAWb_F_6TU63FZoYuqcrsRCRr9Kl_r68xcI01Xiq_EL2jgWuqVvRryVqwDrm_Srg05J-c9LqftiFnr1GFGyfHM5Wr5kp88arD30u_5OWfd-zmLuAD8WCuxn2-GPETojClLTsMjGcIER7OVXyG4x-cAb2E3kkzLWbQMTSRWQE_VA3P9RdV_iOLn7vlTqGRppDm3ORarlOjhEy9OQlzdzvzmayGSEkSYKBtjCqdummOuB32GViVd3WnYtug6q721ku9gktt_vsgHJvBPwPJieWR-UNETI72FjfJj1KUHX2c_OGUZPYhH_-ELX0P4DuVolZ-n6ALfFX4cHz3KM_wMXa8rzCHMfxqKnxK1oXbaoscssfQFyA9VV9vES44ccNR5cN26zb4pLhfMzcpnTXRrLvaJ7gCnzX3X4s7ezLK7ryrn7AqId_X_qafF-n4RCyT_rLsQZDEJ0vOIWqiyYo74LkQnApUyMoyFQrAk2n3Wv2Ml2Tec0JJXGTI0godvO-Bi-fBX81LhqdUTO_hhTF2901UYfnpqEX6YQovwcRNZh61h6pvbb2VETqMjRKUW2_okmI0podxulX3BVeMLRjzy9hTXxVbekZWUtG1kOQzsqYe9pGh5O3Fx3PqQq0qUpC5i-0zjPFtQHv1IGJaspFGUmCu8WNy3sLed4zgB2TAW10KaJm_ENwN0dTwMQEeXU2O7vi1kwqaK-xbTivAgOAtpNL-aiI94yJyHRrxpDoJs6qlLu5ELB9PTsvwo-RdO7028CxPArEBCe4A1IOIcJE0O9iOYLxvRVp0K1vYxvBQe9zw8CSoAlaALSsXMdDh8j_m_AeKAQ_IoAtTuBfb2fef4P8cybq_6Yi2ZeQmfHdqIaFc1aCsfziIE8aYKiRkktPUC6mBYQf-T8XjmSjlCT0YCxb3ontwfUp9Su8fMIsdfLv63o7OwZRZylGXIdgIOK_byCYlf14aHi8YdPXfIUyTHtDvLfgYRBcfChK_xnqJvZ4wmVKESuzargHX_wxy8jlinGdTsGJEQ2LMLdtPvMhwA2PsuAFfcI5yryzYfbMFEoJ-YmwWYMCzYJQ6i0XNr1J_T8z4EfdBValkAYMHn1kBQlRFj7qLsGnEtU2rIidrKHT5YkEG_fnVQr62nLUD50jQlaBAdA9uaOzWO5kd7eX33Qu3gQyn8uM5s6_HpwNtMB9AeEB2L_mM6sLcv0DKfciV-QDNRxYRo8Rpp0w7PU_jKy2OxDe692HTvKX-jAlyYXjMyWfGpCG08W-hAaZl5vp6wUQC9NDnK6bgsoixla080VxVHeH3pcmCu2g-LhhkJZWkFaUDpNquLs5HjcWkyDHBtz9u4GEXeZCjIV-l2TUuyr2uv0WQXIZwuEM84LsHv31Lhf7Vu0eqRuVfw1pZky_UA2SISSoiJ9ShXs7aJ24vl4VdZOw43VYWMosrwoDHfgQqU9e_A-GDmqbfcNXZQlJAqaQXvVwykhKlX6fihazahxOCAQNEqCoDDLf3GEQJo29kF4aMy8cXNbM12ygUqNTMOaBOEr7FfOMblldiRIv841vzaBaqrAB81MVMDQFTmmuscN_haQjYA4KnFbgypv7ToP4JU4RbYb5sQ3TJ2_iareXNqO-0xFrR_KoYPae2UD2D9mSzhV5OQKKURUR3CHu8k3xW0m4SkomcVh41VBk9qhoqx9SALHgsmalSfD8T0p2F9dUip7itJliiNJawiGDDBG7nb_u2zKPrKDnn23Cku1Emjybr0i7uyjKIejeu_g0HvL2j6ZAi3XcAGWsTJ_SFQrtKX-GF43PYWl17dRKI3b-RIdrNlL9qVPH5DRemxPhZNU3beeobKPHm8Q3rW3uonG-hNPp5f7u0jIdFstmJNkp9M6UhrIvQQZMZ6aZfXoVOtgH3_9dyOis1g4z4dYbLxGpUBxuJ3LVoeKAZwc9oKP0Dryq5ZiaZMEuTrqIR1AdY2wC77i9dNOeLU28-FIgDeTFFu0Z-zlKUNd6PRf8KCjsvhu_MmXbeWrZCxUHS8IuMO_b0Jwo5eXVgcCeACLsKQDPufjIGiJwESaCTvNnqhlmi_-sfLwhE4KNKqzHKjCU7ocm-ctbH39d_3-SYhRNNXMXx2XTgdt_iaoICrYFhaQjJ6BjXSuVBBkkAoHIBwXEJLvs8yztRzo7IwbZPHrtLRyjLZoo2p2hLN9qunMpT6wZmwTcWSaLL203xu5WiG6n32DSh8jFyZGRhAZF59c44Sfcu6LhM0Z-d6JDxQoplWqR67dgin9kVtVwd045FT_41VoKtFjNo0YmnmOJA1V_IXci7VowvVJq1BL4EhIWVi5qxm1zXeYrICNGJwcxGHPJS5rhsgKUKlHgnx4uGfJkqpsiyIYq1OIcD-t3ntOT8GeSVfaPr0krGv6-BDCDjTBNXlrx_2AqfWB8sq-0Oj0wGQraCi7EDf5T-LFjiEyJGYxGpF7gMv2Uka5HJ2zDwCNJDPF3bpVkxuTLF0BPdZ9ZhvOSdGsQpYVhDQijK6oqSZFeSoCkhYW2rN-2vUYjYegtseFN4HUnj4vLvTVzbpvU&cid=CAASFeRooE5HYdohiHKGNMnoOxwULS7g8g&rfl=1%2Chttps%253A%252F%252Fwww.familyfriendpoems.com%252F%240

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39278d4b968b3ef1e83e7d751d4efcb7a00722c4a881a8ea24e4e46ce3343b3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6E61 42 B
63 B 48ms
47ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DXO2Lf5ixQOBQZ3jK-H3_Ww8fGw3r5q0E5Qcdij6YxDSo3jGBfslSJauWKGHzU5td-mNQdeCAC7vvNplxZZCsSI8YRoydlT9IuS9iljPJrpBvwCzA

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 6E61 2 KB
1 KB 173ms
82ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:58:07 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 6E61 15 KB
6 KB 134ms
42ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:16:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:16:22 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 6E61 0
0 97ms
47ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR1fk7AtXDIFgIqWkvtfSlCaVPzeyhDIZzKNkMUQf-EGCQ74UetwWvHQCP5t6gUC7h85HEzsSHjsT1EpLno77qBu5LCgQ
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6E61 124 KB
38 KB 73ms
51ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 18C0 624 B
300 B 51ms
50ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ9YDEhgIYnOrUwQEwAQ&v=APEucNXo1bNzcbgQaVfZ1K1s_hKqjXanDxoicU49nh-k0k1hvxHvsm0fq4gKO7WCz76QmVUjKoJr7y9u8cuS0xFOs5oc2J2aQj3zjvryiZnitLjYzzb5no7iFqxjjz7EJ8eBajVwV00LCAPVS4OxjUFD7nICg2bP6sF15TBuGBL3wnnPa_Ds9v8

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 02:20:43 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1A82 25 KB
15 KB 102ms
101ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ChbDBpoD4B7TV2r7aq5ducKR6Pkakv2RPwm2jle5-I1DOUDFuNHU-h5WAmP08iklTDfGJrc_7W_4jRypUuUhnGHX8pMW4ia2ahf6wueJKwMjOTcyMyyfA30SlUEovHfSjeWJ7Nxkf2xFjK53LpUFIqSDcr1w&cry=1&dbm_d=AKAmf-C_a3jsC6Pkrg8GNL7sB-h6eUU0xVGIc_TwUXCU8MZST9IhUg6dBgBJulsAQHabePfWyOPZ6zYvfqcdzGB4l3zb_qI_SvXfU4f5PRlgv5ZkTWK7Y0czRbOjeY6RDV8tqKN5r-EAcBoc0kw20m9T6968qMMK2cN9r5eCUVrYCJdyImwsy5LyjUlZfoK7_7t8RWV0srriicH6CS5AbuWMEAGqb4TmN_HgBhhijR4JoIsWD-4HFTJJe9cF6AvmV6EOUqlESaJkJ6wLf8ew0xJgQ20bLwG5jMwBpePw9Ub573LvmitZyradpoLNJmIqXOI5-NX6XOWDQH6y15_f4B2xjAKXbztQSEiyHXTJksWAsa3P7-tGKxDgT6IeGQ21OSSkDVpMdcYh9tLVj4AD4mxBFDYJOMAwzaFcAu8exWNE_7FCiY4RfFInITwM-C0gKG9GNPCuSFY_Ed3NPBeZjoHTrUeTZ72764s5YLJ2E6gAHqt_6dGgThJKEQi-qYUsW6p7fXDO37PD3x5rKSvByQQxh7mBY3Ma_20kfnwPK4Afdl5WQ8_DUwd-R7_r4f-27I81xgNCStr84ZoGCZmoKSpGbwpRkqAMmx2GHsJ0sya7NTZRV5RMZdJryzBeCA8uXkrvu-EhaP3ivpvem5Za4E8TMEZUT2MokDmbpd6md1OmU8Xn8MhMOJU0fIFBX2iAQMmnUFPiy6O1VSQosxSMV2UvfPsPkMcxtv5_bBWZhwS0wapK2gVIWyECcnbukW5I-eDUBcr75ynxi69OjtamvtKIxbfXYCV6g9y9J2PpjCdERNu-dvhxvRLnyICLz-6j65pSg5Zvq0-88wGUMtiWdkA7Pw7drICZMpuxLtCLssVQ5hFkd08mekRXaiTbhF2l0QfPd9-KxylEeqmdj9H5pFPUE7B8ApgfJAVBtVSCWwePkcsPsEVSiEQLuuXzCki6_CeppS3MbAmfBtMBiujwEaeqO_hKCvOMGTDt0vmSl2sJSXb96uDCT9AA2l0WaiSUydI0Oodj2e_ieBltwZwhY03TatHs5_lj0Rd8PGrFRsmAozQ4EZm6F_TRvIJ9JAHAvn212WWMtLxEn1rQr2iYf2Vb08VSDsy5kUdGGssGxaaUOmFKb2T-ni32PUWatcyWgOQYhT_2qmA1aIP-DCF9qRpuRA8YwG3rp0Y5MSU625QvTkT9DlAL2X1UJGLTsmrUi-FQLmWPRVaR2apJgNT8yRhV49rAmjr9QvZkKYv72utz8pMpw2wUGwBBwmKYrY8qdcJYHlubb_oAjyNplZNuowlvgp4I7IpsSaV9eO6sRp6XiPwvzj0wgkcH019C2rxw2wwvJLkyWf3S6iNL-C6ePBvrSgB_cUYPwhZLpnP9St7XOA1qevt25Cuw3z_x6SCEbfbEf2SLKQyGkiQxMpiikLhvs9mNyj2yWLyifFGwQLL2zyyAHIjf8L_e3j7gSZx9Cwo41xCN1Bk2YSZtnQ5pMV3bGMewIWXzUAreFtWEvOKsWBi-3f7nqyNtMzMcgrH6kghYJnABb3eMtQrLGGxE8Ir9nWRWNob977UpHd6kh5gLR4tWQ3z0stEaL9a2Qaai-yhLnk7X7KtqeABaOxAw3Ghu0LUpLTcGYeimLNL2xs8kjgYqPUhURwBqjWwJYewBanfRlxSx9L8yt-CYYcXa4O_prp1YijQ1Xtk3LYq3Z0Ue9FHQGmn7lcHcd19T7KBAun6lqLsb3KqinA-x0M5kIWsFJlQh5Yc12R9l6PeD4OIh2xloW3CGB3ZKy9c4Txr2QLaNKjzJ2QOpZjFeFZr8NKhntjbWbl9ujBKpWk8nfNOXVdVfSnPVG1gefPTk4d16WxU1QSF3ivXRNzMp6n2gnyUnaLMHtDJO1QYYENwdSkI8cUkqcpDs6tsPbJTLlBRxY9lc8XTmYaW8VCkb-sLUFQzH4rLz1iMdMRJoX0YXUaCWlOb0JMLosZYLLdHoJPxTjE7cLYV2SYZ9vcq-g_qz1IsVHNJRgN9zqM_6vnbWKGrzh9W3UCUzl5GFCiNi8k9I8pO4px43KL8cS1Mp8dTRX2pRsIsZ7hz36qrcckNsWqBUCawmCMM1MeGvdvZeSMg_DC1ip0wIcjhg5sWfDiRrSTs5Ep_bSUW0XDb-AKN__fct9u0iXioeAtONfmbJH1oRWevq95YYE2rA0DLwklR9aV679hKN2jFCDixJWRG2C9KUOeZXIq91H6yKlr9Jzps3C1NllNMXm5-RUVSvsqjbKGcEXTWhnE3ZrOt2xqFUAGpgttEyPsXud07uN--HHhfgal8Hp45oZURhowBIyp22-YhjUpXlI0yg7BAPa_zoi88nAaErmy21E30bCXNEcBNgesJKAWh0aygygSu_y22sHinE4nBc2WgMAc8t9mihhbC2ePm5Lp2UgdliTUZJZi4gurAUwgHerQvdAlXWFc7eRTEPYTAJ9tqGfVARKj2yKeDgzHMScW8HBoV1WCWM4-M9WjHlvzzZ9XHxjnFmQf_ciMgzQ6h-TFQ0nWZNk-fC3WzqOeonnvRmbtOJZsdeD0fSPNHE-aYXlg8IKkWOqX5YwY_xcwUJiIkF2RO6lG39ppgjoTNzNj-dhewU1QAPy2BnT53FkcMkj0Z7gTaPmltpzEbZHMtjkUQWiId70vODR_CabV1phWBkiHH-ps55N7Z69TtrmANqt0tThCAixAZlaz4n2iC6azdLfQUeiTao6g8vbhauNOGzA6dOl4N4_H98www8jATzXVuX2IfY8BrsomWaQKPvaofI_9riUfpmcvZiZgChh-TpOK7OcrW5WjU8Wfqp6qCQ2jOPKTzz9c5fvQtq2aB3Dg_54V_qVx_YeUA4sSNTP78_hADPrRl8KhA-xEqgjzVxWWOi_mtTSJ3PwV6bTDM3JH9MBbDntMABGO_T0xcTtS77t8lYePaQZv0SuzF3xqvHm-DAOrKVmHQUxMBgCIVjS5e8zl6ix-vO2gAErCeH7d-9naEljZ8UHwPV_TJXr42hfbfgRqk2QOv_8qkTwnZpGkJz4yxwf7LYQVxAyOYT1d4CqHccPma4jXl64YDzHRswM2KeSn-hbbG46XUrr29ANE8mAqf9JaXQCjXACG7ujChslYG7MK86ExQAk-Wnv0w5y8LSpu7lx9C_4s-CpLMqp8k5hQgUp8_w2HG5l9eLVmcosR1JsPlLi-a-cSufrAo8p0nUTNz75ZrmS3zYBVMjiIEubzOsZBgzgBAO49p5jdiyvN17zLt5C9cyC0OWBmzakD58AIFOsZpjeaUWRGLdIKC8uhXlhM_FguszPtm_lVxjt_E&cid=CAASFeRoeOHT3EeA9F-4OZxnLLIXyMTxbg&rfl=1%2Chttps%253A%252F%252Fwww.familyfriendpoems.com%252F%240

