pt.friendsforever.world Open in urlscan Pro
2606:4700:20::ac43:48e0 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pt.friendsforever.world/
Effective URL:
https://pt.friendsforever.world/
Submission: On December 05 via api (December 5th 2023, 11:22:37 pm UTC) from US — Scanned from DE

Summary HTTP 272 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 78 IPs in 10 countries across 60 domains to perform 272 HTTP transactions. The main IP is 2606:4700:20::ac43:48e0, located in United States and belongs to CLOUDFLARENET, US. The main domain is pt.friendsforever.world.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 28th 2023. Valid for: a year.

This is the only time pt.friendsforever.world was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::681a:571	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	2606:4700:20:... 2606:4700:20::ac43:48e0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	151.101.66.217 151.101.66.217	54113 (FASTLY) (FASTLY)
9	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
30	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:50c0:800... 2606:50c0:8002::153	54113 (FASTLY) (FASTLY)
1	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
3	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
1	5.161.35.131 5.161.35.131	213230 (HETZNER-C...) (HETZNER-CLOUD2-AS)
1 13	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
7	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
3	89.149.192.64 89.149.192.64	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1	34.107.161.123 34.107.161.123	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	147.75.84.158 147.75.84.158	54825 (PACKET) (PACKET)
7	2606:4700:10:... 2606:4700:10::6816:2460	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	34.149.20.76 34.149.20.76	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6 12	185.89.210.101 185.89.210.101	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.120.63.153 34.120.63.153	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2602:803:c003... 2602:803:c003:200::45	26667 (RUBICONPR...) (RUBICONPROJECT)
2	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1	130.211.34.132 130.211.34.132	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
21	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
9 12	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
4 10	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1 2	52.210.167.100 52.210.167.100	16509 (AMAZON-02) (AMAZON-02)
14	2a00:1450:400... 2a00:1450:4001:830::2006	15169 (GOOGLE) (GOOGLE)
1	172.217.16.198 172.217.16.198	15169 (GOOGLE) (GOOGLE)
4	78.46.23.46 78.46.23.46	24940 (HETZNER-AS) (HETZNER-AS)
2	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
2	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
2	2600:9000:204... 2600:9000:2046:5800:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2600:1f18:1ac... 2600:1f18:1aca:4282:f238:b199:bc69:7947	14618 (AMAZON-AES) (AMAZON-AES)
1 4	88.99.219.174 88.99.219.174	24940 (HETZNER-AS) (HETZNER-AS)
3	91.121.248.44 91.121.248.44	16276 (OVH) (OVH)
1	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
1	104.64.118.247 104.64.118.247	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.11.198.160 3.11.198.160	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.184.230 142.250.184.230	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	65.9.95.34 65.9.95.34	16509 (AMAZON-02) (AMAZON-02)
1	18.239.50.21 18.239.50.21	16509 (AMAZON-02) (AMAZON-02)
2	35.177.10.97 35.177.10.97	16509 (AMAZON-02) (AMAZON-02)
2	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	35.244.193.51 35.244.193.51	15169 (GOOGLE) (GOOGLE)
1	131.153.158.209 131.153.158.209	60558 (SECUREDSE...) (SECUREDSERVERS-EU)
2	162.19.138.117 162.19.138.117	16276 (OVH) (OVH)
3	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	151.101.65.108 151.101.65.108	54113 (FASTLY) (FASTLY)
2	23.35.229.251 23.35.229.251	16625 (AKAMAI-AS) (AKAMAI-AS)
1	95.101.148.20 95.101.148.20	16625 (AKAMAI-AS) (AKAMAI-AS)
1	67.202.105.23 67.202.105.23	32748 (STEADFAST) (STEADFAST)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	188.42.196.115 188.42.196.115	7979 (SERVERS-COM) (SERVERS-COM)
1	216.52.2.16 216.52.2.16	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1 1	50.16.53.197 50.16.53.197	14618 (AMAZON-AES) (AMAZON-AES)
1	52.59.107.120 52.59.107.120	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:212... 2600:9000:2127:1e00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
4	77.245.57.72 77.245.57.72	36057 (WEBAIR-IN...) (WEBAIR-INTERNET-MTL)
1	54.145.99.161 54.145.99.161	14618 (AMAZON-AES) (AMAZON-AES)
1	51.89.9.252 51.89.9.252	16276 (OVH) (OVH)
3 7	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	184.30.16.195 184.30.16.195	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	46.228.174.117 46.228.174.117	56396 (AMOBEE) (AMOBEE)
1	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	44.206.51.168 44.206.51.168	14618 (AMAZON-AES) (AMAZON-AES)
2	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	52.46.143.56 52.46.143.56	16509 (AMAZON-02) (AMAZON-02)
2	2a05:d018:d29... 2a05:d018:d29:3605:f06e:6a0f:4f28:b438	16509 (AMAZON-02) (AMAZON-02)
1	2a05:d018:cc3... 2a05:d018:cc3:fe04:ffa8:51ae:9be1:eddc	16509 (AMAZON-02) (AMAZON-02)
1 2	63.35.136.25 63.35.136.25	16509 (AMAZON-02) (AMAZON-02)
2 4	3.123.238.130 3.123.238.130	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	65.9.95.40 65.9.95.40	16509 (AMAZON-02) (AMAZON-02)
272	78

1 2606:4700:20::681a:571 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

pt.friendsforever.world	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2606:4700:20::ac43:48e0 (United States)

ASN13335 (CLOUDFLARENET, US)

pt.friendsforever.world	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.friendsforever.world	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.217 (United States)

ASN54113 (FASTLY, US)

fdyn.pubwise.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8002::153 (United States)

ASN54113 (FASTLY, US)

superal.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

p2e9r4n9.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.161.35.131 (United States)

ASN213230 (HETZNER-CLOUD2-AS, DE)
PTR: static.131.35.161.5.clients.your-server.de

pfx.api.botman.ninja	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 89.149.192.64 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

prg.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.161.123 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 123.161.107.34.bc.googleusercontent.com

bid.pubwise.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.158 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:10::6816:2460 (United States)

ASN13335 (CLOUDFLARENET, US)

useast.quantumdex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.quantumdex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.149.20.76 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 76.20.149.34.bc.googleusercontent.com

ssc.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 185.89.210.101 (Frankfurt am Main, Germany) 6 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.63.153 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 153.63.120.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2602:803:c003:200::45 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

pubwise-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.34.132 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 132.34.211.130.bc.googleusercontent.com

api.pubwise.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 216.58.212.162 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.64.151.101 (United States) 4 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.210.167.100 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-167-100.eu-west-1.compute.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:830::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f198.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 78.46.23.46 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.46.23.46.78.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2046:5800:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:1f18:1aca:4282:f238:b199:bc69:7947 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 88.99.219.174 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.174.219.99.88.clients.your-server.de

hal900029.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.121.248.44 (France)

ASN16276 (OVH, FR)
PTR: ip44.ip-91-121-248.eu

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.64.118.247 (Prague, Czech Republic)

ASN16625 (AKAMAI-AS, US)
PTR: a104-64-118-247.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.11.198.160 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-11-198-160.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-34.prg50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.239.50.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-239-50-21.ams58.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.177.10.97 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-177-10-97.eu-west-2.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.193.51 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 51.193.244.35.bc.googleusercontent.com

lexicon.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 131.153.158.209 (Amsterdam, Netherlands)

ASN60558 (SECUREDSERVERS-EU, US)

id.a-mx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.138.117 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533568.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.108 (United States)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.35.229.251 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-229-251.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.148.20 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a95-101-148-20.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.105.23 (United States)

ASN32748 (STEADFAST, US)
PTR: ip23.67-202-105.static.steadfastdns.net

ssc-cms.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.42.196.115 (Luxembourg) 2 redirects

ASN7979 (SERVERS-COM, US)

ads.betweendigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.52.2.16 (United States)

ASN32475 (SINGLEHOP-LLC, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.16.53.197 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-53-197.compute-1.amazonaws.com

ssp.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.59.107.120 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-107-120.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:1e00:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 77.245.57.72 (United States)

ASN36057 (WEBAIR-INTERNET-MTL, US)

sync.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.145.99.161 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-99-161.compute-1.amazonaws.com

cs-server-s2s.yellowblue.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.252 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip252.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 13.248.245.213 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.16.195 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-16-195.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.228.174.117 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.78 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 44.206.51.168 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-206-51-168.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.143.56 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d018:d29:3605:f06e:6a0f:4f28:b438 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:cc3:fe04:ffa8:51ae:9be1:eddc (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.35.136.25 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-136-25.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.123.238.130 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-123-238-130.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.40 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-40.prg50.r.cloudfront.net

cm.smadex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 148	643 KB
36	doubleclick.net 11 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 75 cm.g.doubleclick.net — Cisco Umbrella Rank: 219 ad.doubleclick.net — Cisco Umbrella Rank: 139 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 515 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 98422	335 KB
22	friendsforever.world 1 redirects pt.friendsforever.world img.friendsforever.world	378 KB
14	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	174 KB
13	adnxs.com 6 redirects ib.adnxs.com — Cisco Umbrella Rank: 229 acdn.adnxs.com — Cisco Umbrella Rank: 610	26 KB
11	adsafeprotected.com 1 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 900 static.adsafeprotected.com — Cisco Umbrella Rank: 602 dt.adsafeprotected.com — Cisco Umbrella Rank: 567	102 KB
11	google.com 2 redirects region1.analytics.google.com — Cisco Umbrella Rank: 2693 www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 93	2 KB
10	casalemedia.com 4 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 578 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 480	6 KB
10	gstatic.com fonts.gstatic.com www.gstatic.com	95 KB
9	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	692 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 37721 hal900029.redintelligence.net — Cisco Umbrella Rank: 261914	55 KB
7	3lift.com 3 redirects eb2.3lift.com — Cisco Umbrella Rank: 372	4 KB
7	quantumdex.io useast.quantumdex.io — Cisco Umbrella Rank: 19494 sync.quantumdex.io — Cisco Umbrella Rank: 4292	2 KB
6	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 537 eus.rubiconproject.com — Cisco Umbrella Rank: 588 token.rubiconproject.com — Cisco Umbrella Rank: 461	16 KB
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	6 KB
5	33across.com ssc.33across.com — Cisco Umbrella Rank: 3699 lexicon.33across.com — Cisco Umbrella Rank: 1596 ssc-cms.33across.com — Cisco Umbrella Rank: 904	944 B
4	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 336	1 KB
4	adkernel.com sync.adkernel.com — Cisco Umbrella Rank: 1750	536 B
4	criteo.com gum.criteo.com — Cisco Umbrella Rank: 424 dis.criteo.com — Cisco Umbrella Rank: 550	1 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	255 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2189	21 KB
3	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 331	724 B
3	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 24395 api.webgains.io — Cisco Umbrella Rank: 59842	19 KB
3	medialead.de pv.medialead.de — Cisco Umbrella Rank: 47317	1013 B
3	smartadserver.com prg.smartadserver.com — Cisco Umbrella Rank: 1657	2 KB
3	google.de www.google.de — Cisco Umbrella Rank: 6765	622 B
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	40 KB
3	pubwise.io fdyn.pubwise.io — Cisco Umbrella Rank: 46424 bid.pubwise.io — Cisco Umbrella Rank: 38441 api.pubwise.io — Cisco Umbrella Rank: 37342	145 KB
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 208	1 KB
2	yahoo.com pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474	1 KB
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 285	2 KB
2	liadm.com 2 redirects i.liadm.com — Cisco Umbrella Rank: 517	1 KB
2	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 544 image6.pubmatic.com — Cisco Umbrella Rank: 793	6 KB
2	betweendigital.com 2 redirects ads.betweendigital.com — Cisco Umbrella Rank: 1601	1 KB
2	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 425	1 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138
2	openx.net pubwise-d.openx.net — Cisco Umbrella Rank: 98378 u.openx.net — Cisco Umbrella Rank: 672	457 B
2	media.net prebid.media.net — Cisco Umbrella Rank: 1498 contextual.media.net — Cisco Umbrella Rank: 665	10 KB
1	smadex.com 1 redirects cm.smadex.com — Cisco Umbrella Rank: 2280	613 B
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 327	648 B
1	adroll.com d.adroll.com — Cisco Umbrella Rank: 1380	181 B
1	1rx.io 1 redirects sync.1rx.io — Cisco Umbrella Rank: 546	194 B
1	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 714
1	yellowblue.io cs-server-s2s.yellowblue.io — Cisco Umbrella Rank: 2453	368 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 674	243 B
1	sharethrough.com match.sharethrough.com — Cisco Umbrella Rank: 495	35 B
1	disqus.com 1 redirects ssp.disqus.com — Cisco Umbrella Rank: 1557	283 B
1	lijit.com ap.lijit.com — Cisco Umbrella Rank: 650	277 B
1	a-mx.com id.a-mx.com — Cisco Umbrella Rank: 1702	275 B
1	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 61264	3 KB
1	webgains.com track.webgains.com — Cisco Umbrella Rank: 49821	2 KB
1	awin1.com www.awin1.com — Cisco Umbrella Rank: 13930	703 B
1	office-partner.de adv.office-partner.de — Cisco Umbrella Rank: 128498	923 B
1	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 751	359 B
1	botman.ninja pfx.api.botman.ninja	479 B
1	stackpathcdn.com p2e9r4n9.stackpathcdn.com — Cisco Umbrella Rank: 680449	7 KB
1	github.io superal.github.io — Cisco Umbrella Rank: 717230	3 KB
0	eu-1-id5-sync.com Failed lb.eu-1-id5-sync.com Failed
0	rlcdn.com Failed api.rlcdn.com Failed
0	agkn.com Failed fid.agkn.com Failed
272	60