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6fd0af94d3371cf5e1a1c40c3a5854cd467fb0a391ba09ad48ca3f12b065995b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15466
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1A82 42 B
63 B 48ms
47ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DBYC1sQ6NRYOfdzWJjl0sa8vVmoTOyC3Ra49b-gmiNOyqlafAKE_h8SrdzZzPEMAEwmAolcaAkJzFVE_IRgVlJCXXAmTSYppuq_cmAdonItHHHCgw

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 1A82 10 KB
5 KB 59ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

2179464a9b593de05ea2a423d14236645d400b267ee7d81acb50b39c06db3763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:25:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3300
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4819
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 14:44:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:25:43 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 1A82 2 KB
1 KB 168ms
80ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:58:07 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 1A82 15 KB
6 KB 136ms
48ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:16:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:16:22 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1A82 124 KB
38 KB 96ms
76ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 2850 4 KB
1 KB 135ms
47ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 13 Feb 2022 01:17:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 13 Feb 2022 02:20:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 2850 205 B
743 B 122ms
36ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 21:05:56 GMT
x-content-type-options: nosniff
age: 18887
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 12 Feb 2023 21:05:56 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 2850 604 B
694 B 122ms
37ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:05:47 GMT
x-content-type-options: nosniff
age: 896
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 13 Feb 2023 02:05:47 GMT

GET
H2 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame 2850 19 KB
8 KB 100ms
52ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a7b5f2e7e3fd51102d05b2706291210864e7890361d932311a18048073374ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 22:51:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8079
x-xss-protection: 0
server: cafe
etag: 5902764951541284931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 26 Feb 2022 22:51:54 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 85DC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ4KTvAhjZv9K7ATAB&v=APEucNX25suH0TnKLvFNUuJP_0adZpCtCw8rAOd8EgOqhI0Bg4qgngNk90zUISH6UIbOQCjzWv4yq4d1sMBiPre86c6JVRiJna6wAuRxsitHJi20m8AyxJ703EU3Pf3jBrp38sVDQq1b06yRBtYF2yKFFNVJ3qeQGiYkSk-SY1oeVZGV0ltOI4c
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 02:20:43 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 85DC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yghq.xG0B-h8s0nBZ2HzIAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2

43 B
894 B

14ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ4KTvAhjZv9K7ATAB&v=APEucNX25suH0TnKLvFNUuJP_0adZpCtCw8rAOd8EgOqhI0Bg4qgngNk90zUISH6UIbOQCjzWv4yq4d1sMBiPre86c6JVRiJna6wAuRxsitHJi20m8AyxJ703EU3Pf3jBrp38sVDQq1b06yRBtYF2yKFFNVJ3qeQGiYkSk-SY1oeVZGV0ltOI4c
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 02:20:43 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 85DC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

43 B
1020 B

7ms
7ms

Image
image/gif

37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMX_6gIQ4KTvAhjZv9K7ATAB&v=APEucNX25suH0TnKLvFNUuJP_0adZpCtCw8rAOd8EgOqhI0Bg4qgngNk90zUISH6UIbOQCjzWv4yq4d1sMBiPre86c6JVRiJna6wAuRxsitHJi20m8AyxJ703EU3Pf3jBrp38sVDQq1b06yRBtYF2yKFFNVJ3qeQGiYkSk-SY1oeVZGV0ltOI4c

Protocol

HTTP/1.1

Server

37.252.173.27 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3e34f343-0581-4170-9303-c139883995a3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 85DC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

170 B
232 B

127ms
50ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6c4852d6-2603-4a17-88d6-df1f2218ce5f
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5D29
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1

43 B
894 B

14ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNUSNUuZrUJepXyKgiN2E5t23SJW4JgTViHd0DEIt-3zsXPpI7s1NIHg_n69jGcKv2spaHxzgoqKhQeBHEDa9lHyDWShUf9pHuDqEPXIjWY9BcDFWWo47iDp62X_V-aVyTTIYTB5ceV8eOr8j92B2fkOheynCfBRlp9naRifF86VCf6tmRM
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 02:20:43 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5D29
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yghq.xG0B-h8s0nBZ2HzIAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2

43 B
894 B

14ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNUSNUuZrUJepXyKgiN2E5t23SJW4JgTViHd0DEIt-3zsXPpI7s1NIHg_n69jGcKv2spaHxzgoqKhQeBHEDa9lHyDWShUf9pHuDqEPXIjWY9BcDFWWo47iDp62X_V-aVyTTIYTB5ceV8eOr8j92B2fkOheynCfBRlp9naRifF86VCf6tmRM
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 02:20:43 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 5D29
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

43 B
1020 B

7ms
7ms

Image
image/gif

37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY583FlQEwAQ&v=APEucNUSNUuZrUJepXyKgiN2E5t23SJW4JgTViHd0DEIt-3zsXPpI7s1NIHg_n69jGcKv2spaHxzgoqKhQeBHEDa9lHyDWShUf9pHuDqEPXIjWY9BcDFWWo47iDp62X_V-aVyTTIYTB5ceV8eOr8j92B2fkOheynCfBRlp9naRifF86VCf6tmRM

Protocol

HTTP/1.1

Server

37.252.173.27 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4cf3e113-e6b4-4cb6-9616-f28b8db4ab8f
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5D29
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

170 B
243 B

119ms
50ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: f702f6c5-982b-4f34-8813-69866937570c
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 18C0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ9YDEhgIYnOrUwQEwAQ&v=APEucNXo1bNzcbgQaVfZ1K1s_hKqjXanDxoicU49nh-k0k1hvxHvsm0fq4gKO7WCz76QmVUjKoJr7y9u8cuS0xFOs5oc2J2aQj3zjvryiZnitLjYzzb5no7iFqxjjz7EJ8eBajVwV00LCAPVS4OxjUFD7nICg2bP6sF15TBuGBL3wnnPa_Ds9v8
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 02:20:43 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFuJ29fQEc34G6H-AXuhTLY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 18C0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yghq.xG0B-h8s0nBZ2HzIAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2

43 B
894 B

12ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ9YDEhgIYnOrUwQEwAQ&v=APEucNXo1bNzcbgQaVfZ1K1s_hKqjXanDxoicU49nh-k0k1hvxHvsm0fq4gKO7WCz76QmVUjKoJr7y9u8cuS0xFOs5oc2J2aQj3zjvryiZnitLjYzzb5no7iFqxjjz7EJ8eBajVwV00LCAPVS4OxjUFD7nICg2bP6sF15TBuGBL3wnnPa_Ds9v8
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 02:20:43 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI4kVB2wZZkEK1e1w9gXoaU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 18C0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

43 B
1020 B

7ms
7ms

Image
image/gif

37.252.173.27
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPD8kAIQ9YDEhgIYnOrUwQEwAQ&v=APEucNXo1bNzcbgQaVfZ1K1s_hKqjXanDxoicU49nh-k0k1hvxHvsm0fq4gKO7WCz76QmVUjKoJr7y9u8cuS0xFOs5oc2J2aQj3zjvryiZnitLjYzzb5no7iFqxjjz7EJ8eBajVwV00LCAPVS4OxjUFD7nICg2bP6sF15TBuGBL3wnnPa_Ds9v8

Protocol

HTTP/1.1

Server

37.252.173.27 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: bee00adc-e11b-4c2a-bb9a-8c61998761ea
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEpWQKSWr-tTaU0tzT9zIGM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18C0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

170 B
188 B

97ms
50ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
X-Proxy-Origin: 185.213.155.169; 185.213.155.169; 539.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7fd0cda0-346f-413e-b3ab-c280de44583e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzg1NjMyNTQ4NjkyNzg0NzcwMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame FF20 106 KB
38 KB 168ms
38ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
Origin: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8448
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 23:59:55 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame FF20 8 KB
3 KB 41ms
41ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DdSgxpfQy2OwzDN7DR0zsnJ9scNL2cinO5BO00NH6AmLS4ifej9T36NdExjqYUJ2_uScwhD3tkdYK2ZcZNlNnJrKGrQ6Mf3beG5yXJ6ABKtbTZKYcBQoxTWBGCvfqKYaZD2UE-W-eV4mCf75Uv2wmm5wPBYQ&dbm_d=AKAmf-ArcanTxvp3vPzPI3HsVt7K5hJYxpU5LBzTfzv_PKl4jaTGPKOx_VrxF9AeeZS98_H2Y6gzkVG6KBPujBSeJNOzUvPdxWxbuX0HeZdX9fLkMNHxvVyEVbI8sryomO1tXJVfXZMXS-XtFx7n1cEk-8WKO9Jhzrfv6bTXRJ8YtCYCtoqcPFwPtNBeFvDhKsCJfbuIScRskeizFCCNsRsOyc6RMBTLvGezK4fHvsLfTOj5sgFN9q1c7MIf6uCFCwYGLgM3Cgfb0b1lLn45B1f0CZK4IhE2CczLGvEZCrWKQHs564BNzNnXI40UVrQU4dW_Hv8kuCEc3z0qGc1fcwEWSux2HLM4ZaPEzB_ezB6PGXLkCOCJhJVB2Mh-VRZ0n-9YftzGvkI3WSZC14TjgawoYyu3C9OTin2KwGkrmE7Z3PbbOj9e0Fvb9w3Vm33K13ujuIml3ENqoXCGCn0lUD6tsQBTla_cm9PR2Aj6qHduUL1quhHr3kSUWhWLELbDJlqZTNKNNYRJyJ_19aLGAYRqnj0WDUXZVJv5n1XcrPH9lcf4Kq8fsTa1GJRShwhWGCXPXiLlRRvRWWdoUuKZtFVrypM_6SQjqDDEbRJaGtJs6j3CYXbZHhjaWI-AzSvj7myQg4RykFCGqjl8gCPYF0dQcFcE7YceNIY5ycd2QpcohI9MIyPnryQ6PmOYd3e9NY_Dmk_H66CM68j3amJoYiV3UkQ3LbCe5FhN-Bm56vfTAbBL1smWbF0ZDgTQnb2etGIRuUV0ahwEVbXSAVjyJM4WwEV6YchTRGMJJuru6K6iIO3HvIn4we2qA6KB6ejH3BQPL722BkFVzXaQnvvLdbapnBhYqRh7U--9Cg9SokoGFWEu8WOTnRT9H83IH4JroGDQ-AH6n0t8C9QzITPN4lWxO7o0vZTw4nl9TBL35_pdXGyI7_Ij61b-Dej3c5qfLQ9LRHcUS7MwmDEde7c4Tks1KAiI69wukousGfyKJngm-Vuom-5wDczLRnj_qm4QiymbHCcizA-8v6zY9QRf6kwr2iJjRdDG3Dpt5xdt3cafB1YipgiWLMZt-dU0BzKAcLGiiDgNyP63P__I2PeGdgWqrYcxQowFxao6oEibkuRhRplOM_BPjjjK8lBTuyCT-0QNEM3gHRWU4bubZXrZV4fx_pjrv9UyNsFg_pDcspakY55860cILltXWjvjwk1Mz1tHBota0lNcbKlet5_G9kIg3sT9GIBOFXuNNdRttq2X3LteHzy9mOmn8xLX5ga7fpbhkUybtLpFOEXsa1NV4eeh2wCjKKuHh455536HjTeNIs9XAtUbGnG8IFUiWEtD8X_U5lt0XS9gvr-P8v-9Tg8nRBoxhOyk493LH2B8LgTIrqeWMOb-hDjbd0zSpkf4bDxyZWZlVrxSf89PQp_8WdWEKulqbQixDce3FaVyGXh5ma49lHw8WKiIQdXNTKiOIyshuUCjmko0Vic3HdD3wZEuiGdHOcaWCyM7bst3r1FKrlorTge-Ognbv5_NSi3yus1Sj_npmDSAXV1SL973dgrIrOTTuxc0vSbGyJAR0rZiauKAVO8kB7YaSTCnuRlnKElqvD79ewon0H2Nj4al1MK0OgweY5zMJDlzURL_ZkivFQplyz26RT5HdApOftd2LCca0cbZmBbQr5jq2fYDu60xvsrrPWMuUnohqalVdX0_OEkJfI3Y8_F6k5vonOKRD-cAm6MpJ0ykM_FxlcOtrluZxlUKok0CBOTS-8GpanTZt_jW4xiE7L9Sb3NuoR50k7m3EXfnFXfICgtrad_nGbYPNN_0PbeFuPeV9V2gaamccx8zcrPnMAleXKonSxwJhV6lkJNudkD-HdWXsZqx5nwm3Jip4KQv-0_Fuw551DN7EvOISWkc7bPR58TabCp1FbFUyNngIkt2IaRaBe_fDCCia7yfgorT5phwERdWECDm8JmGSDR2hRU9zY8l_e4lmpdhRQxQXIOtp1ouQ8CEmJCnOrBByCvcyWOFLxHRczvosJ9vy0Bul4fv2tIxJ6IkvoU4BGk0AEqxbAarJxuNFhVrW0xXEGDZCa3i8l4GzuWmFXAlFHAB8Us58HVM5vQj_2i99M1RLLCTxyz5qUomt_S99DcOWbu24eKC2K8AXCRJaLCKwPasqBD6jawUvMQIKA-tHkgvJ_ACbkqvE7r3YwBoi2iZdPinswuYudxmsb5ev6j423mKzAUPiQ-TAmA7ePqGfAnOjoMQ46J_kNLGKY2uo10xv8-qddqqNjXyWVqaeJxBYT1VMrBgxKPbYhzrViylNA2Hne8-uSD0U5SuUf87p9MNy64v70UmgkFTOqUmXSgWsChCFj09WwPAdJyxWqBRtwgRg_oxnxs2IHrTecKVY85OZn5-GE_YriEyDyqm2Ti1uL75NSEqAdQULNpdKrYxB79TwJiiqtY1pYKSYTCIse2YLgSJxt4A4lq4xx0ElFP_cGPgogXaATO5RvtGQ15aHXhEn5ft2v2JxZMSiJ0qPiVjYOme_V_yV_Tv0CY4xa1fAVY0Lydo0XwT72K5uWfvGk_l97RWIrmh2spHGobEDJEGoWRa1XgX1K93T-cxDbecFfFu9B0Xwb_gXZ-koQefyiicTt_0HFFaUCZr09CIEYznsrMQyc8XdmhYH9QskwIRQa_H9mtrA2czMKn9GUFAiU0zLu2NsDLc5Ft1X0WkFYWXN3pUMXoya0fgXcvjQiLFZpdRcFu4lSP9FvKcdQKtc38CnNhxuv9b0nAq-5HasDjoS-jBpRASO2N1psCrSvcZizXo7axpLlv57JLd6fgOX6wONxYGzjKxgIfHW7wKDLr-hh86-oLsm9Wy1mzGqHkAhhcR0RFfy3Wirlt134DXRAmY66Q2WaQSS1m8uAXdGFU9F1I0RivIvaZkMkDcEu9N0o-F4baOQYJ_8SZMTgIL5ZYFFoC9aJYZBuMVRmvmwKrZFdrz_VoUvdGkiNojY6d8CC50VDIrnYOwQk9XliMBJMjMVuH2l7g9FVn3BY_wqWpR_ZzwyJTo8XcXRMZsSdAvW2dlrG19uCYUsvTRjaorNpzD9bNqLq93yzAAw-hiHOlALlG-8dlcOem0HRsJkLILRqqzBV5uiybyNxu75CUAA55po_FLcQBO9cHq_9t9pwvpZebGeTfg8ji__Fu8I9VrDNMeZ_vDOSVkSA9S10oBDYR608XkmR665JFJReYLzVOOFEeydcJA9S-J0BYXScKiDcJ4_RA&cid=CAASFeRo9mp5j3gVUDq1VTQMAWAayDe-jg&rfl=1%2Chttps%253A%252F%252Fwww.familyfriendpoems.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:35:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2704
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:35:39 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame FF20 24 KB
9 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:00:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:00:21 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame 6E61 24 KB
9 KB 39ms
38ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AquO8rwo_3FJRdWWZbKUHgvt0l3S_uEPHxARcJV2tWHA6GspX-8o6UABj3NTObqHUs8fKqBPVpTuPPyVj5gveUcFQJVBv8k8HIGvYfo8eoKGJ1TV26VKCvSJZLeefeD12t9k6zTOg5iZzsNfNs1ktEFFOmMQ&cry=1&dbm_d=AKAmf-BGvJJG_HpaIqpVUwp7GX9l_zCHV8IlHYiTOD5VYXrjX7dg-BetcRFiMxKrT8oWPFu3INKKzjPAsjBdwn7a59gtMIY01zvzw8Dvc1gGp2M7IiIhnXt0tB5yFwXdOorjHEaiTHW17NxFDpJAJu5NewwMhSzJTB9MuAumFbxXuvkudn3g438lryLrNg12PsWlx_zH4U5YiFxe-GWGrfRRnSiODQKSiNo06fc6L4qisIKdoC9rM6B6qtmVLF847td6cO4uw59PdoHxpGJs433zzEPvJF_Qm36b1yvcY65WpLxcF8ZOo4pewqeiZl-upm4xWhARUvAQ_dFUdMS4vSG-qKMos557J5XScYFvCvkKiM8sgWDro3ewjl-TsSFZbPnBAfxtBc4peelEMuNtdfbnNzmEP2VdJiQfk_i0TIOojKYHN9LIikzJoSHPj5NStkdin3EHIjAYWD7jBFrHmdmrRXHo2-YJlMEG2AGmM9s8zvbk0WV-HeFFG319pEfVn6Ky6kKDWEjuYU7bRuOpr0NJyvXo5chVvwmL99rebhxLuGfT3QnajWgScjcZXJ0Luv91x4y1jmYiWndJgpxKnDYgFUT6RDFIYcfg00Kh9l95rvf0rqUdJ5Lc6sRsAWb_F_6TU63FZoYuqcrsRCRr9Kl_r68xcI01Xiq_EL2jgWuqVvRryVqwDrm_Srg05J-c9LqftiFnr1GFGyfHM5Wr5kp88arD30u_5OWfd-zmLuAD8WCuxn2-GPETojClLTsMjGcIER7OVXyG4x-cAb2E3kkzLWbQMTSRWQE_VA3P9RdV_iOLn7vlTqGRppDm3ORarlOjhEy9OQlzdzvzmayGSEkSYKBtjCqdummOuB32GViVd3WnYtug6q721ku9gktt_vsgHJvBPwPJieWR-UNETI72FjfJj1KUHX2c_OGUZPYhH_-ELX0P4DuVolZ-n6ALfFX4cHz3KM_wMXa8rzCHMfxqKnxK1oXbaoscssfQFyA9VV9vES44ccNR5cN26zb4pLhfMzcpnTXRrLvaJ7gCnzX3X4s7ezLK7ryrn7AqId_X_qafF-n4RCyT_rLsQZDEJ0vOIWqiyYo74LkQnApUyMoyFQrAk2n3Wv2Ml2Tec0JJXGTI0godvO-Bi-fBX81LhqdUTO_hhTF2901UYfnpqEX6YQovwcRNZh61h6pvbb2VETqMjRKUW2_okmI0podxulX3BVeMLRjzy9hTXxVbekZWUtG1kOQzsqYe9pGh5O3Fx3PqQq0qUpC5i-0zjPFtQHv1IGJaspFGUmCu8WNy3sLed4zgB2TAW10KaJm_ENwN0dTwMQEeXU2O7vi1kwqaK-xbTivAgOAtpNL-aiI94yJyHRrxpDoJs6qlLu5ELB9PTsvwo-RdO7028CxPArEBCe4A1IOIcJE0O9iOYLxvRVp0K1vYxvBQe9zw8CSoAlaALSsXMdDh8j_m_AeKAQ_IoAtTuBfb2fef4P8cybq_6Yi2ZeQmfHdqIaFc1aCsfziIE8aYKiRkktPUC6mBYQf-T8XjmSjlCT0YCxb3ontwfUp9Su8fMIsdfLv63o7OwZRZylGXIdgIOK_byCYlf14aHi8YdPXfIUyTHtDvLfgYRBcfChK_xnqJvZ4wmVKESuzargHX_wxy8jlinGdTsGJEQ2LMLdtPvMhwA2PsuAFfcI5yryzYfbMFEoJ-YmwWYMCzYJQ6i0XNr1J_T8z4EfdBValkAYMHn1kBQlRFj7qLsGnEtU2rIidrKHT5YkEG_fnVQr62nLUD50jQlaBAdA9uaOzWO5kd7eX33Qu3gQyn8uM5s6_HpwNtMB9AeEB2L_mM6sLcv0DKfciV-QDNRxYRo8Rpp0w7PU_jKy2OxDe692HTvKX-jAlyYXjMyWfGpCG08W-hAaZl5vp6wUQC9NDnK6bgsoixla080VxVHeH3pcmCu2g-LhhkJZWkFaUDpNquLs5HjcWkyDHBtz9u4GEXeZCjIV-l2TUuyr2uv0WQXIZwuEM84LsHv31Lhf7Vu0eqRuVfw1pZky_UA2SISSoiJ9ShXs7aJ24vl4VdZOw43VYWMosrwoDHfgQqU9e_A-GDmqbfcNXZQlJAqaQXvVwykhKlX6fihazahxOCAQNEqCoDDLf3GEQJo29kF4aMy8cXNbM12ygUqNTMOaBOEr7FfOMblldiRIv841vzaBaqrAB81MVMDQFTmmuscN_haQjYA4KnFbgypv7ToP4JU4RbYb5sQ3TJ2_iareXNqO-0xFrR_KoYPae2UD2D9mSzhV5OQKKURUR3CHu8k3xW0m4SkomcVh41VBk9qhoqx9SALHgsmalSfD8T0p2F9dUip7itJliiNJawiGDDBG7nb_u2zKPrKDnn23Cku1Emjybr0i7uyjKIejeu_g0HvL2j6ZAi3XcAGWsTJ_SFQrtKX-GF43PYWl17dRKI3b-RIdrNlL9qVPH5DRemxPhZNU3beeobKPHm8Q3rW3uonG-hNPp5f7u0jIdFstmJNkp9M6UhrIvQQZMZ6aZfXoVOtgH3_9dyOis1g4z4dYbLxGpUBxuJ3LVoeKAZwc9oKP0Dryq5ZiaZMEuTrqIR1AdY2wC77i9dNOeLU28-FIgDeTFFu0Z-zlKUNd6PRf8KCjsvhu_MmXbeWrZCxUHS8IuMO_b0Jwo5eXVgcCeACLsKQDPufjIGiJwESaCTvNnqhlmi_-sfLwhE4KNKqzHKjCU7ocm-ctbH39d_3-SYhRNNXMXx2XTgdt_iaoICrYFhaQjJ6BjXSuVBBkkAoHIBwXEJLvs8yztRzo7IwbZPHrtLRyjLZoo2p2hLN9qunMpT6wZmwTcWSaLL203xu5WiG6n32DSh8jFyZGRhAZF59c44Sfcu6LhM0Z-d6JDxQoplWqR67dgin9kVtVwd045FT_41VoKtFjNo0YmnmOJA1V_IXci7VowvVJq1BL4EhIWVi5qxm1zXeYrICNGJwcxGHPJS5rhsgKUKlHgnx4uGfJkqpsiyIYq1OIcD-t3ntOT8GeSVfaPr0krGv6-BDCDjTBNXlrx_2AqfWB8sq-0Oj0wGQraCi7EDf5T-LFjiEyJGYxGpF7gMv2Uka5HJ2zDwCNJDPF3bpVkxuTLF0BPdZ9ZhvOSdGsQpYVhDQijK6oqSZFeSoCkhYW2rN-2vUYjYegtseFN4HUnj4vLvTVzbpvU&cid=CAASFeRooE5HYdohiHKGNMnoOxwULS7g8g&rfl=1%2Chttps%253A%252F%252Fwww.familyfriendpoems.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:00:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:00:21 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6E61 41 KB
15 KB 93ms
43ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame 1A82 24 KB
9 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ChbDBpoD4B7TV2r7aq5ducKR6Pkakv2RPwm2jle5-I1DOUDFuNHU-h5WAmP08iklTDfGJrc_7W_4jRypUuUhnGHX8pMW4ia2ahf6wueJKwMjOTcyMyyfA30SlUEovHfSjeWJ7Nxkf2xFjK53LpUFIqSDcr1w&cry=1&dbm_d=AKAmf-C_a3jsC6Pkrg8GNL7sB-h6eUU0xVGIc_TwUXCU8MZST9IhUg6dBgBJulsAQHabePfWyOPZ6zYvfqcdzGB4l3zb_qI_SvXfU4f5PRlgv5ZkTWK7Y0czRbOjeY6RDV8tqKN5r-EAcBoc0kw20m9T6968qMMK2cN9r5eCUVrYCJdyImwsy5LyjUlZfoK7_7t8RWV0srriicH6CS5AbuWMEAGqb4TmN_HgBhhijR4JoIsWD-4HFTJJe9cF6AvmV6EOUqlESaJkJ6wLf8ew0xJgQ20bLwG5jMwBpePw9Ub573LvmitZyradpoLNJmIqXOI5-NX6XOWDQH6y15_f4B2xjAKXbztQSEiyHXTJksWAsa3P7-tGKxDgT6IeGQ21OSSkDVpMdcYh9tLVj4AD4mxBFDYJOMAwzaFcAu8exWNE_7FCiY4RfFInITwM-C0gKG9GNPCuSFY_Ed3NPBeZjoHTrUeTZ72764s5YLJ2E6gAHqt_6dGgThJKEQi-qYUsW6p7fXDO37PD3x5rKSvByQQxh7mBY3Ma_20kfnwPK4Afdl5WQ8_DUwd-R7_r4f-27I81xgNCStr84ZoGCZmoKSpGbwpRkqAMmx2GHsJ0sya7NTZRV5RMZdJryzBeCA8uXkrvu-EhaP3ivpvem5Za4E8TMEZUT2MokDmbpd6md1OmU8Xn8MhMOJU0fIFBX2iAQMmnUFPiy6O1VSQosxSMV2UvfPsPkMcxtv5_bBWZhwS0wapK2gVIWyECcnbukW5I-eDUBcr75ynxi69OjtamvtKIxbfXYCV6g9y9J2PpjCdERNu-dvhxvRLnyICLz-6j65pSg5Zvq0-88wGUMtiWdkA7Pw7drICZMpuxLtCLssVQ5hFkd08mekRXaiTbhF2l0QfPd9-KxylEeqmdj9H5pFPUE7B8ApgfJAVBtVSCWwePkcsPsEVSiEQLuuXzCki6_CeppS3MbAmfBtMBiujwEaeqO_hKCvOMGTDt0vmSl2sJSXb96uDCT9AA2l0WaiSUydI0Oodj2e_ieBltwZwhY03TatHs5_lj0Rd8PGrFRsmAozQ4EZm6F_TRvIJ9JAHAvn212WWMtLxEn1rQr2iYf2Vb08VSDsy5kUdGGssGxaaUOmFKb2T-ni32PUWatcyWgOQYhT_2qmA1aIP-DCF9qRpuRA8YwG3rp0Y5MSU625QvTkT9DlAL2X1UJGLTsmrUi-FQLmWPRVaR2apJgNT8yRhV49rAmjr9QvZkKYv72utz8pMpw2wUGwBBwmKYrY8qdcJYHlubb_oAjyNplZNuowlvgp4I7IpsSaV9eO6sRp6XiPwvzj0wgkcH019C2rxw2wwvJLkyWf3S6iNL-C6ePBvrSgB_cUYPwhZLpnP9St7XOA1qevt25Cuw3z_x6SCEbfbEf2SLKQyGkiQxMpiikLhvs9mNyj2yWLyifFGwQLL2zyyAHIjf8L_e3j7gSZx9Cwo41xCN1Bk2YSZtnQ5pMV3bGMewIWXzUAreFtWEvOKsWBi-3f7nqyNtMzMcgrH6kghYJnABb3eMtQrLGGxE8Ir9nWRWNob977UpHd6kh5gLR4tWQ3z0stEaL9a2Qaai-yhLnk7X7KtqeABaOxAw3Ghu0LUpLTcGYeimLNL2xs8kjgYqPUhURwBqjWwJYewBanfRlxSx9L8yt-CYYcXa4O_prp1YijQ1Xtk3LYq3Z0Ue9FHQGmn7lcHcd19T7KBAun6lqLsb3KqinA-x0M5kIWsFJlQh5Yc12R9l6PeD4OIh2xloW3CGB3ZKy9c4Txr2QLaNKjzJ2QOpZjFeFZr8NKhntjbWbl9ujBKpWk8nfNOXVdVfSnPVG1gefPTk4d16WxU1QSF3ivXRNzMp6n2gnyUnaLMHtDJO1QYYENwdSkI8cUkqcpDs6tsPbJTLlBRxY9lc8XTmYaW8VCkb-sLUFQzH4rLz1iMdMRJoX0YXUaCWlOb0JMLosZYLLdHoJPxTjE7cLYV2SYZ9vcq-g_qz1IsVHNJRgN9zqM_6vnbWKGrzh9W3UCUzl5GFCiNi8k9I8pO4px43KL8cS1Mp8dTRX2pRsIsZ7hz36qrcckNsWqBUCawmCMM1MeGvdvZeSMg_DC1ip0wIcjhg5sWfDiRrSTs5Ep_bSUW0XDb-AKN__fct9u0iXioeAtONfmbJH1oRWevq95YYE2rA0DLwklR9aV679hKN2jFCDixJWRG2C9KUOeZXIq91H6yKlr9Jzps3C1NllNMXm5-RUVSvsqjbKGcEXTWhnE3ZrOt2xqFUAGpgttEyPsXud07uN--HHhfgal8Hp45oZURhowBIyp22-YhjUpXlI0yg7BAPa_zoi88nAaErmy21E30bCXNEcBNgesJKAWh0aygygSu_y22sHinE4nBc2WgMAc8t9mihhbC2ePm5Lp2UgdliTUZJZi4gurAUwgHerQvdAlXWFc7eRTEPYTAJ9tqGfVARKj2yKeDgzHMScW8HBoV1WCWM4-M9WjHlvzzZ9XHxjnFmQf_ciMgzQ6h-TFQ0nWZNk-fC3WzqOeonnvRmbtOJZsdeD0fSPNHE-aYXlg8IKkWOqX5YwY_xcwUJiIkF2RO6lG39ppgjoTNzNj-dhewU1QAPy2BnT53FkcMkj0Z7gTaPmltpzEbZHMtjkUQWiId70vODR_CabV1phWBkiHH-ps55N7Z69TtrmANqt0tThCAixAZlaz4n2iC6azdLfQUeiTao6g8vbhauNOGzA6dOl4N4_H98www8jATzXVuX2IfY8BrsomWaQKPvaofI_9riUfpmcvZiZgChh-TpOK7OcrW5WjU8Wfqp6qCQ2jOPKTzz9c5fvQtq2aB3Dg_54V_qVx_YeUA4sSNTP78_hADPrRl8KhA-xEqgjzVxWWOi_mtTSJ3PwV6bTDM3JH9MBbDntMABGO_T0xcTtS77t8lYePaQZv0SuzF3xqvHm-DAOrKVmHQUxMBgCIVjS5e8zl6ix-vO2gAErCeH7d-9naEljZ8UHwPV_TJXr42hfbfgRqk2QOv_8qkTwnZpGkJz4yxwf7LYQVxAyOYT1d4CqHccPma4jXl64YDzHRswM2KeSn-hbbG46XUrr29ANE8mAqf9JaXQCjXACG7ujChslYG7MK86ExQAk-Wnv0w5y8LSpu7lx9C_4s-CpLMqp8k5hQgUp8_w2HG5l9eLVmcosR1JsPlLi-a-cSufrAo8p0nUTNz75ZrmS3zYBVMjiIEubzOsZBgzgBAO49p5jdiyvN17zLt5C9cyC0OWBmzakD58AIFOsZpjeaUWRGLdIKC8uhXlhM_FguszPtm_lVxjt_E&cid=CAASFeRoeOHT3EeA9F-4OZxnLLIXyMTxbg&rfl=1%2Chttps%253A%252F%252Fwww.familyfriendpoems.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:00:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:00:21 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 1A82 41 KB
15 KB 86ms
39ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FF20 41 KB
15 KB 96ms
55ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8447
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
DATA 200
OK truncated
/ Frame FF20 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c18cf6e5b4dc6dc09b735fb1b15a9bfb6ce4e262920a40c1ff7faae3021f4cf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame B598 8 KB
888 B 95ms
48ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 13 Feb 2022 01:15:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 13 Feb 2022 02:20:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame B598 1 KB
875 B 66ms
66ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:19:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 848
x-xss-protection: 0
server: cafe
etag: 2277666839114365613
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:19:47 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame B598 19 KB
8 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:58:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1363
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:58:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame B598 2 KB
1 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:58:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1356
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:58:07 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B598 124 KB
38 KB 53ms
52ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:20:43 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame B598 15 KB
6 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:16:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 02:16:22 GMT