	Domain	Requested by
30	pagead2.googlesyndication.com	pt.friendsforever.world pagead2.googlesyndication.com f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
21	tpc.googlesyndication.com	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com googleads.g.doubleclick.net pt.friendsforever.world tpc.googlesyndication.com pagead2.googlesyndication.com
18	pt.friendsforever.world	1 redirects pt.friendsforever.world
14	s0.2mdn.net	pt.friendsforever.world s0.2mdn.net
13	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com googleads.g.doubleclick.net
12	cm.g.doubleclick.net	9 redirects googleads.g.doubleclick.net eb2.3lift.com
12	ib.adnxs.com	6 redirects fdyn.pubwise.io googleads.g.doubleclick.net acdn.adnxs.com eb2.3lift.com
9	www.googletagmanager.com	pt.friendsforever.world www.googletagmanager.com adv.office-partner.de
8	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
7	eb2.3lift.com	3 redirects sync.quantumdex.io eb2.3lift.com
7	dt.adsafeprotected.com	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com pt.friendsforever.world
6	sync.quantumdex.io	fdyn.pubwise.io sync.quantumdex.io ssum-sec.casalemedia.com
6	www.gstatic.com	googleads.g.doubleclick.net
6	region1.analytics.google.com	www.googletagmanager.com
6	fonts.googleapis.com	pt.friendsforever.world googleads.g.doubleclick.net hal900029.redintelligence.net
4	x.bidswitch.net	2 redirects ssum-sec.casalemedia.com eb2.3lift.com
4	sync.adkernel.com	sync.quantumdex.io
4	hal900029.redintelligence.net	1 redirects f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com hal900029.redintelligence.net
4	hal9000.redintelligence.net	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com hal900029.redintelligence.net
4	www.googletagservices.com	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com googleads.g.doubleclick.net
4	fonts.gstatic.com	fonts.googleapis.com
4	www.google.com	2 redirects pt.friendsforever.world tpc.googlesyndication.com
4	img.friendsforever.world	pt.friendsforever.world
3	match.adsrvr.org	fdyn.pubwise.io ssum-sec.casalemedia.com eb2.3lift.com
3	pv.medialead.de	hal900029.redintelligence.net
3	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	fastlane.rubiconproject.com	fdyn.pubwise.io
3	ssc.33across.com	fdyn.pubwise.io
3	prg.smartadserver.com	fdyn.pubwise.io
3	www.google.de	pt.friendsforever.world
3	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	cdnjs.cloudflare.com	pt.friendsforever.world s0.2mdn.net
3	securepubads.g.doubleclick.net	pt.friendsforever.world securepubads.g.doubleclick.net
2	dpm.demdex.net	1 redirects ssum-sec.casalemedia.com
2	pr-bh.ybp.yahoo.com	ssum-sec.casalemedia.com eb2.3lift.com
2	s.amazon-adsystem.com	1 redirects ssum-sec.casalemedia.com
2	dis.criteo.com	ssum-sec.casalemedia.com eb2.3lift.com
2	i.liadm.com	2 redirects
2	ssum-sec.casalemedia.com	sync.quantumdex.io ssum-sec.casalemedia.com
2	ads.betweendigital.com	2 redirects
2	eus.rubiconproject.com	fdyn.pubwise.io eus.rubiconproject.com
2	id5-sync.com	fdyn.pubwise.io sync.quantumdex.io
2	gum.criteo.com	fdyn.pubwise.io
2	api.webgains.io	analytics.webgains.io
2	5994599.fls.doubleclick.net	1 redirects f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
2	static.adsafeprotected.com	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
2	www.googleadservices.com	pt.friendsforever.world
2	googleads4.g.doubleclick.net	pt.friendsforever.world
2	fw.adsafeprotected.com	1 redirects pt.friendsforever.world
1	cm.smadex.com	1 redirects
1	px.ads.linkedin.com	eb2.3lift.com
1	d.adroll.com	ssum-sec.casalemedia.com
1	image6.pubmatic.com	ads.pubmatic.com
1	sync.1rx.io	1 redirects
1	ads.pubmatic.com	sync.quantumdex.io
1	onetag-sys.com	sync.quantumdex.io
1	cs-server-s2s.yellowblue.io	sync.quantumdex.io
1	s.ad.smaato.net	sync.quantumdex.io
1	match.sharethrough.com	sync.quantumdex.io
1	ssp.disqus.com	1 redirects
1	ap.lijit.com	sync.quantumdex.io
1	token.rubiconproject.com	eus.rubiconproject.com
1	ssc-cms.33across.com	fdyn.pubwise.io
1	contextual.media.net	fdyn.pubwise.io
1	u.openx.net	fdyn.pubwise.io
1	acdn.adnxs.com	fdyn.pubwise.io
1	id.a-mx.com	fdyn.pubwise.io
1	lexicon.33across.com	fdyn.pubwise.io
1	cdn.track.production.webgains.team	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
1	analytics.webgains.io	track.webgains.com
1	adservice.google.com	5994599.fls.doubleclick.net
1	track.webgains.com	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
1	www.awin1.com	hal900029.redintelligence.net
1	adv.office-partner.de	hal900029.redintelligence.net
1	ad.doubleclick.net	f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
1	api.pubwise.io	fdyn.pubwise.io
1	pubwise-d.openx.net	fdyn.pubwise.io
1	prebid.media.net	fdyn.pubwise.io
1	useast.quantumdex.io	fdyn.pubwise.io
1	prebid.a-mo.net	fdyn.pubwise.io
1	bid.pubwise.io	fdyn.pubwise.io
1	region1.google-analytics.com	www.googletagmanager.com
1	pfx.api.botman.ninja	p2e9r4n9.stackpathcdn.com
1	p2e9r4n9.stackpathcdn.com	pt.friendsforever.world
1	superal.github.io	pt.friendsforever.world
1	fdyn.pubwise.io	pt.friendsforever.world
0	lb.eu-1-id5-sync.com Failed	fdyn.pubwise.io
0	api.rlcdn.com Failed	fdyn.pubwise.io
0	fid.agkn.com Failed	fdyn.pubwise.io
272	90

This site contains links to these domains. Also see Links.

Domain
pt.friendshipquiz2022.com
twitter.com
www.instagram.com
www.facebook.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-06-28` - `2024-06-27`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
fdyn.pubwise.io GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-08-12` - `2024-09-12`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.github.io DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-20`	a year	crt.sh
*.stackpathcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-05-04` - `2024-05-30`	a year	crt.sh
pfx.api.botman.ninja R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
bid.pubwise.io GTS CA 1D4	`2023-11-07` - `2024-02-05`	3 months	crt.sh
*.a-mo.net R3	`2023-11-07` - `2024-02-05`	3 months	crt.sh
ssc.33across.com GTS CA 1D4	`2023-10-28` - `2024-01-26`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
prebid.media.net GTS CA 1D4	`2023-10-28` - `2024-01-26`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
admin.pubwise.io GTS CA 1D4	`2023-11-21` - `2024-02-19`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M02	`2023-03-29` - `2024-04-27`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
redintelligence.net R3	`2023-10-10` - `2024-01-08`	3 months	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M02	`2023-05-09` - `2024-06-07`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
pv.medialead.de R3	`2023-12-04` - `2024-03-03`	3 months	crt.sh
adv.office-partner.de R3	`2023-10-28` - `2024-01-26`	3 months	crt.sh
www.awin1.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-10` - `2024-03-09`	a year	crt.sh
*.webgains.com Amazon RSA 2048 M01	`2023-05-15` - `2024-06-13`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.webgains.io Amazon RSA 2048 M01	`2023-07-24` - `2024-08-22`	a year	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M03	`2023-08-30` - `2024-09-27`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
lexicon.33across.com GTS CA 1D4	`2023-11-27` - `2024-02-25`	3 months	crt.sh
id.a-mx.com Sectigo RSA Domain Validation Secure Server CA	`2023-10-12` - `2024-11-10`	a year	crt.sh
*.id5-sync.com R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
cdn.adnxs.com GeoTrust TLS RSA CA G1	`2023-03-27` - `2024-04-26`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-02-18`	a year	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2023-09-06` - `2024-09-30`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2023-05-06` - `2024-05-04`	a year	crt.sh
*.sharethrough.com Amazon RSA 2048 M01	`2023-06-14` - `2024-07-12`	a year	crt.sh
s.ad.smaato.net Amazon RSA 2048 M03	`2023-09-04` - `2024-10-02`	a year	crt.sh
*.adkernel.com AlphaSSL CA - SHA256 - G4	`2023-01-03` - `2024-02-04`	a year	crt.sh
*.yellowblue.io Amazon ECDSA 256 M02	`2023-04-18` - `2024-05-16`	a year	crt.sh
casalemedia.com Cloudflare Inc ECC CA-3	`2023-05-21` - `2024-05-20`	a year	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-28` - `2024-01-28`	a year	crt.sh
*.3lift.com Amazon RSA 2048 M02	`2023-04-13` - `2024-05-11`	a year	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-11-26` - `2024-11-26`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-29` - `2024-02-21`	6 months	crt.sh
d.adroll.com Amazon RSA 2048 M01	`2023-10-09` - `2024-11-07`	a year	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2023-11-03` - `2024-05-03`	6 months	crt.sh

This page contains 41 frames:

Primary Page: https://pt.friendsforever.world/
Frame ID: D374712E04F0B0D23B9A5FD705E5B38A
Requests: 91 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20190131/zrt_lookup_fy2021.html
Frame ID: D443F7CDB414B7C4980CB518E8542811
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7003191985075097&output=html&adk=1812271804&adf=3025194257&lmt=1701818551&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpt.friendsforever.world%2F&ea=0&pra=5&wgl=1&easpi=1&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701818551126&bpp=2&bdt=508&idt=205&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5704237447782&frm=20&pv=2&ga_vid=1986389205.1701818551&ga_sid=1701818551&ga_hid=768679530&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079605%2C31079714%2C31079826%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072&oid=2&pvsid=291141450960331&tmod=310378929&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=215
Frame ID: 7E739153F4BC9A32F30E5764C78596F1
Requests: 1 HTTP requests in this frame

Frame: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: AFAEAB65FB11AA8A098DC6CA47FF9131
Requests: 1 HTTP requests in this frame

Frame: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D094EC5ED96CA62E7D897BBCB862DA0B
Requests: 27 HTTP requests in this frame

Frame: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 9D5AC627C599B05FDDBC2E7138F4577D
Requests: 22 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV2A42NLQGD0glbKP944tnkmeA3nONFrtVZz9daD63s7WORgdaqQ0zq-QVNYnmpAaHWpEfSVdOZQ5JYn5UGYncEdwLngXcooUFy_v-cVJT0-81a1dziDok8BnCelajoaWPHcyA4hvAROhzhxo6wwmVHVtAe8AnIwERDqPjLKsuXdq8D0BY
Frame ID: 9B8A4820E2BFBB99DE66ADB19C33ADDF
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVQdzyJTn2M-7pYo-_oWvpUnkhjSOQKZjtkU-XyZS_U1C0NgOP0mt4Sb8SL-22xvA4NRNE7xVnWr-3AsBDbz7ySIZEWycike9rkv8FS0Z4txQE9F_E0QdDq7TTpT2KULgjUqzclrm2oXDjZMuOxVy74CdLb9sTBkOAe5KxXH-KC_6n23H8
Frame ID: C6FACD170D622594F90D77CEB339CE9D
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: B30E3B214E6F2899908345961EEB87C2
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 35AA7A017E43178AA5DD670F3E535610
Requests: 14 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: ED61E349337BF63A3153F5D31B8D974D
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: DAF01619A23624268115793741112A2A
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 5DC9696FE101B4D2423E545D64C82E7E
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: AFC0756FBD39CA00A1B73B7C80A004C4
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js
Frame ID: F2D2F15C1BFDC5629A58831F0607C938
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 3962876D5E60FFFE44F7B8BA86311C58
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
Frame ID: 5248B7DE5F42BF949BDE31DDC95B7A5C
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js
Frame ID: 9899DFA5BFCD154F4384A2555F2BE0FF
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: F5D9B76CB5F31C906644F17E0EDAAA08
Requests: 1 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=52239300001964104444550012530029&t=htlp&gdpr=1&consent=1&gdpr_consent=
Frame ID: ACB5054F02533C77561380C53C08A8D7
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 46C04413AFFD68DCCDB9D45A0CEBA0AA
Requests: 3 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523
Frame ID: 6C2E7DD49F37DA890603E209E0782538
Requests: 2 HTTP requests in this frame

Frame: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
Frame ID: 6598DFE87D065FFCE2AF022212140967
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F2EA29FB629AFF10DDA20785C8562C2D
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A1BE46BE213E398F9F0D76B528AC0C64
Requests: 2 HTTP requests in this frame

Frame: https://sync.quantumdex.io/usersync/pbjs
Frame ID: 660CDB26A175AD092D841F5B07102FD4
Requests: 8 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: A65C6491F4A915E49FC48ABAC29E0C0F
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: E67675E595B8FDA1E9CB05E9C4B96134
Requests: 3 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: F7EDEF76831F662161A458362224272A
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU75OYJ3&prvid=2034%2C2033%2C273%2C233%2C157%2C159%2C236%2C237%2C117%2C437%2C51%2C97%2C55%2C99%2C56%2C59%2C3012%2C122%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C208%2C2055%2C171%2C173%2C294%2C251%2C175%2C450%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3015%2C3014%2C337%2C338%2C459%2C70%2C77%2C38%2C182%2C184%2C261%2C141%2C262%2C186%2C461%2C188%2C145%2C222%2C102%2C225%2C468%2C10000%2C80%2C108%2C229%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1
Frame ID: 49758DA4D5D571BC7600995FAB4377C2
Requests: 1 HTTP requests in this frame

Frame: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dXYyk0o2ur7BmNrkHcnnVW&gdpr_consent=undefined&us_privacy=undefined
Frame ID: C12201FE2A976EA82463F68EA750D65D
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=185416&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Frame ID: 6942594DC2D1C7BD307CDFBA63DF9890
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=148144&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Frame ID: 28AB975ABF12D7AC8EDF54719505D008
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=149271&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Frame ID: 56D42D925C857813138179E375C0295D
Requests: 1 HTTP requests in this frame

Frame: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Drise%26uid%3D%7BpartnerId%7D
Frame ID: 6E7F3C2C26DF01B589389410CFBD4553
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Frame ID: D839C62564CC452A5171316DE410A67D
Requests: 10 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=2bb78272a859ca6
Frame ID: 9172B017ABCEEC5613BC7333BC327E1A
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Frame ID: 774A52B5C78DC58DC86C767FD1D5B8D3
Requests: 11 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=184388&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxap-184388%26uid%3D%7BUID%7D
Frame ID: 352416773CEFDAED782F84A928103BAF
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Frame ID: 011A557A7A3011909DBF4E679EBC558B
Requests: 2 HTTP requests in this frame

Frame: https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=
Frame ID: DBFA208BA9782464EC17CF3CBAE4234D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Prêmio de Melhor Amigo 2023! Desafie seus amigos AGORA!

Page URL History Show full URLs

http://pt.friendsforever.world/ HTTP 301
https://pt.friendsforever.world/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

272
Requests

90 %
HTTPS

37 %
IPv6

60
Domains

90
Subdomains

78
IPs

10
Countries

3050 kB
Transfer

8293 kB
Size

58
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://pt.friendshipquiz2022.com/teste-da-amizade-bff/play/2563?utm_site_source=custom&utm_site_medium=ad&utm_site_campaign=user

Search URL Search Domain Scan URL

URL: https://twitter.com/ContactFriends3

Search URL Search Domain Scan URL

URL: https://www.instagram.com/friendsforeverworlds/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Friendsforeverworld1/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pt.friendsforever.world/ HTTP 301
https://pt.friendsforever.world/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 93

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWoaCf-H6KHXaors-mE3Rw&google_cver=1

Request Chain 94

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW.wuCBawGXdfJk4xUYQKAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2

Request Chain 95

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEBvv4EobC5KWtsaeaFXghi8&google_cver=1

Request Chain 96

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQwODE5MDczMTczMjczOTAwNg%3D%3D

Request Chain 97

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1

Request Chain 98

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW.wuIq89JC9JpY7S-Ts6AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2

Request Chain 99

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESENEmErUIipCr4dgrWDDKr9M&google_cver=1

Request Chain 100

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ3MDQ4MTYzMzE0MjE3NDgzMg%3D%3D

Request Chain 134

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 135

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 151

https://googleads.g.doubleclick.net/pagead/adview?ai=CeM3mt7BvZfDaHc-_vcAP7v6OqA73mOKwdOjQ8o3fEbmb34aHKhABIPWblCpgleKQgqAHoAGEjJm8AsgBAagDAcgDywSqBNkBT9A2ryHCIXrYigHXW0kmuEGwO5UB5q8bZi110xTztLtTt5VpKV_VpduXr16jT5Eek9XDB6ZJy5wtEQdbQ12NxBwAs7FFE1p83BQ2dxmYxuD6NhACDttdefTDZgomzWocKvGeZncabC86NNHuuG-tdLn8kIoSH8PZ-czKCVfqlqcnDhq9_dxYSdP8-tsnFO8dNyhN-8M-kxiBttazuHi8orTXaYAva0t809060X3zSr3GkxIaNEGUr2jNoF2SBQmS0rCFAw9fJk-UdHT65YVciJLmNrsBWnd0OMAEu5qS37oEiAWPu8ybQJIFBAgEGAGSBQQIBRgEgAe7j_67AqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEENrUNtIIHwiA4YBwEAEYHzIC6wI6AoBASL39wTpYgZHnkbj5ggOaCbYBaHR0cHM6Ly9nZXRzdGFydGVkLnRpa3Rvay5jb20vZGUtYnJhbmQ_bGFuZz1kZSZhdHRyX3NvdXJjZT1nb29nbGUmYXR0cl9tZWRpdW09cG1heC1hZCZhdHRyX2NhbXBhaWduX2lkPTE3MjUwMjgzMTkzJmZ1bm5lbD1Qcm9zcGVjdGluZyZ0YXJnZXRpbmc9YWxsJmNyZWF0aXZlPVRleHQmbm9fcGFyZW50X3JlZGlyZWN0PTGACgHICwGiDBAqDgoM5LSxAu61sQK1uLEC2BMM0BUBgBcBshccChoIABIUcHViLTcwMDMxOTE5ODUwNzUwOTcYAA&sigh=qsre64DtTsc&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgDICaaNFiRcciqcf3CZQQK4bgZBJx_VFo4MNfYnEoc0G6U9PHCnrVxIx3duOpq3xlnywhpgFnABT81Q_LdlIkR4blYXhX31fDe7wzaULRgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212578264644738560297%22,%22debug_reporting%22:true,%22destination%22:%22https://tiktok.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22663111172%22],%224%22:[%2212-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224683544545019730833%22}&andc=true

Request Chain 154

https://fw.adsafeprotected.com/rfw/st/1627455/73523880/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-7520027584027322&ias_chanId=1&ias_placementId=20492285957&bidurl=https://pt.friendsforever.world/&ias_dealId=&xsId=ABAjH0gCNXqjv-659CPAE7UACAFU&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gCNXqjv-659CPAE7UACAFU&adContainerId=brand_safety_uLBvZdmHC6e69u8Py72I2Ac&cbFunctionName=goog_wrapCb_uLBvZdmHC6e69u8Py72I2Ac&true_pb=&adsafe_pb=https%3A%2F%2Fstatic.adsafeprotected.com%2F4a.js&adsafe_url=https%3A%2F%2Fpt.friendsforever.world&adsafe_type=y&adsafe_url=https%3A%2F%2Fpt.friendsforever.world%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Ff884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Ff884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:c29739b4-3cc2-32dd-b751-152c2275ae89,c:vYhQMs,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-594854db75-d77q6,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:DIV,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:18,oid:2a55f20f-93c5-11ee-afc7-b2861a590722,v:19.8.463,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/4.js?xsId=ABAjH0gCNXqjv-659CPAE7UACAFU&ias_xappb=&adContainerId=brand_safety_uLBvZdmHC6e69u8Py72I2Ac&cbFunctionName=goog_wrapCb_uLBvZdmHC6e69u8Py72I2Ac&true_pb=

Request Chain 174

https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 187

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523

Request Chain 234

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID HTTP 302
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=3470481633142174832

Request Chain 235

https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D HTTP 302
https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D&crf=1&rts=310679055145922638 HTTP 302
https://sync.quantumdex.io/setuid?bidder=between&uid=7aaf60a4-f326-5254-acfd-159fc992a525

Request Chain 238

https://ssp.disqus.com/redirectuser/?partner=valueimpression&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dzeta-global%26uid%3DBUYERUID HTTP 302
https://sync.quantumdex.io/setuid?bidder=zeta-global&uid=ua-405eeb60-19f0-3c0a-94ad-a1497bf7766c

Request Chain 247

https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID HTTP 302
https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1

Request Chain 250

https://sync.1rx.io/usersync2/rmphb?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%5BRX_UUID%5D HTTP 302
https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=

Request Chain 252

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=01ecba1a61534f60bb903333305a7ea6 HTTP 303
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

Request Chain 254

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEit50Iv5euCvy1nBS59wcY&google_cver=1

Request Chain 255

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gpp=&gpp_sid= HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gpp=&gpp_sid=&dcc=t

Request Chain 258

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191

Request Chain 262

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDcxMDc4NDQyMzg2NjgyODk0NQ%3D%3D HTTP 302
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

Request Chain 263

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO8ae7-dHEUAoASmbtP1YjU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

Request Chain 264

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDcxMDc4NDQyMzg2NjgyODk0NQ%3D%3D