GET
H3 200 ff20f166b0acb5bbc58563e896201b58.js Show response
www.gstatic.com/mysidia/ Frame B598 27 KB
11 KB 81ms
36ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff20f166b0acb5bbc58563e896201b58.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:21:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11452
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 06:53:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 11 May 2022 14:21:09 GMT

GET
H/1.1 200
OK k87fl8jofdhz Show response
hal9000.redintelligence.net/zone/ Frame 6E61 11 KB
4 KB 58ms
17ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/k87fl8jofdhz?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4592bbb4558dd7e6e5e1f70590004755d3bf1d436fc928613d8d58b28eeaffa4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:43 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3930
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 impl_v84.js Show response
www.googletagservices.com/dcm/ Frame 1A82 41 KB
17 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v84.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

1cfa97d4c5c4cf2854e01ce2046be1c05e6bc76519d644aad6aa4f1d959efbe4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:25:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17214
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 14:39:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:25:43 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F807 22 KB
8 KB 40ms
38ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 3867
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BE7C 143 B
163 B 39ms
38ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Sun, 13 Feb 2022 02:04:52 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 951
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 B26967115.327978408;dc_ver=84.245;dc_eid=40004001;sz=160x600;u_sd=1;dsp_id_0_=64;dc_adk=2228999113;ord=qm1e8k;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Rgd-2oIYo... Show response
ad.doubleclick.net/ddm/adj/N718661.4186494APEXDV360/ Frame 1A82 73 KB
28 KB 190ms
80ms Script
text/javascript 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N718661.4186494APEXDV360/B26967115.327978408;dc_ver=84.245;dc_eid=40004001;sz=160x600;u_sd=1;dsp_id_0_=64;dc_adk=2228999113;ord=qm1e8k;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Rgd-2oIYo3mC8i53gOFiLfQC9z-sq1on43Sl4UQh7a-z4gKEAEg_4CrH2CV4pCCoAegAfbSzJwCyAEJqQLACNMsjQqzPqgDAaoE_gFP0FmCLt8JvY7FsdzSrN4ophJhmYOVBj6-P30zDzz-rkD8a1wvxcObBvBQEfFLuKEwoCRbOk4PlJ3RrpLa-a9bCwSgMT18gkTWjwd8HYw0Q2tRneYIPCv_6lCAUR4Dc7cK4BzDHtHB1MhT8QBuwllpaiRnH-mv500f0Zf0LcDAALvM2aeKOvi9Xi5itCVU5-BdJuf-7ZIHXnjPDrJBcgGvUF7iE5i_824cw1gMJ4CfemsFNxKk0d2psmuYuRzAuih05yGMYLVotXkpKOT7RsAuTUv8knOUq5Lu2RUK5Yx64kKEmpqdhdEsa870IjF7omw2O_KzlpsjmhkyblfPKMAE3J759_QD4AQDkAYBoAZNgAfyrLPjAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT5PGYDsgT3-GM3wPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoeOHT3EeA9F-4OZxnLLIXyMTxbg%26sig%3DAOD64_0FL6kLkv7jouW2ZcPiY7yaaQAcOA%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-BonJlUd0n4NGOtosWvm7BecQ0KX5Css8L_NIutrEACwxZKAY0_fcqB57dXtweb3pW1vhgfKSrimbB7Pps0pyANNlpus_8dvRgunOiaIwjan9KADKPobBkIcKI0XcX4hgkrf8EUx8x6mIVoAx27YPMgVFYqjg%26cry%3D1%26dbm_d%3DAKAmf-DQrtdIDnMVZe2J_-bZdyd1Z4a4ErxDyAJlFCl6ltNN2xVHTOrtamdsIwSMOdifh7hBisVxAVLQKROonn_tsZaRIg5jq1iuJQztRtoxo_c9NflkD3CXmeFWTB8ptYUjqNHvuSUQm9MkINKuW8D6ry454iTUokbStOP1aJhPvJc0QjLK5vimEsIKs5cRwKrwP0OOnr88FAu0FmMEZ49st-6sxp0sYegl5vuf7_UdYhohIgImQSDFljfBaqiE_aok5EZSmAsb8ouOeNQRn4SbJFw69axHvwY7kmdz2dTmkknSViNBYIfAutKmQ7761pRhB0_A7RYi3K9M56e3SdyBf4iFL93c0Eddauz41vEYmnGmr8feAQ5qSlYHcNd_oRGEBH73INPmcY5DzzIVb5ctrvo8sum3jBxhz2nP9zDj5ejt7M1rZJFzLREzpJmeBRW-B-Sj-3InZpoVyOVsmLRxN825tbWZag%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%2C%5B%5D%5D;dc_rfl=1,https%3A%2F%2Fwww.familyfriendpoems.com%2F$0;xdt=1;crlt=NZICHUJ44F;sttr=51;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v84.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

f1fc84899fe247feb3cf0937489d12ba0fc833c97f2fbed286b686d426cbaed8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28515
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
hal900011.redintelligence.net/ Frame 6E61
Redirect Chain

https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

105ms
83ms

Script
application/x-javascript

138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ancestorOrigins=https%3A%2F%2Fwww.familyfriendpoems.com&random=4156681561085&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 8a63201ec7bd8c7a126f5f9b27d2681e52f0b17bd104c6d18fe99bd746359477

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 89722800015453200710580011869011
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1264
Expires: Sun, 13 Feb 2022 02:20:43 +0100

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:43 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ancestorOrigins=https%3A%2F%2Fwww.familyfriendpoems.com&random=4156681561085&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Sun, 13 Feb 2022 02:20:43 +0100

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DD3E 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 3867
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B5F6 22 KB
8 KB 40ms
38ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 3867
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame F807 35 KB
13 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 20:48:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 12 Feb 2023 20:48:43 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BE7C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

78ms
78ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 13 Feb 2022 02:20:44 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 02:20:44 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 13 Feb 2022 02:20:43 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame D299 35 KB
13 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 20:48:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 12 Feb 2023 20:48:43 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3630430972408758272/ Frame DE8E 261 KB
31 KB 81ms
37ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3630430972408758272/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b6c5c61d31d9a294660a1999928903900aadb1eda143065f81b59e3c4770cfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 31830
date: Fri, 11 Feb 2022 13:52:42 GMT
expires: Sat, 11 Feb 2023 13:52:42 GMT
cache-control: public, max-age=31536000
age: 131281
last-modified: Thu, 20 Jan 2022 15:37:33 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF20 0
571 B 195ms
82ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstaNDRpW9SOUmabUApjzPAIqzL0dBfnsn8HlL21Paa3UhaDSZ1UgMkhblNxVKmFcLnBWvepdrNScWrOVab7PVJ9wkEJxQvgiqVh13f8WmWDNOZLOv_ttVH_0Kri0P64rjMjsrWzY94axsRgF-dqS0UR3Ti8eDb85qIya35dOw5GiBSn90gKbxf0qyuOCr_-rHQeU5LVW8oCH3ohLn22MvF2H1kEuZGAENNEn9w4Hwp84ecb3-gmGajLYnMG5z46edMsaB8xSfZgLjEJJiZHEbqcnPQdjFpxNDzKKVAb9rlsDHJBUzj8nsRYAYaTOkEl4f3Pwdd8wU8eOd7ODvOanMAhlpCoGZyfM-16I3tf-2OSIul0NTQmOnyHRFd58UGZxgU93AlW8_LLlXUK9_JylQscVf15IBkQpvXiUW94pR3tvUC8331bg7UnSQGowKz7kIrgHs3bHuehtTXdG4ldCOmhGcqNLDwEvewwbsfnb_qcEDDEAhEVsRoSjGa8IJZzJ0I8b1TeeVU_xPgmHPsFkOwPSqCBr8ityrRfwfGn2sh488Uq0oOn4u3QsfeVF9oiGNcBKhFVL2xpkQr5Oa1yWgTYLijs6sGudmT8r7_lEvOM1yXwmRACyE0gF5MpS2nVIJ2aM1VUVSHLyf_je-kic_2wCVLecZra6PRFA9Zi_4HSgQu06V__yqOEpMlz0PgFNC9AoyoHvQraxl_yAxX-gwBCPkvVts7vBPBSnZ1nrJw2pQDLpN9WXxekfHx9D2KPzljd9ayF3v2iHeBTACpCbMJXZwZi11SZf-Rd-N6pYkCF8JwQqP7cHGchPlM5B4I5wMddonVvuXKQU7vD-BCq7uPs52vRLwg1qOZ2jS8xfSSPTc7SxtEo07fafWU3tBNoBeVYRhZ0ZiMIKXDkF64eAMD9vkU9bbPPAzFUQTPcWXX6HrJbg8uicBNWEXKHagGcqznQXhpwZkSkKawwIRmmlYATsfhUnmgWAwl3CVZ6YTim1KBgDiq1QlbmB6S6hlkNQm3OE5M9w52USD_FfPLPFsILNUvgZ0kjcVKFoQWvtPhJZGZYi7_YAoZZ36qgJhqx7hPg7vJk8n8x4TGTUxpeUYLw6FyEQ38Ot_JqbaKIqnTdi2zNczIlQWeX4JMXWYK6fyGrH9oQnfQTPX7jJ5-tWRU_43MlHXt4PiRzPGfENcN4RPdI1D_At92LyPcEHrs5BQq7NFILs4troQ&sai=AMfl-YTTgzwCxN6Y_nSVRiQV3Mt39tgz7KtL6mSRyBhSFFUNf7R2c0UgFNoyLaGmRdDq3BWfubAXYN_kHnAm6N3AGd7MNMlmVeYRJ4EQMtiAfvoUHp7ZhlKc8dYphxvI-bVpvpCtBhdXfWRDflOvr1lwcrO4p5j01VeAq4xaZl4&sig=Cg0ArKJSzN0TlM587BG3EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=234&cbvp=1&cstd=231&cisv=r20220209.51323&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 13 Feb 2022 02:20:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame DD3E 35 KB
13 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 20:48:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 12 Feb 2023 20:48:43 GMT

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame B5F6 35 KB
13 KB 40ms
40ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 20:48:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 12 Feb 2023 20:48:43 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 3C0C
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=89722800015453200710580011869011&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89722800015453200710580011869011&actionid=981741&produktid=&dt_url=

0
607 B

66ms
28ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89722800015453200710580011869011&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ancestorOrigins=https%3A%2F%2Fwww.familyfriendpoems.com&random=4156681561085&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Baienfurt, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Sun, 13 Feb 2022 03:20:43 GMT
server: Microsoft-IIS/10.0
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Sun, 13 Feb 2022 02:20:43 GMT
content-length: 0

Redirect headers

Server: nginx/1.17.5
Date: Sun, 13 Feb 2022 02:20:44 GMT
Content-Type: application/javascript
Content-Length: 0
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=89722800015453200710580011869011&actionid=981741&produktid=&dt_url=
Host: pv.medialead.de
Proxy-Host: pv.medialead.de
X-IPLB-Request-ID: B9D59BA9:8E1E_91EFC182:01BB_62086AFC_5AFAF27:1E71C
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40027

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 6E61 1 KB
2 KB 245ms
128ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3392345&wgcampaignid=99582&viewref=89722800015453200710580011869011&js=1&nw=1
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: a566a0d4e8751d318f54a3c4a59ae1de0fe7fca579e4034646906d38add0a4e1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:44 GMT
Last-Modified: Sun, 13 Feb 2022 02:20:44 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1239
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637 Show response
5994599.fls.doubleclick.net/ Frame EE41
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637?