Request Chain 267

https://x.bidswitch.net/sync?ssp=triplelift&user_id=3464710784423866828945&gdpr=0&gdpr_consent=${GDPR_CONSENT} HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=3464710784423866828945&gdpr=0&gdpr_consent=${GDPR_CONSENT} HTTP 302
https://cm.smadex.com/sync?sm_did=bds&bds_ssp_id=triplelift&bds_param=188933c5-efc5-4199-b05e-fb28ff576cde HTTP 302
https://x.bidswitch.net/sync?dsp_id=340&user_id=2b0ca226-62ff-450d-992e-8cf677d9472c&expires=10&ssp=triplelift&bsw_param=188933c5-efc5-4199-b05e-fb28ff576cde

Request Chain 269

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?mid=3335&xuid=3470481633142174832&dongle=4d58&gdpr=0&gdpr_consent=

272 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
pt.friendsforever.world/
Redirect Chain

http://pt.friendsforever.world/
https://pt.friendsforever.world/

22 KB
6 KB

426ms
408ms

Document
text/html

2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1f61d95c90c3ba60d0c9591a32133b57fbeda216e0d049fa8f99178c1e8426e

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 83100812ce9b6ae1-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 05 Dec 2023 23:22:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2WeHtFqm9myQkHUXWgW3WYfYsO2rrV4GI7hRE%2FnZDM5bWb5WwolR8w%2F8Axm8UyJ8FCYSXvjxYHSUXngMinD8omLXz0DQzMEW5a6zr44n4m4z66Amdz3N8qw%2F33e6nfp3keYK4PkjzHVM98QWXM5VIjAuyURR"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-host: as-hi-164-web
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Redirect headers

CF-RAY: 831008129e644dc3-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Tue, 05 Dec 2023 23:22:30 GMT
Expires: Wed, 06 Dec 2023 00:22:30 GMT
Location: https://pt.friendsforever.world/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yYr2%2FJvhT33WGP3fiIMgjMZmYFMs8gbEdpPHuAm7ItDMBlhXEmU9CGg2tqBM3ZEbo%2Ber6lLpHbZX8D7rvxUx6YJk1biUGAbsO9g8eLErkmNtYVRiU3Kuj9e%2FKnyfnRhHK7KYOQdUQ9ditjaqu17Xfz5Dm1fh"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2 200 font-awesome.css
pt.friendsforever.world/public/css/ 30 KB
7 KB 367ms
365ms Stylesheet
text/css 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/css/font-awesome.css?v=20231121

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c936bca314b30e3c48bbad667c920cac28e3e43b72f5f372c706e885a0aa2743

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-120-web
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 12 Sep 2023 11:57:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"84b0f-7823-6052825aa1c40"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3CBVlPUvdRAktyzojjwDQg7cqN2YCm553wbHhdEfkx8QSMHPGaq3pKk1gMaIr23sckSDPN%2FDVjErOXdUDMH8xO3llVGuNPSGArNsOTA5Ojw0sV12jEcsMs42KedD1uXiZ%2B204CvjbzijQpSyVvuunTmDxpDV"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8310081568956ae1-FRA

GET
H2 200 bootstrap.css
pt.friendsforever.world/public/css/ 119 KB
20 KB 17ms
16ms Stylesheet
text/css 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/css/bootstrap.css?v=20231121

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5270b4442df921b38b1241f7152a12f1cc932633bae9ec745515477369e4939

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-200-web
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Nov 2023 04:47:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4770
etag: W/"847b1-1dad3-60adea647ba40"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a3BI%2F7EOogAWtMwosWRJAn8AgusPKXc9TgMLwcZ7%2FqjEXZv01D5Noo4DYKI02bExSyqs4Ex%2B1j1LaaaaIe12XjzILLzR7Qlq55dSlEpZXn83JiUb6oifcDuEoALmuyewagZRjU623Bm7KBIj%2BCX71EO03ax1"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8310081568976ae1-FRA

GET
H2 200 common-spinner.css
pt.friendsforever.world/public/css/ 2 KB
757 B 16ms
15ms Stylesheet
text/css 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/css/common-spinner.css?v=20231121

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b6dfeb59f7464899e64068a09afaa80fdae61e9767a041f9bc60aae5362c599

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-164-web
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 18 May 2022 12:24:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1646
etag: W/"84bb1-6ff-5df4855f03c00"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mns09hgaF%2FtBNaD6mNBNmLc8HAUPHwmzDp60fcdcXyMrPGZjqDQuRHL1Y2gf5UiIUx3GQefY%2BZ%2FS7phGI6rZ5KeqdvrpCpw3D08DS%2FxMHCO07nhDjQqBYbvYmo8SOOI4jUoBg0XR%2Brw6dWWDAA7jh%2Bp%2F9JZH"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8310081568986ae1-FRA

GET
H2 200 style.css
pt.friendsforever.world/public/css/friends_forever/ 46 KB
10 KB 339ms
338ms Stylesheet
text/css 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/css/friends_forever/style.css?v=20231121

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1af8189c0a005cdfcd47482d36288517428abf24dd6dff2a84b98e2f5729e3cf

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-181-web
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 31 Oct 2023 08:53:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"c62b2-b820-608ff486c3e40"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FoCJXqfPGwQuMoFNH666weS5B1MsvSwETOanbAYbiDzjdycuqQfnTYB%2Fb81rON2MQ3L4VMIUyyHYvyNb4lE%2BTJEGPY5O5LiSF87tsFlW6%2B48B6G%2Bohtv2hbB%2Fd87DZbBF%2BY7uK54NVrSY5uagySj4cEctbqF"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8310081568996ae1-FRA

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 91 KB
30 KB 92ms
65ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba1cd9af530aa23f4fa4d81aa7047b128d8f78a62b1a7c3fa1f9fb9ea0550558

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29951
x-xss-protection: 0
server: cafe
etag: 622 / 19696 / m202311290101 / config-hash: 3440202233105863466
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 pws.js Show response
fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/ 482 KB
145 KB 210ms
179ms Script
text/javascript 151.101.66.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Requested by: Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ffbd03246f6fb03f3ad1a8a6194401ada2a15f6c82b39a3c608d13359669468b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
via: 1.1 varnish, 1.1 varnish
content-encoding: gzip
age: 5051
x-cache: HIT, MISS
x-goog-meta-surrogate-key: 6ee5d879a1b08f594d09e931818208a4 ad68bb627be803dc9c335edff2c354a9
content-length: 147739
x-pw-gzip: 1
last-modified: Tue, 06 Dec 2022 14:37:24 GMT
x-timer: S1701818551.024325,VS0,VE173
etag: "32860c01a1ce0f069ab0e435583858d3"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=21600
accept-ranges: bytes
x-pw-frac: 10
x-cache-hits: 1, 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
67 KB 61ms
34ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-207152156-9

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ebb21fd1c8aa540e056691b1af18b7fcf9860fc8c88a263ebafd80723044c805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69001
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 187 KB
68 KB 47ms
20ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-126527512-18

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e90de18068fd669d9dbbe1d39c2c8e7e252ef474deb2eb270b933d5d5c0c5048

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 69119
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 83ms
56ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7003191985075097

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

caac6db1bffec25e329e05610f10bf99c20ede03d4961741fea3d732aa53df00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Origin: https://pt.friendsforever.world
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51730
x-xss-protection: 0
server: cafe
etag: 17988222108247442940
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1019 B 36ms
15ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,400;0,500;0,600;0,700;0,800;1,600&display=swap

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6e5f38456e85c91724979e7df314dc38b568bed6a75d0fa42c5c76bd94c07ad7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 23:22:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 23:22:30 GMT

GET
H2 200 css2
fonts.googleapis.com/ 18 KB
923 B 38ms
17ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84cb06c27b7617c81b075bdb123e0e63e8da1b70feee763f86899a4fc3f3623

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 23:22:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 23:22:30 GMT

GET
H2 200 BFA_Log.png
img.friendsforever.world/public/site_content/quiz/ck_editor/images/meta/BFA/ 36 KB
36 KB 113ms
14ms Image
image/png 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.friendsforever.world/public/site_content/quiz/ck_editor/images/meta/BFA/BFA_Log.png

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb8727019f2f9986f7d2f6c3f3d454d1aa7d68498019eb96c2dcc596c7a5895a

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Tue, 05 Dec 2023 23:22:30 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4789
content-length: 36401
last-modified: Wed, 01 Sep 2021 13:33:48 GMT
server: cloudflare
etag: "e20ce-8e31-5caef1db5c700"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i0qfxMv8rt0Tekbu74vPkJz1595ssGrTmLslPIT%2Fkc8Kh0uVGbnYZLgwdhEXRV1onGN04TOVr5iDwGFlz6WFYETzxe91Ki7rhvjjixYDL5kyKi%2B2juTOc9Q6GUWHBbqcvEzGSpVZrNDnKrhPOe9WYvRYQO0Iig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 8310081609016ae1-FRA

GET
H2 200 lang.png
pt.friendsforever.world/public/images/friends_forever/ 661 B
1 KB 334ms
334ms Image
image/png 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pt.friendsforever.world/public/images/friends_forever/lang.png

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf9c6fa44989dd4c596f901f16c35fe611d383f46754231f92457dffa58ca006

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-117-web
date: Tue, 05 Dec 2023 23:22:30 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 07 Sep 2021 09:29:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c6b20-295-5cb64678cc480"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NtvhtIH2ig1YL%2Ff%2FQEScU%2BprDCiG4zPd6aNJ0orH6VnN3%2B3jGKbe4OoRT2%2BjmsjW0XOG3AtFWGp9SqO%2F%2FPx%2Bet1PetGw3XaXKVPthwkxbJVGQj0DAs55GkEu9CyrjKd3nux7peJI6YOLZQnEhZ7IZQ3xnVkQ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 83100815689b6ae1-FRA
content-length: 661

GET
H2 200 HolaQuiz-Category64cb4445015f8.png
img.friendsforever.world/public/site_content/quiz/category/ 77 KB
77 KB 806ms
805ms Image
image/png 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.friendsforever.world/public/site_content/quiz/category/HolaQuiz-Category64cb4445015f8.png

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2eeffe9ade4f82dd23a01540e23e8ac2d29bcc251e3c082ac08bf0f1390a87b2

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Tue, 05 Dec 2023 23:22:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 78424
last-modified: Thu, 03 Aug 2023 06:08:05 GMT
server: cloudflare
etag: "31c267-13258-601fe9a75db40"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7f86%2FO55sooLAm7sDrgsjqXaFa%2F7T%2BI9IKalkNhx7K78ksp9d%2B4nx1VCyOxqEqS1VL8O5%2B6LDhNL%2BmD62nqrEnvkvSV%2F9CBq3wFp3pNSLu3oJ5GaXW1qTew%2F1%2BmdNdoSgZClFf8%2Bo9Q2bXNbgUXxWC3DsNAtWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 8310081619106ae1-FRA

GET
H2 200 FriendsForever-Category6152bf591a7f2.jpg
img.friendsforever.world/public/site_content/quiz/category/ 52 KB
52 KB 651ms
650ms Image
image/jpeg 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.friendsforever.world/public/site_content/quiz/category/FriendsForever-Category6152bf591a7f2.jpg

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e7e70ae818df9b6d1d339cd71c104d8b96fa84a1e5f76d72ea05d8319dc896e

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Tue, 05 Dec 2023 23:22:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 53181
last-modified: Tue, 28 Sep 2021 07:08:09 GMT
server: cloudflare
etag: "3181bf-cfbd-5cd08e03bc840"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FwNUJHva779lBDrv1k3tQchQsoWaH59LlcyyWX2i6HRS0toSrH6ykozC%2FK%2B2kiF32xqLSOQbbfuuSq8PQtIVAeTt52PS1HJIXzPhmoVs2lLmRaI0jB5dt225z4eV5pJPthYnKt6d7CKMBrLEOQCP7yV%2BEsV6%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 831008177a106ae1-FRA

GET
H2 200 BFF_custom_Portuguese.jpg
img.friendsforever.world/public/site_content/quiz/ck_editor/images/ads_custom/ 40 KB
41 KB 367ms
363ms Image
image/jpeg 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.friendsforever.world/public/site_content/quiz/ck_editor/images/ads_custom/BFF_custom_Portuguese.jpg

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdb0b68c764f20f483b8077b9eb2080ac6871fcc65e6a214089eaa5571f84d55

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Tue, 05 Dec 2023 23:22:31 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 41030
cf-bgj: h2pri
last-modified: Mon, 22 Aug 2022 06:01:22 GMT
server: cloudflare
etag: "1f6676-a046-5e6ce2d58d080"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DvWWwaiYKjtvv3aiVBfZinnaq9WWbD9XBFYUI0butDh%2FeTpxkxq7MvAXP4fp3q6ihYYF8rXm%2FncSI90Jzrlq69YEgjMwEVPSl4tzzwtV%2FRPm8sqe0KVu4zz1rCSY1qu3ZG7ol3X6UJ%2BnWAnR%2BJjbQJIZf%2FSQgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: true
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 83100817ba346ae1-FRA

GET
H2 200 twitter_footer.png
pt.friendsforever.world/public/images/friends_forever/ 523 B
1017 B 338ms
336ms Image
image/png 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pt.friendsforever.world/public/images/friends_forever/twitter_footer.png

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63e6f24715518dd6a3520f0b6d768b24ce278787b788154d6fbccc10ac062c1b

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-204-web
date: Tue, 05 Dec 2023 23:22:31 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 07 Sep 2021 09:29:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c6b36-20b-5cb64678cc480"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w3u0s9Polow%2FTFjIbqM8QIkSqOtFolyIpr92aml4Ebs98hpFFiJWF7v8P1IMob0p1VSDqOU2ldJnp146g9v3XS2Omzo7tyf6B5YVFpFXca85bSqnsCkbTWrnPvVO9nJoUHuc7AgiKO47jei6TDRHeopGjL0d"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 83100817ba3e6ae1-FRA
content-length: 523

GET
H2 200 instagram_footer.png
pt.friendsforever.world/public/images/friends_forever/ 605 B
948 B 370ms
368ms Image
image/png 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pt.friendsforever.world/public/images/friends_forever/instagram_footer.png

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb0fd579388b546353dbf540497787a7fd40b983b99391a764706b984545667d

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-117-web
date: Tue, 05 Dec 2023 23:22:31 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 07 Sep 2021 09:29:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c6b1d-25d-5cb64678cc480"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xd0aJqLvtbHBu2RiAfW01Twm6MrswfdIA7hh%2BEEqhIR79IWNW47B4dMo%2Bi8Uw4soI4NID45jaCqlyLO68jMmzCJ8hfLaY1VNOb5mZCAfjC1VPJXEeCiyl34WU0pWVo5iNYba0A6R1dvASKxWQRDZsRkZR1sM"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 83100817ca406ae1-FRA
content-length: 605

GET
H2 200 fb_footer.png
pt.friendsforever.world/public/images/friends_forever/ 520 B
864 B 343ms
341ms Image
image/png 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pt.friendsforever.world/public/images/friends_forever/fb_footer.png

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac7c82b8bb1d0f85cd4e112e5789568360d256d2f3200aabab6f9d1dbce9663c

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-123-web
date: Tue, 05 Dec 2023 23:22:31 GMT
cf-cache-status: REVALIDATED
last-modified: Tue, 07 Sep 2021 09:29:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c6b12-208-5cb64678cc480"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jVx8yJ8Azl2MWmt10NtAECOkbC5ejSJaynaHPivOdL%2BStynSJ9wJ5EtZyypdJcyVYB6Aagm8hVBsbB0SMsXXDnbzQ%2Fa574Wq4tpphYoQUu58SZn469yjcYK1cz%2F5Pb3AWExI7tjI7hBaT93N1Cx1tkxoEhVq"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 83100817ca426ae1-FRA
content-length: 520

GET
H2 200 jquery.min.js Show response
pt.friendsforever.world/public/js/ 94 KB
34 KB 341ms
337ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/jquery.min.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi--web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Wed, 01 Sep 2021 08:47:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"84bac-176f8-5caeb1ed5b2c0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XulmmABG6B7XSE7BC8Z2vaVNxLuy9pPx2gEkauPEMSc14Uz0rgDJV9Y8MYwYb0voO7nErQv04eW0VNBvFpSyHp%2FiezyGAHaU%2FmUytdvAjsPI0mXoYcOCVWSbxRtB8LWwLcmH9HupVYlq4QL0Mg8T6VCpg5M4"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba336ae1-FRA

GET
H2 200 bootstrap.js Show response
pt.friendsforever.world/public/js/ 34 KB
10 KB 370ms
366ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/bootstrap.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57f6d3807b91f5746bee342a67bb053029f637f59ed6afee9f224ab8ef394757

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-63-web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Wed, 27 Sep 2023 09:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"84b8c-888e-6065389402ac0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Exd%2BDji%2F7GmrylS9hUUnl5LLX5Y5NRG5NBh8woFHV64TaG3JMK3%2Bb1AaaLlBfd8XhNGDqTrj6cVFh69CU3BeVJil8ZCnwgcm89mtTXapivYCA6bv9jvS2AlEgU1o6X1u2AD7d2AUJbCLpfOmxKiJYzda%2FGJP"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba356ae1-FRA

GET
H2 200 angular.js Show response
pt.friendsforever.world/public/js/ 114 KB
41 KB 25ms
21ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/angular.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c72c5cdb8ee97ed1e23f49f9cc0884c795f9c70e85a566453d9701f12cebfe9f

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-86-web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Sep 2021 08:47:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4769
etag: W/"84ba3-1c61c-5caeb1ed5b2c0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=83zF8S6ifQ9YhmGz7o62Z0a8xlPLvJeIMN%2FFlXNV0ZkXh6a3rC8Dfhme9Z0l0qcC%2B%2FYkdBzvGMG5Crz5h6%2B7adJNljv0xcpStqGxMKqkMzNAvCFHDyjnWz7SCJiU%2BOr7wCrF%2Fj31Ny0lYIokGPgfIBwzypbq"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba366ae1-FRA

GET
H2 200 angular-sanitize.js Show response
pt.friendsforever.world/public/js/ 21 KB
7 KB 19ms
15ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/angular-sanitize.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db668b70fd0021a224a50338fc80f62881fc5e678e84987ff62785d86ab3f320

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-164-web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Sep 2021 08:47:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1841
etag: W/"84ba2-5536-5caeb1ed5b2c0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nPmvNAnAZbPK3TIKmJMSOhHpcBik7NPcm%2FHCOLve96DTDApX0bp8teU%2FqmXhl3kp84Gbeaap4Gc2bTU37AqSwYmjlKCWSdEQ2egRr6CIulf2XlcTIYAiZt9ZgJ7J6tmJeLrnQZtSCq6hDQS5vo%2BLofdgF7C1"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba376ae1-FRA

GET
H2 200 site_api.js Show response
pt.friendsforever.world/public/js/ 269 B
494 B 334ms
330ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/site_api.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a7e4bf63bc70f8c050d0d52aea5b15dddaaf64fd51036cd996130cbb5f58b14

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-117-web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 30 May 2023 12:05:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"84baa-10d-5fce8041a54c0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l80l5GtECKNVpCfNVMA7e6EuMXHDKmcJM0Ph89dn8liB%2F4%2FTAwl1cN5LFc%2FjD%2FtUCww942aAXsPPNkta8%2FNZU4bcgekrM08tMoBe%2F1cf6HIePIiT2kBF9A2TwI5u3lXZVdFszGsIi9VYrloicqYGHXSiSVrL"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba386ae1-FRA

GET
H2 200 s_a_cont.js Show response
pt.friendsforever.world/public/js/ 97 KB
19 KB 20ms
17ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/s_a_cont.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba67e5d2e5db0a26ca087c9a9bcdf1ca76a909b0e00de8b692c187c98bfa82e1

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi--web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 09 Nov 2023 09:56:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4769
etag: W/"84ba4-18469-609b537133480"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JgrXjb14ckOLqtXTpkyDuY32Ccnt5dxaQN9taegQde4wKzj4jctfRB3Ksxx4%2FEu7olFcoQ00XRkya%2FpAlcvvL01ot%2FBqlSj4mJd7Q%2FqftDd2WqBqsf%2F2ZSPXigAUM5RdqFGYaBC%2BbMoFUh%2BLYQhTvCSX9RmI"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba396ae1-FRA

GET
H2 200 s_a_ser.js Show response
pt.friendsforever.world/public/js/ 6 KB
2 KB 372ms
368ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/s_a_ser.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e04a40af8692b8e76780c014a3f5ad8d55d98fe8a6cd671bbebd32413117888d

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-190-web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Wed, 08 Feb 2023 11:24:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"84c2a-198d-5f42e824842c0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q5Yzza8u%2FUlgdylvGU%2BuRMI5tFFtsIxN7v2asldK%2BKkE%2BBVXV8qHLOHCP6i1h50ozMiWHMyTCwEjZ5T2lC3DzEe4CycoVokBeaMMhby%2BhEvs4cmxcYk9mxVdCbCc7E84LYG%2FBoVEj0c%2F6qXaixCJRmNDLdmD"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba3a6ae1-FRA

GET
H2 200 site.js Show response
pt.friendsforever.world/public/js/ 49 KB
12 KB 22ms
19ms Script
text/javascript 2606:4700:20::ac43:48e0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pt.friendsforever.world/public/js/site.js?v=20231120

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:48e0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9d326d143e17ce184ce94bd819a52c092a13b2cea37cac67fc423984914562c

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-135-web
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Nov 2023 04:47:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1841
etag: W/"84c6f-c31b-60adea647ba40"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N0uOgWrKBbg2XhPxqC%2FaNcQq%2Fhh48Cnq7D5QGKrp0C7T3XU2QVxAh4CYRwm2pW9YV0V85O9%2Bokmrs3W3n7jkU90n9QH3LUBbY%2BXUY6HmkeV%2BCpmCUlCXZjnoecATDUM4I36kQEjhR1B22YWDY6CcJYTcR7FR"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 83100817ba3d6ae1-FRA

GET
H2 200 html2canvas.min.js Show response
cdnjs.cloudflare.com/ajax/libs/html2canvas/0.4.1/ 36 KB
11 KB 38ms
12ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/html2canvas/0.4.1/html2canvas.min.js

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

737473b145a0fb2d97963ba71104b42ea59d434e17d43de3db67ddffc24200ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 247722
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11066
last-modified: Mon, 04 May 2020 16:11:09 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e9d-9079"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QEE5JooJGqS5d5ovZPDx5kzzpoUD281gd%2BNXfZPwF78bg%2FuoysOvTSwLc%2FTdww7LtbZpqkNrNUwuxnS6RmRLOtSGTurna%2BQy%2BMfqwrjp94mSW29gFoYUBYTS1J52oZ7SlsFNP%2BDgyqWHhPhjUazKf1m2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83100817dbd0bb79-FRA
expires: Sun, 24 Nov 2024 23:22:31 GMT

GET
H2 200 canvas2image.js Show response
superal.github.io/canvas2image/ 8 KB
3 KB 33ms
7ms Script
application/javascript 2606:50c0:8002::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://superal.github.io/canvas2image/canvas2image.js
Requested by: Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8002::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 9a03674bfe83fe09eee7aae6106943918be73a009be21468c2bdb1b4ce958fdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-fastly-request-id: 2006c94377b12b079aea74080a4061fbf199678f
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: gzip
via: 1.1 varnish
x-cache-hits: 2
age: 176
x-cache: HIT
x-proxy-cache: HIT
content-length: 2514
x-served-by: cache-fra-eddf8230043-FRA
last-modified: Thu, 27 Oct 2016 14:01:12 GMT
server: GitHub.com
x-github-request-id: 57C4:6DDD:BFA50A:C267A8:65669693
x-timer: S1701818551.020250,VS0,VE1
etag: W/"581208a8-1fcf"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
expires: Wed, 29 Nov 2023 01:47:08 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 196 KB
69 KB 29ms
28ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NX4NZMK