391 B
345 B

104ms
54ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637?

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

5f0df50948209936e7aea89d2a41fe3abff7609fd15c8501d745a9281acfb7e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 13 Feb 2022 02:20:44 GMT
expires: Sun, 13 Feb 2022 02:20:44 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 13 Feb 2022 02:20:44 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900011.redintelligence.net/ Frame 50B2 7 KB
2 KB 38ms
15ms Document
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request.php?zone=k87fl8jofdhz&nw=20&renderingType=javascript&namespace=46f7cbf533&subid=&uid=144fa15daa875d8d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCu05Z-2oIYozmC8i53gOFiLfQC4_g-IZT_bGLpMoM8C4QASD_gKsfYJXikIKgB8gBCakCwAjTLI0Ksz6oAwGqBPcBT9AOWTaJseafS4hBJyNXjIlZ1tn0NyzPhqMYseR7qMWmN4IfDYRHLGils3svtOmIaO0-HANwerCr1QC_Bt4uYK1MJcIvqDFK_0t_PNkJzMQdKMnpxHlsM6rrz4-bgz9ko5w_AqQUk63Co0DzH4Dn8y51H-VrZWSXFuoJI4E42TNtlIVgYoQMfvB2UhRJX9xKuBiFhkvAlb4Q6TgmGmbk9pJ07DpzvCrk08OX31rWK5j5XeZv2vR6yanLAL2Quso3pdDfpJKGzTXMyAOdqBy5TbkfDcmsz9X-r_Xa8OrjHE074isYnACgcX9s_OWi7iS9f0VSj7zzysAEu_GowM8B4AQDkAYBoAZNgAfr5-heqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgdgAoDmAsByAsBgAwBsBPcmesN0BMA2BMD2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASFeRooE5HYdohiHKGNMnoOxwULS7g8g%26sig%3DAOD64_1kGdhE5jy7HCst_WfIibWDGiKgRQ%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-AjeKo7nG-RUXi7zWVuDVl6_tH39eQqYJlUaodYLS1M7ZBQjDNAlibwa9BjnmpoSd_nMXVIiKoTDF1SVX9HUAdjWIDBAy9XvOux3NkU7EBhgEJHgN3jt6W3rSfFffek9ntdU_tHU9p9PBLwfBErKsh5XRiOrg%26cry%3D1%26dbm_d%3DAKAmf-AkOZ7rfYxxC-gdUWL2O6Wl4_6eHOA95EmaSWV1L_Y2DJPXts-vZydi5q7cY2392rGuAEP6joDcwCcQ476Tutd7VZ9hp4COqI-gyiNcR4Ofnwm5tjL90q64cJzY8-8yLilMIM0CpYher7tKlx4D36_RC8aTdb62sIzMYH8GHwMF3CtpPhzojvFjCl_Jy8hVdCON_iz4gGiGZDyWX7JkQBBW3tPebBxW66yS_W5goSAYz9rt_PFgqGVitgAm2dtP3fY6yOEwvz5kYTUWxPQjJGITZddHz-dG7UTAykR-JaPaqpl4-di1wokQ5jS9tNwwfHB_OGtQnA5vJxKqi9zRTEmCXZJks99a7Hjg-Zb3hFKkfYMSLKFB6xc0v9PF5Yh2A3a10C2YvOTO-Cab06F3UledQajamhVDVatSwC9i3niwbzSRheyvSMnwyZX85nOXj_GRRTm_U2Q4XMWLHIfPkGWMBPOTNw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.familyfriendpoems.com%2F&ancestorOrigins=https%3A%2F%2Fwww.familyfriendpoems.com&random=4156681561085&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9c4a14ce668f7d210058d8a2520673aead799e203e6fa1f211c50130ab062897

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

Date: Sun, 13 Feb 2022 02:20:44 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Sun, 13 Feb 2022 02:20:44 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2101
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 6E61
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=89722800015453200710580011869011
https://ad-server.eu/wm/pb/native.png

68 B
312 B

181ms
34ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:26:21 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Sun, 13 Feb 2022 02:20:44 GMT
Server: nginx/1.17.5
Host: pv.medialead.de
X-IPLB-Request-ID: B9D59BA9:8E20_91EFC182:01BB_62086AFC_5B057AB:1E71B
X-IPLB-Instance: 40027
Strict-Transport-Security: max-age=15768000
Content-Type: application/go
Location: https://ad-server.eu/wm/pb/native.png
Keep-Alive: timeout=20
Content-Length: 0
Proxy-Host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 6E61 43 B
702 B 38ms
15ms Image
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2519595&v=14098&q=379097&r=296283&pref1=89722800015453200710580011869011&pv=1

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:44 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
DATA 200
OK truncated
/ Frame 6E61 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0bc0d28b452ba97a2dd466d1a5abbd1b1ba66641c696ac5c971338e4f2644f81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/902187/60813169/ Frame 1A82 231 KB
76 KB 147ms
63ms Script
application/javascript 52.48.8.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/902187/60813169/skeleton.js?ias_dspID=64
Requested by: Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.8.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-48-8-1.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f5e1d091d5c366c23a13861b5c64311655fe860e95e13387582268f4bfd313e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
content-encoding: gzip
x-server-name: app05.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 1A82 106 KB
37 KB 86ms
39ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
Origin: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8449
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 23:59:55 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame 1A82 8 KB
3 KB 39ms
38ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N718661.4186494APEXDV360/B26967115.327978408;dc_ver=84.245;dc_eid=40004001;sz=160x600;u_sd=1;dsp_id_0_=64;dc_adk=2228999113;ord=qm1e8k;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC0Rgd-2oIYo3mC8i53gOFiLfQC9z-sq1on43Sl4UQh7a-z4gKEAEg_4CrH2CV4pCCoAegAfbSzJwCyAEJqQLACNMsjQqzPqgDAaoE_gFP0FmCLt8JvY7FsdzSrN4ophJhmYOVBj6-P30zDzz-rkD8a1wvxcObBvBQEfFLuKEwoCRbOk4PlJ3RrpLa-a9bCwSgMT18gkTWjwd8HYw0Q2tRneYIPCv_6lCAUR4Dc7cK4BzDHtHB1MhT8QBuwllpaiRnH-mv500f0Zf0LcDAALvM2aeKOvi9Xi5itCVU5-BdJuf-7ZIHXnjPDrJBcgGvUF7iE5i_824cw1gMJ4CfemsFNxKk0d2psmuYuRzAuih05yGMYLVotXkpKOT7RsAuTUv8knOUq5Lu2RUK5Yx64kKEmpqdhdEsa870IjF7omw2O_KzlpsjmhkyblfPKMAE3J759_QD4AQDkAYBoAZNgAfyrLPjAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKA5gLAcgLAYAMAbAT5PGYDsgT3-GM3wPQEwDYEwqIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoeOHT3EeA9F-4OZxnLLIXyMTxbg%26sig%3DAOD64_0FL6kLkv7jouW2ZcPiY7yaaQAcOA%26client%3Dca-pub-5811587082793834%26dbm_c%3DAKAmf-BonJlUd0n4NGOtosWvm7BecQ0KX5Css8L_NIutrEACwxZKAY0_fcqB57dXtweb3pW1vhgfKSrimbB7Pps0pyANNlpus_8dvRgunOiaIwjan9KADKPobBkIcKI0XcX4hgkrf8EUx8x6mIVoAx27YPMgVFYqjg%26cry%3D1%26dbm_d%3DAKAmf-DQrtdIDnMVZe2J_-bZdyd1Z4a4ErxDyAJlFCl6ltNN2xVHTOrtamdsIwSMOdifh7hBisVxAVLQKROonn_tsZaRIg5jq1iuJQztRtoxo_c9NflkD3CXmeFWTB8ptYUjqNHvuSUQm9MkINKuW8D6ry454iTUokbStOP1aJhPvJc0QjLK5vimEsIKs5cRwKrwP0OOnr88FAu0FmMEZ49st-6sxp0sYegl5vuf7_UdYhohIgImQSDFljfBaqiE_aok5EZSmAsb8ouOeNQRn4SbJFw69axHvwY7kmdz2dTmkknSViNBYIfAutKmQ7761pRhB0_A7RYi3K9M56e3SdyBf4iFL93c0Eddauz41vEYmnGmr8feAQ5qSlYHcNd_oRGEBH73INPmcY5DzzIVb5ctrvo8sum3jBxhz2nP9zDj5ejt7M1rZJFzLREzpJmeBRW-B-Sj-3InZpoVyOVsmLRxN825tbWZag%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%2C%5B%5D%5D;dc_rfl=1,https%3A%2F%2Fwww.familyfriendpoems.com%2F$0;xdt=1;crlt=NZICHUJ44F;sttr=51;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 01:35:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2705
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 01:35:39 GMT

GET
DATA 200
OK truncated
/ Frame 1A82 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a53a65a1441581d62f14cd619380fd1816bb4214b833ce563dedd75e95b6a71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 044A 22 KB
8 KB 39ms
39ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 3868
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame DE8E 29 KB
10 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 12:53:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48451
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 12:53:13 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 50B2 1 KB
419 B 48ms
48ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ea795a298e37c1cd48937e8d9b242162d213ebaa07c997769a6bfe4b4d8ec411

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 13 Feb 2022 01:22:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 13 Feb 2022 02:20:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 13 Feb 2022 02:20:44 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 50B2 16 KB
16 KB 36ms
14ms Image
image/png 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: ca84e6bb352092092c62f8bd21dc40128e16022c329e086ffa17596cd4634e44

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:44 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16464
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 50B2 17 KB
17 KB 38ms
15ms Image
image/png 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/3839/creativesup/father_daughter_1200x627.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 928d79b45785aa533e8196c50f02586ea391120500ca3ec7ebbd5fe21f92415a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:44 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16858
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 50B2 16 KB
16 KB 150ms
127ms Image
image/png 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52085/creativesup/affiliate-panini-familienzeit-banner-1200x627.jpg
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d78c3f283d517f14f23929c28ded0a2ef2a00a562736f7face1cdb4eaa887d90

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:44 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16145
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 VolvoNovum-Medium.woff2
s0.2mdn.net/sadbundle/3630430972408758272/ Frame DE8E 38 KB
38 KB 37ms
37ms Font
font/woff2 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3630430972408758272/VolvoNovum-Medium.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2675ab1d1852f1aa30e272d7c2b1b9616e1f4771a94860e0d92bc7fca6c3c48a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:52:42 GMT
x-content-type-options: nosniff
age: 131282
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39068
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 15:37:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 11 Feb 2023 13:52:42 GMT