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fedca70f477e2b6a0b5fed74374b64dd6159f4dae5c6ac3cf0638ed7ac047b8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70338
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H/1.1 200
OK __pmon.min.js Show response
p2e9r4n9.stackpathcdn.com/ 19 KB
7 KB 43ms
10ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://p2e9r4n9.stackpathcdn.com/__pmon.min.js
Requested by: Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: fd15dccc78b33bb29115461ac9504869f4af29b5bdc93111b8ecff5d58469206

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:31 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Mar 2022 13:58:37 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "4ba3-5d9c97e7e3e1f-gzip"
X-HW: 1701818551.cds289.fr8.hn,1701818551.cds324.fr8.c
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=84600, public
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6398

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 283 KB
92 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LBTPVBQZBX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-126527512-18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ae639a7506587163bc81082e5066794377d3573ed38ae6cb41051778cd0e08aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 94287
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
67 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-207152156-9&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-126527512-18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dcea90774b4efef72411006fda4ff5af93fc59b26ec28d6f93cdf7dac0cb8927

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68980
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 56ms
13ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-126527512-18

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 05 Dec 2023 21:22:33 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 7198
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 05 Dec 2023 23:22:33 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 292 KB
95 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NX4NZMK

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fbe2dbe2acf3d8629c626f25807486e251958d7d1c38be4b44ee39275cb7b12c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 97357
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 90ms
89ms Fetch
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7c9d9926c25c642b38c61db699c38c2e5029fb03788c08b0f39a4ca74138423c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51729
x-xss-protection: 0
server: cafe
etag: 3094598168538523387
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
79 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-G1CPQJTCEQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-207152156-9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d544a042adc760c2d4c0e55dfb54eee3e64209733c7db5fc3bbf028d63c86c16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81189
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 dip.html Show response
pfx.api.botman.ninja/ 55 B
479 B 308ms
96ms XHR
text/html 5.161.35.131
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfx.api.botman.ninja/dip.html?ak=f8fe1ae5c2968a9d211e3fdad4e6be1ede137ae5&m=PFX&module=JSTAG&f=SCR&vis=4&ifp=0&burl=https%3A%2F%2Fpt.friendsforever.world%2F&uq=IvNyX2lukfx4&ac=null&purl=&ih=1200&iw=1600&ow=1600&oh=1200&plf=Win32&cpu=undefined&lst=234lj4kl4dXfsDfkJitY323f6d3&aver=5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/119.0.6045.199%20Safari/537.36&uagt=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&cen=UTF-8&aname=Netscape&acod=Mozilla&cd=24&zi=undefined&nlang=en-US&ndrv=false&win=true&dnt=8&hco=4&plg=true&layer=0&nmt=0&nbo=Europe/Berlin&fsa=false&ch=1200&cw=1600&sh=1200&sw=1600&bld=24&actv=visible&acc=Intel%20Iris%20OpenGL%20Engine&gyro=undefined&pop=false&brl=0&brt=0&brh=0&brb=0&als=Intel%20Inc.&cam=undefined&bt=undefined&ce=true&dlmax=10&ntype=4g&ofw=0&ofh=0&s1=NA&s2=NA&s3=NA&s4=NA&s5=NA&s6=NA&hless=false&s7=NA&s8=NA&s9=NA&s10=NA&s11=NA&s12=NA&s13=NA&s14=NA&s15=NA&s16=NA&s17=NA&s18=NA&s19=NA&s20=NA
Requested by: Host: p2e9r4n9.stackpathcdn.com
URL: https://p2e9r4n9.stackpathcdn.com/__pmon.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.161.35.131 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.131.35.161.5.clients.your-server.de
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 9a73ec51d0e62c2fdb04d631b841b43d1d61a18fd1c09ffc243db565ef05bbe4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: gzip
last-modified: Mon, 08 Aug 2022 12:51:27 GMT
server: nginx/1.18.0 (Ubuntu)
etag: W/"62f106cf-37"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Wed, 06 Dec 2023 23:22:31 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 398 KB
134 KB 85ms
69ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7003191985075097&plah=pt.friendsforever.world

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7003191985075097

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e008c4298a5b3e7d5da28902166d987f328eaa2bbe022c9cb38f8b0c71eb4e60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137571
x-xss-protection: 0
server: cafe
etag: 4558922384891660742
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231204/r20190131/ Frame D443 9 KB
4 KB 39ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231204/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7003191985075097

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 86222
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 23:25:29 GMT
etag: 5585625838579639069
expires: Mon, 18 Dec 2023 23:25:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/ 432 KB
135 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa40858bc00aa25239b434a313f9b30b4b604715b21395c0f278a3055cd31deb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 20:14:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11291
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138184
x-xss-protection: 0
server: cafe
etag: 495798054771589180
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 04 Dec 2024 20:14:20 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
213 B 14ms
13ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=768679530&t=pageview&_s=1&dl=https%3A%2F%2Fpt.friendsforever.world%2F&ul=en-us&de=UTF-8&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1566198077&gjid=968233618&cid=1986389205.1701818551&tid=UA-126527512-18&_gid=1855048781.1701818551&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=2108906343

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
68 B 13ms
13ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=768679530&t=pageview&_s=1&dl=https%3A%2F%2Fpt.friendsforever.world%2F&ul=en-us&de=UTF-8&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAUABAAAAACAAI~&jid=1337856662&gjid=101059327&cid=1986389205.1701818551&tid=UA-207152156-9&_gid=1855048781.1701818551&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=2049361776

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
260 B 34ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-G1CPQJTCEQ&gtm=45je3bt0v9119070307&_p=1701818550990&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EAAI&_s=1&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=page_view&_fv=1&_ss=1&tfd=1031
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-G1CPQJTCEQ&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
355 B 51ms
17ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-126527512-18&cid=1986389205.1701818551&jid=1566198077&gjid=968233618&_gid=1855048781.1701818551&_u=YEBAAUAAAAAAACAAI~&z=853503148

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 35ms
21ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978z8851863554&_p=1701818550990&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=Ag&_s=1&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=page_view&_fv=1&_ss=1&tfd=1059
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 29ms
18ms Ping
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9QKBNZJYL1&cid=1986389205.1701818551&gtm=45je3bt0v899789978z8851863554&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 51ms
17ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-9QKBNZJYL1&cid=1986389205.1701818551&gtm=45je3bt0v899789978z8851863554&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=1288425589

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 20ms
20ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-LBTPVBQZBX&gtm=45je3bt0v894806200&_p=1701818550990&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EAAI&_s=1&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=page_view&_fv=1&_ss=1&tfd=1082
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LBTPVBQZBX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
45 B 17ms
17ms Ping
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-LBTPVBQZBX&cid=1986389205.1701818551&gtm=45je3bt0v894806200&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LBTPVBQZBX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 33ms
18ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-LBTPVBQZBX&cid=1986389205.1701818551&gtm=45je3bt0v894806200&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=1437749690

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 16ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978&_p=1701818550990&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAg&_s=2&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=page_location&_et=3&tfd=1101
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 14ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978&_p=1701818550990&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AkA&_s=3&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=scroll&epn.percent_scrolled=90&_et=35&tfd=1103
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 38ms
18ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-126527512-18&cid=1986389205.1701818551&jid=1566198077&_u=YEBAAUAAAAAAACAAI~&z=909332346

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 26ms
26ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-126527512-18&cid=1986389205.1701818551&jid=1566198077&_u=YEBAAUAAAAAAACAAI~&z=909332346

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
565 B 337ms
95ms XHR
application/json 89.149.192.64
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.64 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://pt.friendsforever.world
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
570 B 343ms
101ms XHR
application/json 89.149.192.64
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.64 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:30 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://pt.friendsforever.world
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
565 B 328ms
87ms XHR
application/json 89.149.192.64
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.64 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: 966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://pt.friendsforever.world
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H2 204 prebid Show response
bid.pubwise.io/ 0
217 B 154ms
118ms XHR
text/html 34.107.161.123
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.pubwise.io/prebid
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.161.123 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 123.161.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/html
access-control-allow-origin: https://pt.friendsforever.world
x-cloud-trace-context: a48916895b90c530bafbc68a59b9a6c2
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
359 B 61ms
15ms XHR
text/plain 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.friendsforever.world
date: Tue, 05 Dec 2023 23:22:30 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
server: envoy
vary: origin, Accept-Encoding

POST
H2 204 pbjs Show response
useast.quantumdex.io/auction/ 0
271 B 146ms
121ms XHR
text/plain 2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://useast.quantumdex.io/auction/pbjs
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.friendsforever.world
date: Tue, 05 Dec 2023 23:22:31 GMT
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 83100819ca579193-FRA
access-control-allow-methods: POST, GET

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 87 B
348 B 125ms
104ms XHR
application/json 34.149.20.76
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dXYyk0o2ur7BmNrkHcnnVW
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: aa75586e9689241b28f92dab52280da1b2bf690601ab184167caeba9fce092c5

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: gzip
via: 1.1 google
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
status: 200 OK
access-control-allow-origin: https://pt.friendsforever.world
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 87 B
170 B 125ms
104ms XHR
application/json 34.149.20.76
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dXYyk0o2ur7BmNrkHcnnVW
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: aa75586e9689241b28f92dab52280da1b2bf690601ab184167caeba9fce092c5

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: gzip
via: 1.1 google
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
status: 200 OK
access-control-allow-origin: https://pt.friendsforever.world
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 hb Show response
ssc.33across.com/api/v1/ 87 B
170 B 126ms
105ms XHR
application/json 34.149.20.76
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc.33across.com/api/v1/hb?guid=dXYyk0o2ur7BmNrkHcnnVW
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.20.76 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 76.20.149.34.bc.googleusercontent.com
Software: / 33Across
Resource Hash: aa75586e9689241b28f92dab52280da1b2bf690601ab184167caeba9fce092c5

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: gzip
via: 1.1 google
x-powered-by: 33Across
vary: Accept-Encoding, Origin
content-type: application/json; charset=utf-8
status: 200 OK
access-control-allow-origin: https://pt.friendsforever.world
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
589 B 151ms
108ms XHR
application/json 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
an-x-request-uuid: 1451345e-6388-485e-90e1-d6ca7b049f32
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
2 KB 106ms
77ms XHR
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU75OYJ3
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 40cd7c42ce18274b6c599fcbbb1148656807b12c48acd4c81474de8bf0658131

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://pt.friendsforever.world
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 61
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 23:22:31 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
585 B 144ms
103ms XHR
application/json 2602:803:c003:200::45
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19602&site_id=445828&zone_id=2575004&size_id=2&rp_schain=1.0,1!pubwise.io,605322,1,,,&eid_pubcid.org=a9f5c826-5e2b-46a1-b56f-7495822696e5%5E1&rf=https%3A%2F%2Fpt.friendsforever.world%2F&tk_flint=pbjs_lite_v7.18.0&x_source.tid=a6ff3dae-fff3-4b16-8a08-7901af3f8e95&l_pb_bid_id=30f8625a2c4bc31&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8393521132973896
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::45 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: bde870db9f69ed3c0d98de250435d2a17e919736ad5fae9ef3aa66c50c1a2013

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 240
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
585 B 127ms
87ms XHR
application/json 2602:803:c003:200::45
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19602&site_id=445828&zone_id=2575004&size_id=2&rp_schain=1.0,1!pubwise.io,605322,1,,,&eid_pubcid.org=a9f5c826-5e2b-46a1-b56f-7495822696e5%5E1&rf=https%3A%2F%2Fpt.friendsforever.world%2F&tk_flint=pbjs_lite_v7.18.0&x_source.tid=b900f2f1-ffd9-4eaa-8a73-ffbb3831894b&l_pb_bid_id=31766986f20a7de&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.4627937775155708
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::45 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 98d275c5fee6b2c633d8ae4531a879216028c3468a7843d4a2fe8e928da98463