GET
H/1.1 200
OK viewability Show response
hal900011.redintelligence.net/ Frame 50B2 0
150 B 40ms
17ms Script
text/html 138.201.64.38
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900011.redintelligence.net/viewability?s=89722800015453200710580011869011&a=606862c7&vb=m
Requested by: Host: hal900011.redintelligence.net
URL: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.64.38 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.38.64.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900011.redintelligence.net/request_content.php?s=89722800015453200710580011869011&a=a8013199
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 02:20:44 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FF20 0
23 B 124ms
77ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstaNDRpW9SOUmabUApjzPAIqzL0dBfnsn8HlL21Paa3UhaDSZ1UgMkhblNxVKmFcLnBWvepdrNScWrOVab7PVJ9wkEJxQvgiqVh13f8WmWDNOZLOv_ttVH_0Kri0P64rjMjsrWzY94axsRgF-dqS0UR3Ti8eDb85qIya35dOw5GiBSn90gKbxf0qyuOCr_-rHQeU5LVW8oCH3ohLn22MvF2H1kEuZGAENNEn9w4Hwp84ecb3-gmGajLYnMG5z46edMsaB8xSfZgLjEJJiZHEbqcnPQdjFpxNDzKKVAb9rlsDHJBUzj8nsRYAYaTOkEl4f3Pwdd8wU8eOd7ODvOanMAhlpCoGZyfM-16I3tf-2OSIul0NTQmOnyHRFd58UGZxgU93AlW8_LLlXUK9_JylQscVf15IBkQpvXiUW94pR3tvUC8331bg7UnSQGowKz7kIrgHs3bHuehtTXdG4ldCOmhGcqNLDwEvewwbsfnb_qcEDDEAhEVsRoSjGa8IJZzJ0I8b1TeeVU_xPgmHPsFkOwPSqCBr8ityrRfwfGn2sh488Uq0oOn4u3QsfeVF9oiGNcBKhFVL2xpkQr5Oa1yWgTYLijs6sGudmT8r7_lEvOM1yXwmRACyE0gF5MpS2nVIJ2aM1VUVSHLyf_je-kic_2wCVLecZra6PRFA9Zi_4HSgQu06V__yqOEpMlz0PgFNC9AoyoHvQraxl_yAxX-gwBCPkvVts7vBPBSnZ1nrJw2pQDLpN9WXxekfHx9D2KPzljd9ayF3v2iHeBTACpCbMJXZwZi11SZf-Rd-N6pYkCF8JwQqP7cHGchPlM5B4I5wMddonVvuXKQU7vD-BCq7uPs52vRLwg1qOZ2jS8xfSSPTc7SxtEo07fafWU3tBNoBeVYRhZ0ZiMIKXDkF64eAMD9vkU9bbPPAzFUQTPcWXX6HrJbg8uicBNWEXKHagGcqznQXhpwZkSkKawwIRmmlYATsfhUnmgWAwl3CVZ6YTim1KBgDiq1QlbmB6S6hlkNQm3OE5M9w52USD_FfPLPFsILNUvgZ0kjcVKFoQWvtPhJZGZYi7_YAoZZ36qgJhqx7hPg7vJk8n8x4TGTUxpeUYLw6FyEQ38Ot_JqbaKIqnTdi2zNczIlQWeX4JMXWYK6fyGrH9oQnfQTPX7jJ5-tWRU_43MlHXt4PiRzPGfENcN4RPdI1D_At92LyPcEHrs5BQq7NFILs4troQ&sai=AMfl-YTTgzwCxN6Y_nSVRiQV3Mt39tgz7KtL6mSRyBhSFFUNf7R2c0UgFNoyLaGmRdDq3BWfubAXYN_kHnAm6N3AGd7MNMlmVeYRJ4EQMtiAfvoUHp7ZhlKc8dYphxvI-bVpvpCtBhdXfWRDflOvr1lwcrO4p5j01VeAq4xaZl4&sig=Cg0ArKJSzN0TlM587BG3EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=615&vt=11&dtpt=381&dett=3&cstd=231&cisv=r20220209.51323&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1A82 124 KB
38 KB 53ms
53ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:20:44 GMT

GET
H3 200 160x600-V01.html Show response
s0.2mdn.net/sadbundle/1428878293222563042/ Frame 2A26 6 KB
2 KB 38ms
37ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25d3e02fd287b7342176b3387803c866b5ba43f636223aeb1e5f2abf6987e20a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 2359
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 07 Feb 2022 09:35:32 GMT
expires: Tue, 07 Feb 2023 09:35:32 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 27 Jan 2022 13:18:33 GMT
content-type: text/html
age: 492312
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1A82 0
23 B 112ms
76ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuielq37gEzWxq0gmxdIMM4t0x2jPCFqoTJZOgoGi_LC-Vs8CwsoM3Ldwhyfg_LR5tsdLoe-wns6ODfWHfXkG9lJqkqFgUzsVMJKbgGc2coIKVpUr-1QPXEOE9YzwbsOSm-MhZ3bCt1AJq8Do3vRqOPeQXuU-U8Bc6UQ7Cp&sig=Cg0ArKJSzKz_g_-JxE_ZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=196&cbvp=1&cstd=194&cisv=r20220209.58634&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637
adservice.google.com/ddm/fls/z/ Frame EE41 42 B
63 B 72ms
72ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIrx05PP-_UCFeTREQgdG9YCIQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=529963035568.4637?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Volvo_Black.png
s0.2mdn.net/sadbundle/3630430972408758272/ Frame DE8E 5 KB
5 KB 38ms
38ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3630430972408758272/Volvo_Black.png

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5be30616d437d2baf9041a6648598542ae30fed30d261b002266e5d58969685

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:52:42 GMT
x-content-type-options: nosniff
age: 131282
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4824
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 15:37:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 11 Feb 2023 13:52:42 GMT

GET
H3 200 Flash.png
s0.2mdn.net/sadbundle/3630430972408758272/ Frame DE8E 3 KB
3 KB 38ms
37ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3630430972408758272/Flash.png

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

baea5caffda9109fe3fe251376d60a25ea43c846fa7bb8dc4b15da44a78c6760

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:52:42 GMT
x-content-type-options: nosniff
age: 131282
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3431
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 15:37:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 11 Feb 2023 13:52:42 GMT

GET
H3 200 Floor_extend2.png
s0.2mdn.net/sadbundle/3630430972408758272/ Frame DE8E 56 KB
56 KB 49ms
49ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3630430972408758272/Floor_extend2.png

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f93264606087b4c1dd4e0bb8bf2ed92549c53fe8b5f095d214c4e72a765f5482

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:52:42 GMT
x-content-type-options: nosniff
age: 131282
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57259
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 15:37:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 11 Feb 2023 13:52:42 GMT

GET
H3 200 Spritesheet_XC40_MY23_4.jpg
s0.2mdn.net/sadbundle/3630430972408758272/ Frame DE8E 783 KB
783 KB 40ms
39ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3630430972408758272/Spritesheet_XC40_MY23_4.jpg

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a082bfd96630ab857ec08e4e0055175aae987aea275d450f048ec3fee5de5383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3630430972408758272/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 23:34:13 GMT
x-content-type-options: nosniff
age: 182791
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 801309
x-xss-protection: 0
last-modified: Thu, 20 Jan 2022 15:37:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 10 Feb 2023 23:34:13 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F807 0
22 B 49ms
49ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BAzoX-2oIYpW-JtuA7_UPrOSEYAAAAAA4AeAEAg&bg=!XF-lXxvNAAbAtJCDwLQ7ACkAdvg8WnSpKzG9MICwdzAXm3axnDQHRO9e9F9UMT_wYWsptqrPaMwOxQIAAAEoUgAAAAJoAQeZAwiTkoQfqnS6pqWunIaO-RoUblkVVapGr1VuVg6chwC2eKcxOfTAO1qJj6GqMeo_yBvz7xviFmHGlTp9F8wzadyWHLFiRSjmofN1Uo37-bLNioVz5OZi60Mg2BF12Tv1seZeO8UfqaVEhKVAAMXgoP9HsZUOnoXsqk9F263TO5iWbYOXztE4ZpSQFyftm7A1hJ2Byqjcqw3PZqL5d-ISQGdP7WrcevGivhcTIfWdBSAujvP12mdww_bHPaHBKnxDaxECQY5EJ2Et-a89plF_AvGVfgnM3zJ5JmMrLXAaUaDEk8xoNtejbyrlDwvRA4euSw5RZsS3UqqkNkYl5_NqIixqaowJ-ICYn-vh1Ide0wDpI0V6_2o4gn981UkCFejC7yO8CBWP32vDivJp_rJnsJZ7pceFcttxPmcnqRjqfOuHKI6OzlnzKVVUQ-AOq8jpHxYQb26O-S4VF__lQf2Ccbccz6csxkR0khe9nSVcnG_970z2sGUOg6Q1fFXfIg715IY4uqBSxUX9dyGPZemR8h6ZpHIJd3z7PvK_UiSy2tD3iFe1g8qsVF2gWbWB1IVbb3TdJ_agmduhEU5zW6ZLMFCeHOKa1rAfbV0E0WlWjDj3318_0TLxB6eYZRi3Pf12FpzjRBJKC2GgnUfWMn0HZ0PbHdlbSzxX7y3sQ8FRAwD_Z2oMoDRG19B-dnEz9wLkFldHvhEcppowMDZpcSsavEJLzjw_lWYFNRYJ5Dkf8-_BNPv-MFexe6nIqpjKXH_e63Spql1yWRddjwHGqdzdgmWsDHDPYJ0uCiwSdqDk43U29RiEYNdhzRp3kJSuhdHAoEj730tqZtpshY3NCVRHI-IhkcUwmiEyVd08e_KcR_pyBL2haJVAL9QS8PCTe_QYQbiOIs6Ihjxbd2tyBodLc0o1G4giBcb-NFgor5B1Docjdb5gOBB3DXNWTTynbr08VvwWoeoxa-66sKSRQfP2dg9JnDBKiMUgfp1pQAobwatMEA04gKmmOMwDNwNGQlRhI6b2Qtc1vVofzg

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B5F6 0
22 B 49ms
49ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BOrLH-2oIYonBJJaQjuwPoNOrgAIAAAAAOAHgBAI&bg=!mZqlmt7NAAbAtJCDwLQ7ACkAdvg8Wt2uYsdoW7TPtOl2Kv4T7mJDRMu-Fccszu6Kfs94fbz7nZyhQAIAAADmUgAAAARoAQeZAxJwol3041II-PjQF39pma1tsy3ryV4Jm-K6kcz07BWyL1zV51-_ARB6Xqev9QSZr5wGYxgQKVXk41OXm7kgSpCWSyvvWSrMkrbs6blyWGqJZh5SeIzsq_F5XIFE2Tdlm91sM4okC-TLH3lq6FKPKvAXG59do9vd5dFGUU5mVbF1l__kyO-XzeYv3GnIXLs59QEva-BKKzgr-U8p7lDT82HOoBq7AdPlUfxukguETj6derzOxtIoDA_2PcC1aeQE0MpuOO1ZObJm2Qu_rwOKLTwrx3p7xCfOzoeb5Lm8Ea3gRGc7fHwIOvtEieazW-hHKj7aucVRD1qMgA_FMtDXX5KjLT3X3E9fORf3CVYa-X6dAP66OrQpR4HWBIftS7MgR-ZqIGZw0XMzXEEjESKOw1isFiuY5zXnL7FEQis4QcfibTTgZ1B_uRutz0fDCpTA7eH500WsO9iGTXpMVjzGqlAvOpDDzZ8CS6i6jn-eUhKkpYF0i6byPanu2U-vRhZFpGK-At4P2r0YlDVqr6StVJsw1E0Di7gCWRzLTzqL9lGqrFQQ1GDlu6eMLoC4xvvL_7XWZM1tnXH27fUtTxltDDYGQSbJ8bT1NGmKpYMlGdNijajSryalhi77zG80Nv_FUHHfidT59zDdWB-uk6lUfjSOI_Fw_jgsP5vB6VUrE6GwoPd_55oKTJkyRRWJv3r-vmA2cgjxSeh3OMS99yzNYu1tN9pI-YQ23QliglVRXZ_W3T6FMjmK3uUZro7Rj71fdR-hUB4ZBjyxM78OS-MbciAsyvshaJhtugJiNFbhUJBZ-jRDnrJm3ARzmaW7bxQ01bZxz8sQV8R7xL-lEuM6BKmSMu6S16K1S3ArK209OHbAOPyH2UzMWo8CqtPJ29hcUh9rdVJ3UnB9oc_nuUG42_nLFNCgg4U2DY51vVt3PzKZ1lslZp17JecJWsGy7yLvIvfm3MKTVaNSGCexEZx5K5fkNgEVzCZbo63RFVcL_LFLCZj3D3XLzBSHw2AR021ZT3mMbKz3QpDozjqr8HPzNNfLBzc

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

4a.js Show response
static.adsafeprotected.com/ Frame 1A82
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/902187/60813169/4.js?ias_dspID=64&adContainerId=brand_safety_-2oIYrToO9n53gOe-ZOQBQ&cbFunctionName=goog_wrapCb_-2oIYrToO9n53gOe-ZOQBQ&true_pb=&adsafe_pb=https%...
https://static.adsafeprotected.com/4a.js

2 KB
1 KB

41ms
8ms

Script
application/javascript

2600:9000:206f:8c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4a.js
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:206f:8c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b2f85dea6d6e5244f125014ca68be395c013e8d9e08fb7be92a03cbeee56500b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 21:45:01 GMT
content-encoding: gzip
age: 189344
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 10 Feb 2022 21:44:58 GMT
server: AmazonS3
etag: W/"83ffaf1be9ebb33024dfbfd1cc7910ef"
vary: Accept-Encoding
x-amz-version-id: w9TePs4d5.qX8.suy2f6KPp9xS6lbZh3
via: 1.1 f2fa38e6635ded6d22a69d089217bc90.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: FRA56-C1
content-type: application/javascript
x-amz-cf-id: U_AA7dp7k2XSTK_U22d91uFqwDvFfClS_52QYlNRakWj4A3qtg5Rfw==

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-server-name: app04.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4a.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame EF53 80 KB
21 KB 62ms
8ms Script
application/javascript 2600:9000:206f:8c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:8c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 15:56:46 GMT
content-encoding: gzip
age: 1592639
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 f2fa38e6635ded6d22a69d089217bc90.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-C1
content-type: application/javascript
x-amz-cf-id: MFeqKz1QDynp2lUSfDUlzpRTfTo62QKy5Ir0wsW96Sq2wplcS_wb3Q==

GET
H3 200 O0zcrAsc3s2SKI8Tuz5umMJoYZUI79PNRri5GeZhfeg.js Show response
pagead2.googlesyndication.com/bg/ Frame 044A 35 KB
13 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O0zcrAsc3s2SKI8Tuz5umMJoYZUI79PNRri5GeZhfeg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3b4cdcac0b1cdecd92288f13bb3e6e98c268619508efd3cd46b8b919e6617de8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:16:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13545
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 02:16:10 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DD3E 0
22 B 50ms
50ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BxbU1-2oIYqj4Jo6G7_UP3PeC4AIAAAAAOAHgBAI&bg=!-fql-r7NAAbAtJCDwLQ7ACkAdvg8WkRrxAu-4qXOiWMU_gWUWvwjho4EKjMHyAUEzQPFB5sVPb2ZKQIAAAEOUgAAAAFoAQeZAvpDhRb3hw4XTxy3STJeEImGuYYYkwSH7-IiwBg3XdAklumEocxf9IVW12GfNCW-IEHPePENEHSpdq5h5K9PYVvm8CRUtKbPh7zn6lQwMAIKlwfDdZhV5vgI6rbaaVrTFbwVBHmxynJkytQ_7GM_Lm9Do_D-GwFq_nhdWmXWr-q479rRil57gBlh-T8qNcB_PvIXUVsYORZwvqSFXiQSsu3SiiO2UnJLG4iLpTtkRuTCf7VHfmXRvTyxMjIeRsI6CpFCNJ-FvPG1VnNLzXsPsNoIdJi6MDgNG72iSeBvEnEdgS19J7nkB81h_9dw4doEBR3Cgcz2lfBqSY8wC1dON7LjczjwAV3EUayD3LJJ9rrRE5YhjwLj-bZbGiXveF56cdG6qp8t4GUZX1hj2peqR8nHM3D_l76w2bxPT30ZvKQ68plJpJl-6KeVakN8uQyq8IDbciVXDN2NxSLjpYtYzT-vrJx2KK0B0G9-x7KMcuZB9JOcCVqKVljaCeWjIrOA9SP554_TjxQ2S2mpv-MCMelZ1Jtbi1CWXIKt6qwGJmZk-aMcm6Wqbgyr76PqZE7NNLegQt3AMIDQc89j1wM9jsi4a8sc1D7MIFnE3OhHKgtiXaolfGrKKHrbp4wYklRkG-170sYrP1ROQv9uiAUX3hB5AT-ubDxHU-8CWASr6OJ_gGyyzuCHVHP6fdl4ElxO-U_tmLeKCleEXmjRQk2n9jMfW2bK6loday8ybEx4N53bowfoQEqo_HRZteNe8TfTzwFrKwQH64KKcOTczmKzCCh96jj0l38YKJlF5-1C4PchhY51fBpBGPsSlmZzYqxjsH0nlU24VWZ5bDq7WBdJ_m6Ei85MS0Hw_Zup2_QIYMEEBDOjCsniLyEFNGfMjejVUKYwopNsvUvbcwuOTpVLBTXCqe6m95q3two6i7JH_mti8_lkdmLlLVCpOUai7Z7tRhHo5xsAhg_XjqVMlm1jKzPlOWslUvQhKu8qk4AfcN8YekmPe4YvYyGkrm4

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1A82 43 B
215 B 537ms
170ms Image
image/gif 54.149.146.0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902187&asId=f4d18962-11bc-9db0-a291-6a96b595c507&tv=%7Bc:44020e,pingTime:-3,time:47,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:16%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:47,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B42~0%5D,as:%5B42~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXhCELB+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C155%7C16*.902187-60813169%7C161%7C162%7C163%7C164%7C1711%7C1712,idMap:16*,rmeas:1,rend:0,renddet:INS%7D&br=c
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.149.146.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-146-0.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-server-name: dt05.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1A82 43 B
216 B 534ms
169ms Image
image/gif 54.149.146.0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902187&asId=f4d18962-11bc-9db0-a291-6a96b595c507&tv=%7Bc:44020f,pingTime:-6,time:48,type:i,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:48,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B43~0%5D,as:%5B43~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXhCELB+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C155%7C16*.902187-60813169%7C161%7C162%7C163%7C164%7C1711%7C1712,idMap:16*,rmeas:1,rend:0,renddet:INS%7D&tpiLookup=ao:www.familyfriendpoems.com*&br=c
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.149.146.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-146-0.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-server-name: dt01.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6E61 51 KB
51 KB 47ms
8ms Script
application/javascript 143.204.215.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3392345&wgcampaignid=99582&viewref=89722800015453200710580011869011&js=1&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-49.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-version-id: wvDglZsFnxZ0eZ1mUErJkFMo1VNidWYJ
via: 1.1 ab39b007ab81966ada6e7fb1536bf376.cloudfront.net (CloudFront)
last-modified: Tue, 09 Nov 2021 11:05:10 GMT
server: AmazonS3
age: 72294
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sat, 12 Feb 2022 06:15:50 GMT
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: 5hnxElcbyu70_tkn-Q0NQfApDuOOABQDk5CnZYt4u7WFSO9ixeuU0w==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 6E61 160 B
618 B 77ms
28ms Image
image/jpeg 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=82135400012150600710776011869030&wglinkid=3392345
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 6b71d2bd27010cbb01e505314423d9c903230bf4182019eb1ca8016bd2b624a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 02:20:44 GMT
Last-Modified: Sun, 13 Feb 2022 02:20:44 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/jpeg
Content-Length: 160
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1A82 43 B
215 B 530ms
170ms Image
image/gif 54.149.146.0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902187&asId=f4d18962-11bc-9db0-a291-6a96b595c507&tv=%7Bc:44020l,pingTime:-2,time:54,type:a,im:%7Bsf:0,pom:1,prf:%7BmdA:647,mdZ:825,beA:864,beZ:865,mfA:866,cmA:867,inA:867,inZ:871,prA:871,prZ:876,si:881,poA:882,poZ:898,cmZ:898,mfZ:898,loA:912,loZ:914,ltA:918,ltZ:918%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:16%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:54,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B49~0%5D,as:%5B49~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXhCELB+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C155%7C16*.902187-60813169%7C161%7C162%7C163%7C164%7C1711%7C1712,idMap:16*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:INS,sinceFw:35,readyFired:true%7D&br=c
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.149.146.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-146-0.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 createjs_2019.11.15_min.js
s0.2mdn.net/ads/studio/cached_libs/ Frame 2A26 164 KB
0 47ms
47ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 02:20:44 GMT

GET
H3 200 160x600-V01.js Show response
s0.2mdn.net/sadbundle/1428878293222563042/ Frame 2A26 79 KB
15 KB 39ms
38ms Script
application/x-javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08232481c0b931e55216437e326f182093b697a0285b8a7fa73b7403e591c209

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1428878293222563042/160x600-V01.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 09:35:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 492312
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15081
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 13:18:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 09:35:32 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1A82 0
23 B 107ms
107ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 044A 0
22 B 54ms
53ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKvJt-2oIYrToO9n53gOe-ZOQBQAAAAA4AeAEAg&bg=!Y2ClYCTNAAbAtJCDwLQ7ACkAdvg8WtZ0s4cMxgRuE2j7yhBor0wUymllUNG4i51OSuCHceCNeeIlIAIAAABfUgAAAAJoAQeZAv2iBvRobvlmP76PMZLcwjWJxnt5hUqXRlcfDi4zsw6uHuN8-QJIe38KO8nZTn4VBHeYQTHf1nX2hKReN_p0bL59W9svt_UNyFDzI_5Xueyoox9ylrXS6CRfZ2msg9LGIvqq5PnTjVKDAgj0rF6hqdwa9DBr9AKLtdciuXXxIknyiIid1G2s6CvncvQQxyTlh0UQVymLK1kgVHFvLLTn1hISQRAUKMCoCtLphKD4kqbhNFzFDY8o4--wsv9Xx8zTsYOXOckZcxo0YwaHonOPiDbEBvMJHkTmWdDmBmI6v20yLTSXYC8qLkJ7a3GyMSerqAmfrCvcFOHkmeIyLmsPCcdfjddYOIOkvj3gfk3DL23rtCpdylMMIJ4mlfp8zkFIlvAQa1LmuoZVZ9tXsXgPBB3nR9UKY9DxL0mH-bwWDXHabOoX-lPB9ULgalktILihCf6M_3bNF0_ceQFVGtY5HtfjCfRipijRvcuEk2Jcxw8iWMoJEWGiar2dq9mzMStY1dwwRS_JkmpMpo5ch3InN5f-UrWg40ENDAoZRH3fcs9kWBXY9253FSoxYxaS_hrlsQTXd2Iz5RGBKqxq1bRd3fEZkrRlOgSsJ5-CTmSDfSW803no-FyxSrzkY69GP8y4S-3PRYfCJduzRWYfCRY3oGfcEBXWHe7rNCnEy_1aDlHZAWDDZ_XMX3bKLwD_zLQEc5HJd9VDIF6BubOPzF0sBTh5vUwg5W7RxNl9zzuvX0otd6jWeizSEPlu3FllsetnLtOpRiNDGlPBIL4fdNf6U65PlxCTXXuiNcG7LlzxhCnH_yuUwTPt0YANJMjJosMreNEap9VfzQsxq5aBSKo5edpdGtSQjpI4KswMyUzGW6955Oee5a_8nzQS5WSVAkJgRDqwo4cq3Sk-n9jPYwtNkV39oJzZ0r0fFm5VO-w1b8q7l8vykK1Gszfu6owQ2CNoOkqmoySQ2UTCxXqUyckk1EfmAjyqNp_DTSAXeNrdv7a7Y5SXDRKHE-9IZboLc_Q

Requested by

Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1A82 43 B
215 B 556ms
336ms Image
image/gif 54.149.146.0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902187&asId=f4d18962-11bc-9db0-a291-6a96b595c507&tv=%7Bc:44022B,time:194,type:e,im:%7Bimprf:%7Bttecl:332,ecd:41,tsecr:19%7D%7D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:194,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:16,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:sp,cc:0.0.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B189~0%5D,as:%5B189~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXhCELB+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C155%7C16*.902187-60813169%7C161%7C162%7C163%7C164%7C1711%7C1712,idMap:16*,rmeas:1,rend:0,renddet:INS%7D&br=c
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.149.146.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-146-0.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-server-name: dt07.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1A82 43 B
215 B 171ms
170ms Image
image/gif 54.149.146.0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=902187&asId=f4d18962-11bc-9db0-a291-6a96b595c507&tv=%7Bc:440268,pingTime:-10,time:413,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85OC4wLjQ3NTguODAgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1644718844739%7C%7C87fbdb96baf4dba00bb5596a7727703a%7C%7C920bd99aa4265c459f442b819dba176b%7C%7Cbaf7752e8adf7ba0d587bd041930ee6e%7C%7C2b9f4f2fbad54f7e71b7292eeb5f77b7%7C%7C532a3d5c084bb2276c8a978d80468aee%7C%7C05a5c5c105ec59d9e86c7ec2752ea1e2%7C%7C9fdb188bcf1d1d321053d670459bc489%7C%7C1629390669%7D
Requested by: Host: a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
URL: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.149.146.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-146-0.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-server-name: dt02.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FF20 42 B
64 B 74ms
74ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssnL64fzVnRaiaKIm6fFmzxYIHvg98zrrETjlhx1d4CNRdmgJt36fzhPIQ6LxrYz0LGTYi_ZhktxMtjkM9Y7CIwQc4n2Dmy0O9R6Qmj10oBas9Cw0J0Jg&sai=AMfl-YTEk7pYxPlvmPLFRJPkVgX1U_Bz-v9Ew7nGdd27ueZXLRjdMxf-YpKHC_ZF05RK8W5Cxx-vYzXHrpebw8YgSCekSZK4A8QRX4JbunuuEy_2a_NoSjndXEW3RO2nnO0&sig=Cg0ArKJSzEsmGKdkTCElEAE&cid=CAASFeRo9mp5j3gVUDq1VTQMAWAayDe-jg&id=lidar2&mcvt=1000&p=253,172,343,900&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3947869073&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644718843454&rpt=299&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 1A82 0
23 B 74ms
74ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuielq37gEzWxq0gmxdIMM4t0x2jPCFqoTJZOgoGi_LC-Vs8CwsoM3Ldwhyfg_LR5tsdLoe-wns6ODfWHfXkG9lJqkqFgUzsVMJKbgGc2coIKVpUr-1QPXEOE9YzwbsOSm-MhZ3bCt1AJq8Do3vRqOPeQXuU-U8Bc6UQ7Cp&sig=Cg0ArKJSzKz_g_-JxE_ZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1024&vt=11&dtpt=828&dett=4&cstd=194&cisv=r20220209.58634&vwbs=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: www.familyfriendpoems.com
URL: https://www.familyfriendpoems.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 51ms
51ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220209&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

7c21d1e7958bba9336ab03e447b59bbc4fd034be3d139d8cb8619db609dba0fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 02:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9870
x-xss-protection: 0

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 6E61 16 B
232 B 80ms
80ms Fetch
application/json 3.248.87.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.87.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-87-88.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.25

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 13 Feb 2022 02:20:45 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.25
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 109ms
30ms Preflight 3.248.87.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.87.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-87-88.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Sun, 13 Feb 2022 02:20:45 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1A82 42 B
64 B 74ms
74ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuWV87SYpv573qXW0qWQaq076LXAm82e-EYi2Y77qmon3guYQQo17mGiPIP3-y7afJ8OKBvfAPlniXTDKuhqsyMQ_m7zVkwDMT6fdK3q_3NV7jCRHVFMg&sai=AMfl-YQYeFtRsAgDpYVHoa8xQEFaaO-OeOOk9yHmX-IJ_o584MI8C-WC__aaahatrDoQot-hy4wkhYWqGfqYG3_9yX5kK4XcqYhEhNpXV71xXUQVFket-QskVXUYINiCAQ4&sig=Cg0ArKJSzHF_B9QWUcr2EAE&cid=CAASFeRoeOHT3EeA9F-4OZxnLLIXyMTxbg&id=lidar2&mcvt=1007&p=253,1256,857,1416&mtos=137,1007,1007,1007,1007&tos=137,870,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2390760339&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644718843463&rpt=659&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 02:20:45 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F743 13 KB
5 KB 39ms
39ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 12 Feb 2022 23:47:13 GMT
expires: Sun, 12 Feb 2023 23:47:13 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 9212
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 40D1 783 B
537 B 49ms
49ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7588c4ce0e982bf5626472cb0707f7b7713bfa615d14e82e93276ad99234e855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-q0jf6PgfBSVGiGHTLROKTA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 13 Feb 2022 02:20:45 GMT
date: Sun, 13 Feb 2022 02:20:45 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-q0jf6PgfBSVGiGHTLROKTA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 40D1 0
0 63ms
63ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220209&jk=1931289875523854&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 O0zcrAsc3s2SKI8Tuz5umMJoYZUI79PNRri5GeZhfeg.js Show response
pagead2.googlesyndication.com/bg/ Frame F743 35 KB
13 KB 39ms
39ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/O0zcrAsc3s2SKI8Tuz5umMJoYZUI79PNRri5GeZhfeg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3b4cdcac0b1cdecd92288f13bb3e6e98c268619508efd3cd46b8b919e6617de8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 02:16:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 275
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13545
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 02:16:10 GMT