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 240
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
767 B 122ms
82ms XHR
application/json 2602:803:c003:200::45
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19602&site_id=445828&zone_id=2575004&size_id=43&rp_schain=1.0,1!pubwise.io,605322,1,,,&eid_pubcid.org=a9f5c826-5e2b-46a1-b56f-7495822696e5%5E1&rf=https%3A%2F%2Fpt.friendsforever.world%2F&tk_flint=pbjs_lite_v7.18.0&x_source.tid=b551c9a2-742c-44ba-ad2a-2ada2630b8eb&l_pb_bid_id=327facc5e34ebc4&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8647654642253724
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::45 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 99bc25d0e108e627a0f594c4f0f452bc709d1ea5de3fa1bf5ac999ed749ea744

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 241
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 arj Show response
pubwise-d.openx.net/w/1.0/ 73 B
375 B 50ms
20ms XHR
application/json 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pubwise-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fpt.friendsforever.world%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=a6ff3dae-fff3-4b16-8a08-7901af3f8e95%2Cb900f2f1-ffd9-4eaa-8a73-ffbb3831894b%2Cb551c9a2-742c-44ba-ad2a-2ada2630b8eb&nocache=1701818551309&pubcid=a9f5c826-5e2b-46a1-b56f-7495822696e5&schain=1.0%2C1!pubwise.io%2C605322%2C1%2C%2C%2C&aus=728x90%7C728x90%7C320x50&divids=friendsforever_728x90_atf%2Cfriendsforever_728x90_btf%2Cfriendsforever_320x50_footer&aucs=%2C%2C&auid=557945575%2C557945575%2C557945575
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 39c832603d09d081c9192ee0c0330f5affc87714c81110957fc09f925917419a

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://pt.friendsforever.world
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7E73 351 KB
82 KB 607ms
606ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7003191985075097&output=html&adk=1812271804&adf=3025194257&lmt=1701818551&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpt.friendsforever.world%2F&ea=0&pra=5&wgl=1&easpi=1&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~4~6&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701818551126&bpp=2&bdt=508&idt=205&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5704237447782&frm=20&pv=2&ga_vid=1986389205.1701818551&ga_sid=1701818551&ga_hid=768679530&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079605%2C31079714%2C31079826%2C44806141%2C44807763%2C44808149%2C44808285%2C44809072&oid=2&pvsid=291141450960331&tmod=310378929&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=215

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7003191985075097&plah=pt.friendsforever.world

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50f54fbc6ed7b4c728674e8e7828ca99b911595bb2cd3dd3b312a14d39a7aa46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 83768
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:31 GMT
expires: Tue, 05 Dec 2023 23:22:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 31ms
10ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,400;0,500;0,600;0,700;0,800;1,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pt.friendsforever.world
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 00:08:32 GMT
x-content-type-options: nosniff
age: 515639
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Nov 2024 00:08:32 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 29ms
9ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,400;0,500;0,600;0,700;0,800;1,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pt.friendsforever.world
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 21:13:02 GMT
x-content-type-options: nosniff
age: 353369
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7884
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:03:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 21:13:02 GMT

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2
fonts.gstatic.com/s/poppins/v20/ 5 KB
6 KB 25ms
8ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,400;0,500;0,600;0,700;0,800;1,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ce2c84c474fb80b33e347ae6f356796021d6fd42e88a6352fc6e9ca0b22bd63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pt.friendsforever.world
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 20:16:03 GMT
x-content-type-options: nosniff
age: 443188
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5384
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Nov 2024 20:16:03 GMT

POST
H2 204 / Show response
api.pubwise.io/api/v8/event/add/ 0
182 B 199ms
160ms XHR
text/plain 130.211.34.132
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pubwise.io/api/v8/event/add/
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.34.132 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 132.34.211.130.bc.googleusercontent.com
Software: nginx/1.19.8 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
x-bes: pw-api-v8log-zzdw
via: 1.1 google
server: nginx/1.19.8
vary: Origin
access-control-allow-origin: https://pt.friendsforever.world
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 47 KB
16 KB 291ms
291ms Fetch
text/plain 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=291141450960331&correlator=4355825664239482&eid=31079968%2C31079970%2C31079240%2C31079527&output=ldjh&gdfp_req=1&vrg=202311290101&ptt=17&impl=fifs&iu_parts=21759293390%2Cfriendsforever_728x90_atf%2Cfriendsforever_728x90_btf&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=728x90%2C728x90&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701818551655&lmt=1701818551&adxs=436%2C436&adys=119%2C1697&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C1&ucis=1%7C2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpt.friendsforever.world%2F&vis=1&psz=746x22%7C746x22&msz=728x0%7C728x0&fws=0%2C0&ohw=0%2C0&ga_vid=1986389205.1701818551&ga_sid=1701818551&ga_hid=768679530&ga_fc=true&dlt=1701818550619&idt=647&prev_scp=refresh%3Dtrue%7Crefresh%3Dtrue&cust_params=page%3Dhome%26lang%3Dpt&adks=2727974958%2C621238773&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae87eca13f4f819535be7d4bff6619d7432d07b329ae57d5e3e0e926c542bffa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:31 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16231
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame AFAE 6 KB
3 KB 88ms
41ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:31 GMT
expires: Wed, 04 Dec 2024 23:22:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D094 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:31 GMT
expires: Wed, 04 Dec 2024 23:22:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9D5A 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:31 GMT
expires: Wed, 04 Dec 2024 23:22:31 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 160 KB
55 KB 96ms
96ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc3f72b5fd9d8db2907974cf2c815903dd438134ab524f6c9be1d3c8a8fa84f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55950
x-xss-protection: 0
server: cafe
etag: 18312829676527222209
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H3 200 slotcar_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 93 KB
32 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/slotcar_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7003191985075097

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de456781e54a563016157873f502b4314950b959e42e789967d3bcd060d1ef3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32962
x-xss-protection: 0
server: cafe
etag: 12739121731527550817
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9B8A 624 B
246 B 49ms
48ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV2A42NLQGD0glbKP944tnkmeA3nONFrtVZz9daD63s7WORgdaqQ0zq-QVNYnmpAaHWpEfSVdOZQ5JYn5UGYncEdwLngXcooUFy_v-cVJT0-81a1dziDok8BnCelajoaWPHcyA4hvAROhzhxo6wwmVHVtAe8AnIwERDqPjLKsuXdq8D0BY

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:32 GMT
expires: Tue, 05 Dec 2023 23:22:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D094 89 KB
31 KB 124ms
124ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D094 42 B
63 B 42ms
42ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BXIAM2EiLM23DVXC1E-_j_ZI__ZxptuesGlt5-BIB1eGRL8ws_0PzxqZ4O2-24BvvLWRVxbstLHA2GqEFW-dMriUoPOQAB9Xmr0JaQIp6NuJc4Qo0

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame D094 3 KB
1 KB 29ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame D094 20 KB
9 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D094 202 KB
64 KB 51ms
31ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C6FA 624 B
246 B 48ms
47ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVQdzyJTn2M-7pYo-_oWvpUnkhjSOQKZjtkU-XyZS_U1C0NgOP0mt4Sb8SL-22xvA4NRNE7xVnWr-3AsBDbz7ySIZEWycike9rkv8FS0Z4txQE9F_E0QdDq7TTpT2KULgjUqzclrm2oXDjZMuOxVy74CdLb9sTBkOAe5KxXH-KC_6n23H8

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:32 GMT
expires: Tue, 05 Dec 2023 23:22:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9D5A 89 KB
31 KB 166ms
166ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D5A 42 B
63 B 42ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AutRfs_Olee62frrDtjX78iWR2zDZ0x1ySn_rNTdOYmco2nSxA9n3vyrQyIJsBD46XE0u4cwRcVORgxV0zAY-5IrHGil9fa1CYGj19bm9cWeSTn9o

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9D5A 3 KB
1 KB 26ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9D5A 20 KB
8 KB 24ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9D5A 202 KB
64 KB 84ms
68ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 9B8A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWoaCf-H6KHXaors-mE3Rw&google_cver=1

43 B
342 B

18ms
18ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWoaCf-H6KHXaors-mE3Rw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV2A42NLQGD0glbKP944tnkmeA3nONFrtVZz9daD63s7WORgdaqQ0zq-QVNYnmpAaHWpEfSVdOZQ5JYn5UGYncEdwLngXcooUFy_v-cVJT0-81a1dziDok8BnCelajoaWPHcyA4hvAROhzhxo6wwmVHVtAe8AnIwERDqPjLKsuXdq8D0BY
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3%2FldBI5ZNVRqh8OAggu%2BeUgFUcudyRLfPM2yISdsNKuM%2BaDl%2Bs9SotJTE7T%2FDGjSkM78UCNzbp8HEfDm1DJR97vcUAmvBj%2Bt058nzFCGJrFFpvcQ7178nJKEN%2F2ADj8UefW0yYPH9uiInA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8310081ea95636dc-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELWoaCf-H6KHXaors-mE3Rw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9B8A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW.wuCBawGXdfJk4xUYQKAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2

43 B
727 B

22ms
22ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV2A42NLQGD0glbKP944tnkmeA3nONFrtVZz9daD63s7WORgdaqQ0zq-QVNYnmpAaHWpEfSVdOZQ5JYn5UGYncEdwLngXcooUFy_v-cVJT0-81a1dziDok8BnCelajoaWPHcyA4hvAROhzhxo6wwmVHVtAe8AnIwERDqPjLKsuXdq8D0BY
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m7artfeqhhkk7jhjxpDe5t9gu4U7ptC9QnexPhk6cc9eNvhGD2SEWiqcOXbQjOkKiEaChpWz25aA4n1LpMpH%2Ft7bXP11FjGMP4P8RAb8GQXe4LY9fJFuPOlIpY7Q4ZO1LQ14mUSW1P7Hvg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8310081efeca1e56-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 9B8A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBvv4EobC5KWtsaeaFXghi8&google_cver=1

43 B
840 B

14ms
13ms

Image
image/gif

185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBvv4EobC5KWtsaeaFXghi8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJCTupUDEPK-3ZgDGNiL3_QBMAE&v=APEucNV2A42NLQGD0glbKP944tnkmeA3nONFrtVZz9daD63s7WORgdaqQ0zq-QVNYnmpAaHWpEfSVdOZQ5JYn5UGYncEdwLngXcooUFy_v-cVJT0-81a1dziDok8BnCelajoaWPHcyA4hvAROhzhxo6wwmVHVtAe8AnIwERDqPjLKsuXdq8D0BY

Protocol

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
an-x-request-uuid: b4da13a9-aff8-44b2-9a27-ab99b40a454d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBvv4EobC5KWtsaeaFXghi8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 9B8A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQwODE5MDczMTczMjczOTAwNg%3D%3D

170 B
243 B

23ms
16ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQwODE5MDczMTczMjczOTAwNg%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
an-x-request-uuid: 3b8b182e-5690-4dcc-8584-92a48293fc4c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjQwODE5MDczMTczMjczOTAwNg%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame C6FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1

43 B
329 B

23ms
23ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVQdzyJTn2M-7pYo-_oWvpUnkhjSOQKZjtkU-XyZS_U1C0NgOP0mt4Sb8SL-22xvA4NRNE7xVnWr-3AsBDbz7ySIZEWycike9rkv8FS0Z4txQE9F_E0QdDq7TTpT2KULgjUqzclrm2oXDjZMuOxVy74CdLb9sTBkOAe5KxXH-KC_6n23H8
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N4cSgfTZPJWLh%2BOZMU1lTnqReHp2%2FB0xkOY9jjmvGdDw2A65QvT5bIkYdml3qDBKsGNFkEmdXa%2BD7FgPP9KRFTDUviCA7PQxpFCQSjnP8obNxEovCpSzeLVgCx%2FGCqozcscRJ91e4COeHA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8310081ea95336dc-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C6FA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZW.wuIq89JC9JpY7S-Ts6AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2