GET generate_204
tpc.googlesyndication.com/ Frame F743 0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
24 B 49ms
49ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220209&jk=1931289875523854&bg=!SEulSw_NAAbAtJCDwLQ7ACkAdvg8WkpKvS4mEm5NsZXpmPrSRMqB2Oudtp6iKCZiQ-wztoCtzhig0wIAAABTUgAAAAJoAQeZAqRkCRzsq1_4mSaV5fR0WyYHzxaxLbXJXifXM3A5U6_NkxsWs7IKSzBl2OBWdH0PWH9WAZsz3Kr-puQuM4nC_bO9qi0h9KtlTC5kZjR7sA4gLVp85I9x0aJscNZhJoV6oXAsR9RRDM22km0yi2zflt6rkAMndyzqaEF6gNWlPkOwiyAesg4dg_OhddC8Mc8ub_pXSgJGH7LU_nyF64qLHW-OksjkqldsYAAqNYOnskSnAeeBXJ85Vtk27uLeNfPHRrxbmgX4p-h7ECpbJ7SHR6czwt7W9BsZLKP7Y0uRqG--xdXsNztW6vptG6Rli_0RPJnw5jyWtNyhr3JDUimvefceKh85LHuxi7-i4ej5u3_YuzE1fVVJ2xojtHTSylhi2CaPugDQHD6kVJj2-IIC8bxJsaW3W2bDZCpFtg6iFvXm0_hBIpd_TVfhjJr0_Gwx_GBVChybjWl_vZsPe25-rt8lGKtaLZvsqbiux5-zuVwsWv2qKsMEZ3Mv0p06ivxXpkuSPYbgeQ3pJCLMxV_eJmeNZ1Y-EfZyUtbxsYiT0m9n5aZSENjjovYclpJus3DoPHOzz3ORbvnxpihlhpz7UFN9z3Zwj9_c4zHFw34J9kta0VWKWNkfl6LzBxg31Tw7z6qwGQWJMexKj2vNSJqJ5mJdrpsDJcdLLtfnnpcYGJD-_9Rzqr0DaImiyxmY93-6yhZmBF0oriXp1sNzu1pFVOMAD6uwUTfqI7JRXELYMvvO0G-Yf6XYosigMhgyTS-WIDTW0UgZkgiT2UDAnzQTT9ZmqrvmC7--inROI6ZLDq-Bq-x-BGQAtuEmNVUU9TCGX71NNOWG6l9wc4bzPUu8h7Dl5Tk8OCtlpDEMviSukuYDvL1uekSYbfmZ2ItF2SvebTqnFRCc

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.familyfriendpoems.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 02:20:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/generate_204?GmF4hw

Verdicts & Comments Add Verdict or Comment

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.familyfriendpoems.com/	1970-01-20 00:52:13	Name: CAKEPHP Value: d3ed08a2c0b08d11dcd8b12f5b085b94
www.familyfriendpoems.com/	1970-01-20 09:37:34	Name: CakeCookie[id] Value: 62086af9-ca0c-4a90-b3e5-7121adcbb88c
www.familyfriendpoems.com/	1970-01-20 09:37:34	Name: CakeCookie[fvc] Value: 1
www.familyfriendpoems.com/	1970-01-20 01:35:07	Name: CakeCookie[fsg100] Value: 65
www.familyfriendpoems.com/	1970-01-20 01:35:07	Name: CakeCookie[fsg2] Value: 2
www.familyfriendpoems.com/	1970-01-20 01:35:07	Name: CakeCookie[fsg10] Value: 2
www.familyfriendpoems.com/	1970-01-20 01:35:07	Name: CakeCookie[fsg20] Value: 4
www.familyfriendpoems.com/	1970-01-20 09:37:34	Name: CakeCookie[geo] Value: DE
.familyfriendpoems.com/	1970-01-20 18:23:10	Name: _ga Value: GA1.2.238457712.1644718842
.familyfriendpoems.com/	1970-01-20 00:53:25	Name: _gid Value: GA1.2.1010363008.1644718842
.familyfriendpoems.com/	1970-01-20 00:51:58	Name: _gat Value: 1
.adnxs.com/	1970-01-20 03:01:34	Name: icu Value: ChgI9Js-EAoYASABKAEw-9WhkAY4AUABSAEQ-9WhkAYYAA..
.adnxs.com/	1970-01-20 03:01:34	Name: uuid2 Value: 3856325486927847700
.familyfriendpoems.com/	1970-01-20 10:13:34	Name: __gads Value: ID=56b50e07652a35f5-220fa2bb3dcd001a:T=1644718842:S=ALNI_Mbo5aATr2_MecvSUKLtFHMexBcEsA
.casalemedia.com/	1970-01-20 03:01:34	Name: CMPS Value: 3274
.doubleclick.net/	1970-01-20 10:13:34	Name: IDE Value: AHWqTUnZPckYLpJv1Xe2e2Wl0vyD8uQdNG8uBt01z34Bc1LbKc-X48gx427ULare5fM
.casalemedia.com/	1970-01-20 09:37:34	Name: CMID Value: Yghq.xG0B-h8s0nBZ2HzIAAA
.casalemedia.com/	1970-01-20 03:01:34	Name: CMPRO Value: 1206
.casalemedia.com/	1970-01-20 00:53:25	Name: CMST Value: Yghq+2IIavsA
.adnxs.com/	1970-01-20 03:01:34	Name: anj Value: dTM7k!M41.D>6NRF']wIg2Ilju$0)>!]tbPl1M>e)ZlrFUfJ+tGXxoX9%X(LI0VPd<T!@m8yT*7E]34-^NFZ0%Ve2Q3If)y3KL9D3I?+MvaKT!
.casalemedia.com/	1970-01-20 09:37:34	Name: CMRUM3 Value: 2d62086afb2760CAESEI4kVB2wZZkEK1e1w9gXoaU
.redintelligence.net/	1970-01-20 03:01:34	Name: 8lcfmzhxc8d6_uid Value: 21b810ca7054dc4e
.doubleclick.net/	1970-01-20 00:52:02	Name: DSID Value: NO_DATA
.awin1.com/	1970-01-20 01:02:03	Name: awpv14098 Value: 296283\|1644718844\|8c15a840-8c73-11ec-b037-22389adc0a30
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 429086:2519595
pb.media01.eu/	1970-01-20 18:23:10	Name: DTU Value: 54546A9A48BDAB91F8383E50F6A0C9EE

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
a0728af7ffb25ca923aa0d61aa6f3014.safeframe.googlesyndication.com
ad-server.eu
ad.doubleclick.net
adservice.google.com
adservice.google.de
analytics.webgains.io
api.webgains.io
cm.g.doubleclick.net
dsum-sec.casalemedia.com
dt.adsafeprotected.com
feeds.feedburner.com
fonts.googleapis.com
fw.adsafeprotected.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hal9000.redintelligence.net
hal900011.redintelligence.net
htlb.casalemedia.com
ib.adnxs.com
pagead2.googlesyndication.com
partner.googleadservices.com
pb.media01.eu
pv.medialead.de
s0.2mdn.net
securepubads.g.doubleclick.net
static.adsafeprotected.com
stats.g.doubleclick.net
tpc.googlesyndication.com
track.webgains.com
www.awin1.com
www.familyfriendpoems.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.gstatic.com
tpc.googlesyndication.com
104.111.239.217
138.201.63.145
138.201.64.38
142.250.184.226
142.250.185.198
142.250.186.130
142.250.186.66
143.204.215.49
145.239.193.130
173.203.184.140
2.18.234.21
23.37.38.181
2600:9000:206f:8c00:8:48e:53c0:93a1
2a00:1450:4001:800::2006
2a00:1450:4001:808::200e
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2001
2a00:1450:4001:810::2004
2a00:1450:4001:810::200e
2a00:1450:4001:811::2002
2a00:1450:4001:813::2002
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::200a
2a00:1450:4001:82f::2001
2a00:1450:400c:c08::9c
3.248.87.88
37.252.173.27
46.236.13.147
52.48.8.1
54.149.146.0
54.76.176.197
88.198.250.30
08232481c0b931e55216437e326f182093b697a0285b8a7fa73b7403e591c209
0831e68e6ebdae08410ffa346828128f67988382bc5e6862061847efa06c5f55
096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bc0d28b452ba97a2dd466d1a5abbd1b1ba66641c696ac5c971338e4f2644f81
0ef7e58b602943799da91b3f53f11ea3fc37389925c0c10198ee88487aea2e88
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c
17296e933f90761a59195bd4cb364e51d4d95e4782aebca753c2f5559ee5c294
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1952a00a2605e0af064e425c4cb845ae4b30da722859c84fd411e65e85e11a53
1cfa97d4c5c4cf2854e01ce2046be1c05e6bc76519d644aad6aa4f1d959efbe4
2179464a9b593de05ea2a423d14236645d400b267ee7d81acb50b39c06db3763
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
25d3e02fd287b7342176b3387803c866b5ba43f636223aeb1e5f2abf6987e20a
2675ab1d1852f1aa30e272d7c2b1b9616e1f4771a94860e0d92bc7fca6c3c48a
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
29ed2d9bbcbb0a34542a3c066940cad97782254ffcf48d6268a9ac701a5b7e4d
2b6c5c61d31d9a294660a1999928903900aadb1eda143065f81b59e3c4770cfe
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
39278d4b968b3ef1e83e7d751d4efcb7a00722c4a881a8ea24e4e46ce3343b3b
3979995a36a2edbae5d6ec4be23befcbe5efac4ae3d7b24dd45919b594866722
3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826
3a4ac7408ba9885a3baf64eabf5890519618c7a5bcd106f98f805c7e8f1d1e3a
3a7b5f2e7e3fd51102d05b2706291210864e7890361d932311a18048073374ae
3b4cdcac0b1cdecd92288f13bb3e6e98c268619508efd3cd46b8b919e6617de8
3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f
406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5
4592bbb4558dd7e6e5e1f70590004755d3bf1d436fc928613d8d58b28eeaffa4
467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30
4a53a65a1441581d62f14cd619380fd1816bb4214b833ce563dedd75e95b6a71
4ae689a5b37c61962b7f8702568778b5fe5afa464b5d7e21646cd6e75cdd0153
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
53dc927e128903785e0766870ab1173dece35778a580d42a59ced928597ee6e7
553af7add02828c043d774c8648a9fcb449d223d83e148cd797bf4bb200a7502
556d18f5a17ad490dee80246818799d88162528229c2c1c25f8f1f3970242ecd
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56bb11adc01f24c79fc0cea049df77f003785136a5db244bb1ba8c7909b8b5ea
5925c3bf9adbd1b35895ea0fc354215f781f558720325a181f4d906c42a0f3b5
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5dca751abec71004424b020d757d387ac905a1420956f406b0cd4b534e5d27e6
5f0df50948209936e7aea89d2a41fe3abff7609fd15c8501d745a9281acfb7e9
60b6fb70c39877b90333526914dbc0d47052cd8c4c298c421aaee2f9d6b48bcc
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
66ba4a1d18086b0c3465db8c6c5c33d9f912d6ff8450fa5752bb4c40df650cbe
6b71d2bd27010cbb01e505314423d9c903230bf4182019eb1ca8016bd2b624a0
6c18cf6e5b4dc6dc09b735fb1b15a9bfb6ce4e262920a40c1ff7faae3021f4cf
6fd0af94d3371cf5e1a1c40c3a5854cd467fb0a391ba09ad48ca3f12b065995b
75744f4b7e439c639ff4c7b585fff954008d490314235582b6c8ad20ea3d0c90
7588c4ce0e982bf5626472cb0707f7b7713bfa615d14e82e93276ad99234e855
77e6bfd29cfbee30689f7c22fee27499a4bc1b7a6f796c5504cec00789f5e69c
7c21d1e7958bba9336ab03e447b59bbc4fd034be3d139d8cb8619db609dba0fa
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
89acce40b15a6519387a29be4b031638240cfecd67ae5c9a3cbfbaae6ca6d88c
8a63201ec7bd8c7a126f5f9b27d2681e52f0b17bd104c6d18fe99bd746359477
8f4b70778aa21c1c093c6acbad70c70b2e69d4d22e47d9405ee137db16ca050b
90136edfb6bc105f7a191a67b3e09ac9533086e7bc55232697011dd5ef2305f1
928d79b45785aa533e8196c50f02586ea391120500ca3ec7ebbd5fe21f92415a
92ac4b2f47e19784ca2a37c2c2b760a4822108fd3cb3ded48db87ad7e0e4e44f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
940ce4ed0c250ce6fed03f695f77279a7baa88c80c1571ab4f8c9cc99f8d5b73
9c4a14ce668f7d210058d8a2520673aead799e203e6fa1f211c50130ab062897
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a082bfd96630ab857ec08e4e0055175aae987aea275d450f048ec3fee5de5383
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a233318e5d99cea088aad43dcdad12b3d4763f9c108df13d73588e60db0cc14a
a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a566a0d4e8751d318f54a3c4a59ae1de0fe7fca579e4034646906d38add0a4e1
a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
ab314ed29cdc0d67c715e9cb78055f04af7fcf02c0a8b8028228719ef90ec094
ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1ed21303fdf573dc0123dccf0db7322f8836aa7b88249dbff33a6ff576b4136
b2f85dea6d6e5244f125014ca68be395c013e8d9e08fb7be92a03cbeee56500b
b69352d7b888db81332b7c4c290ef3496e90c2a4c8771c565ebfa40922acb976
b78424594851ca53dee0fdfbac774f618630b4b8ae8266910fafc2eabb2a3dcc
baea5caffda9109fe3fe251376d60a25ea43c846fa7bb8dc4b15da44a78c6760
c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
c9d1e528e46e684559d434c27a826ed1b6e5a35126260944f8e15078578d0dbf
ca84e6bb352092092c62f8bd21dc40128e16022c329e086ffa17596cd4634e44
d78c3f283d517f14f23929c28ded0a2ef2a00a562736f7face1cdb4eaa887d90
d7a4008ea38aa8b6839151dae7fae0de0acb0e8626802a6ded249d07b74d9f93
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e106aa0d2157ff986c6aa212dbc5a7b486c92ea70c0d22d374e996e9e6219314
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e534e723aa28b9ff18c42c2f8e6d301fa90ace9cc87c9ed923f3c6e463365117
e5be30616d437d2baf9041a6648598542ae30fed30d261b002266e5d58969685
ea795a298e37c1cd48937e8d9b242162d213ebaa07c997769a6bfe4b4d8ec411
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a3ee3aeb132df9dcbaacf413ba639f0f93d62035578cace11636ce60155d16
f1fc84899fe247feb3cf0937489d12ba0fc833c97f2fbed286b686d426cbaed8
f5e1d091d5c366c23a13861b5c64311655fe860e95e13387582268f4bfd313e0
f93264606087b4c1dd4e0bb8bf2ed92549c53fe8b5f095d214c4e72a765f5482
f93d0298dd39f7dff18566a5b2754067e26c0182b469fd6b24e5d63429fef88b
fd11fa353cc6a8560f4c35e67c6fb8a3a4061ed3de4309cdf83fca65f8319bb4

www.familyfriendpoems.com Open in urlscan Pro 173.203.184.140 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

171 Requests

91 %HTTPS

44 %IPv6

22 Domains

37 Subdomains

34 IPs

6 Countries

2599 kBTransfer

5657 kBSize

26 Cookies

7 Outgoing links

Page URL History

Redirected requests

171 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.familyfriendpoems.com Open in urlscan Pro
173.203.184.140 Public Scan

Screenshot
Live screenshot

Full Image

171
Requests

91 %
HTTPS

44 %
IPv6

22
Domains

37
Subdomains

34
IPs

6
Countries

2599 kB
Transfer

5657 kB
Size

26
Cookies

171 HTTP transactions
3 data transactions