43 B
772 B

21ms
21ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVQdzyJTn2M-7pYo-_oWvpUnkhjSOQKZjtkU-XyZS_U1C0NgOP0mt4Sb8SL-22xvA4NRNE7xVnWr-3AsBDbz7ySIZEWycike9rkv8FS0Z4txQE9F_E0QdDq7TTpT2KULgjUqzclrm2oXDjZMuOxVy74CdLb9sTBkOAe5KxXH-KC_6n23H8
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xzqydzlrD5GAY6UGq9WZKRBXcMcXOdPSjevMoMWWQ6Ry1JLDOIhtDjAqdDcjVPCVvdouaSLSEzeWETXd5eAuZHp7oOyjrkLkptc%2F8iRDN7t9g4Jw5fGUtMOTTkd8Pk9Qqh%2Bu%2BN%2BxiBxJww%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8310081efecd1e56-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJIsnNw8JyYsFAUwXKqK2WQ&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C6FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENEmErUIipCr4dgrWDDKr9M&google_cver=1

43 B
840 B

13ms
13ms

Image
image/gif

185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENEmErUIipCr4dgrWDDKr9M&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNVQdzyJTn2M-7pYo-_oWvpUnkhjSOQKZjtkU-XyZS_U1C0NgOP0mt4Sb8SL-22xvA4NRNE7xVnWr-3AsBDbz7ySIZEWycike9rkv8FS0Z4txQE9F_E0QdDq7TTpT2KULgjUqzclrm2oXDjZMuOxVy74CdLb9sTBkOAe5KxXH-KC_6n23H8

Protocol

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
an-x-request-uuid: 52fd288e-218c-4ae9-88cd-155dcd64a41c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENEmErUIipCr4dgrWDDKr9M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C6FA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ3MDQ4MTYzMzE0MjE3NDgzMg%3D%3D

170 B
232 B

18ms
17ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ3MDQ4MTYzMzE0MjE3NDgzMg%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
an-x-request-uuid: d9c71463-2e22-4337-8a22-58ebb0453388
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzQ3MDQ4MTYzMzE0MjE3NDgzMg%3D%3D
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/ Frame B30E 9 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34134
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 13:53:38 GMT
etag: 5585625838579639069
expires: Tue, 19 Dec 2023 13:53:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/ Frame 35AA 9 KB
4 KB 6ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34134
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 13:53:38 GMT
etag: 5585625838579639069
expires: Tue, 19 Dec 2023 13:53:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame B30E 4 KB
767 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 22:07:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame B30E 205 B
296 B 35ms
12ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:13:25 GMT
x-content-type-options: nosniff
age: 126547
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 03 Dec 2024 12:13:25 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame B30E 604 B
919 B 34ms
11ms Image
image/png 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 16:29:57 GMT
x-content-type-options: nosniff
age: 24755
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 04 Dec 2024 16:29:57 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/ Frame B30E 16 KB
7 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 16:03:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26332
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6766
x-xss-protection: 0
server: cafe
etag: 14924840246271906451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 16:03:40 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/ Frame B30E 22 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:42:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9210
x-xss-protection: 0
server: cafe
etag: 13914886398874665762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:42:02 GMT

GET
H2 200 b1fdc9f83bbec90a172a8086cc6d7abe.js Show response
www.gstatic.com/mysidia/ Frame 35AA 9 KB
4 KB 26ms
5ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b1fdc9f83bbec90a172a8086cc6d7abe.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbde0fd637840b04806e70ee7610047e1cfe5568854929dc58c310a861d93ca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 15:24:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115066
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4047
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Mar 2024 15:24:46 GMT

GET
H2 200 280465d6b51993ac6d052e033b440ef2.js Show response
www.gstatic.com/mysidia/ Frame 35AA 11 KB
5 KB 33ms
13ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/280465d6b51993ac6d052e033b440ef2.js?tag=text/vanilla_highlight_ms

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3e4cdbb12defe352221c7446f538206d487f314187f7883e6f261d9246ab3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 23:12:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87002
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4756
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Mar 2024 23:12:30 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 35AA 14 KB
1 KB 16ms
15ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 21:51:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 35AA 2 KB
875 B 9ms
8ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 35AA 24 KB
9 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 35AA 3 KB
1 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 35AA 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 35AA 202 KB
64 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H2 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame 35AA 37 KB
15 KB 26ms
7ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 97990
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Mar 2024 20:09:22 GMT

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 44ms
42ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7003191985075097
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D094 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1925164581815&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D094 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1925164581815&version=m202309260101&ct=76&x=1&cor=2605904013992248000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D094 110 KB
41 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsK-PzmVUMs_qA4y6wL68np0Zjk06kQTIykYPw-kjTaL8nhTSiq9WKc0HgpsrMMhoqkQ3ETX1NxHRwFaU05ehcBpL0hbXtfB55bJxhPk1vMZ1P2xJBPnzYXMdBcYnvJPrmxJ4KXoCRuLBzs6-W6b1y7fPjU3TqaQV1z9LaQU0ZUlQL7WE&dbm_d=AKAmf-DeZNFH2SxhLsjhBxDgMvNWswNpO_FcJu0DAAy8wKPeurs4miITmvEQK8ANWTW8InVm8y8aZZjhU-jsEyjBjvpn-FYFIghwILd5Wd9Po_W3uEYIYp-leMdanp71zrD96B7J3WuPqJJJ5uzPdkPABk0YM_JkEMyPM8hDm7b0xQW9WgvpcQ_uy4td8Nnn6eoFULdSb5FJFUUzaifKPmHd0Hhna3FP7JsIWTKj7NOakZyVNWSRLUhbM_zAYIUJs9jubDOOozNA4JnxNkf1Jlxf_yD8RtGcyxcquD7HiDJmwIA4SQGrrkJc_PnGvH1IivNpfL_yXo705jp_dIHorcIQjsrLN9JOXo0FmIUD3Vz9VuGtWIMNM-t9TT_1E9Ui_zaWcbMeHQTzV8yMqW4u_9_9iDFzQtcdmLJ-fPXqAa5t2PyEEPQ8N61OSI34eU5MgyQfnzE2dxMex8wvuoUp4-Lz7OpZJ6ClvQoydQmAEVITPzySbrm2apGm2PCuuksHsmh8pXk01peoXg6X1vVcAp4Yzlabmqh6689uDGFbZUF9xcMn_Vi_WMscwXCwcI-VyK433JZoERUQe-EzyaGe7Ii3k_6cd_WyUa9XMehkUJXAByYAEQsV04TVFOxIKdNsUIZ4L9hTHsjw9_UUIjs1oPez8ZP52Mz_w1RPeBQlylTyseGlzbpHcdzS68My2ptMRMNgZa6phSSQqH5wAbol0au4173fCMzOTF50OlCiVeO7yraQj6zK4x-3I2A1p7HAeKLuqXCMCMkdk-EEiBFUihvyye0p_gh_1rOB3IPB-zoEgsVndj69aFLb7vSyhCxmpu7QlTtW5nwjlfw5lh0kH4bdODdbd7BHubjfCum2YjJBjp3tYRyZ5T1IXEF1H4H1G1XKy9jq8pml8tkMOsmov0f-Um83q8hRpZUCqSSW1jP96pkCMuuU1WlaBw0W7R1Fg6bV0r2-skjKA9HYmASKX5FkYG3MvTJ97JyYNw9WDHlQ1ghdX30rXEi3djVza_nCWlIZShioZBa-p15DUHdsauaqJOK55W1xQ7losggRR-YMxf6xZpFFlpzXKRNkHEBU--x-_eaH7peev_6udUI1ejqPxSHaXGzgvA2G465CbCiO_E-YQdCwz88NPzmfMn1vdbCQ0KebbKLz4Z-TJTwVodPOANopvEemQmCGkCBlr8zwrCoihxvQfR59FOD3EttV1HDdS406knW3hPEIyE5U4KX_sEXgAKEUc-cqS_m6anHbngw48TBr0J5nMPdZKzvl0waj7AS2q2KD4NduP9EsU2t2-WVPKODMviL2zLe27xR3qgiYFpiyuWxLvnEGgvgD2nKDW9eolkp9h0qM7AR2pYp-bB0gq-5l2yQMxXWN8ftCyPiaj9ESGfvo1SY1thPGLg8rMs5lRDO3ZAdKX6B8lY4vTKt6HGAa82KPuC3jmL421euMg5ljWKeUECaLteRlg0HyV9Kb7aC1TQhbyd9RS5rDh9D0wPUlXmO6NzqAnkBUbv1pzf8HpnS9S6LEvfte-yJpI3rsHz7Jk7SOnE1leaMvwvJS83b_ThfDDup2YqYH61Atz7Rci2PSfDFvr3KPzRUPQ_tjqtC204zrg0c9V4yWZjAruV7PAg1jf0CZ3Uxqg95cYRDU7OL_o3b3A_oRu4_Spf9y60phAQTcbb-lbagqwqtbtr2duXj0S-Jt3IcR9cw0md59t2IefSWN43kb6S5y_c4QCofrNQwh3LqUrC-XH7XDy27Dg-kqjlfwJQsWIrFi4j5-KtBax5aDB7jXyAFeOJRCHFU5hBeZrDFYf7AAP-B5se_bYIEVUnON3fDDQ_6u49nTWUmB91F7WJM7E10l47ixv5dkfxUKwRWtoXXGMaBVml-AGp7A1Ex2nSutcip-hkoy9ZCWtiVeeDHdxoSotXi4_FdvzIev9yLXIeRIqzp2Rvpt7o-A3h7MinhL-Q15KRL6VYzZdomQi73istCsS3guXy2IVgWu3Kl8pnffcXEvFk1fFLoI3to6MAB1vQNu3TGoF2otg1ESFsAjvFW31wP4n58o6pMxEW1fJkccgYZ_JogXOFsQtfLJeJtWtWCv05z0zTRrd0Rj2eI0-s3PZZDcaHYKQcYUzOKKF0v0DGR-GykHNcC-7ZB4Fvx1lDBr0047bJHtVAj5pCJ-V-MwmhQgqbMjWEhAcQ_-fBRr6UTTpfelQ6PgGz_ZTYsDmvXyvMcE71e0s6ELMsJkDxOcKT4as_mRfRa5zbpjks6TvwrCy7X4OmqV_JMXsWEM1Ob7XB01c5ay-krL5YhyAhBRgb-Ah731_DpEoCGuw2iJ3kIjq13Xmp1WjsOV-NssKxQJzMQZohfDTKssUIyVr0BHFiduVcghH8OMk47_LNgEk8oqo75gUfOz0gylxpi1Ckmdc25pg46ZcnqVtYyr0-rkAjLfDEq7PCjgJZorJcK6qOVOnQqWbcHqJeypEaqGO2gbMH6PPdkQw5o4_zbneu5DM5w9t4vneLz--ZBM7HcbTxa9qlWL44fyejzRX-Z3exIvzjbe6feKrdjhOnFSBrCI0nb1ZaNnI4_OBOSfyAkRKZNof3z-16qNHCidUrgrrHsReyGsAhEWLLGLBLsRlCT_p-2K_ohg-pzRTOLBQ8cLm-QVUi39Zp7bCiKpF6S9Gx_tZxkgrru4jx0X60ii5MrRC9iKKhppZyPX-atiUOvNEoqtBQWuppDjpxmK5RaGeTCUbSuj31feuJnL1LSEJdMHjk9HI9dPi0fwl3l35L7g6Q3MV_LN7U3Uk-YHsAfLvMkm2nq3lw3j3prpIZEcwlucwu5Yy147XMaL_iQbgy6-UuTWh70v-tGFAYUkZ5hoRyK5rRr4I9zI6v5zSNMre0g6iHywuKATOcSB54pF5N0XneKVR-BhHbeck6YF6tnV_Yj4l9D741kc2eOzJeQo2eDNsNW2emv4Rs8ppUWOR8B8-0iSZbtq8UY1ynek-X0zZjyw9Rqmpuf4u28a0bBrBdQWFfW9xBgdICUVHifdCywr0k6ay2uWZOvX_jD_Arv7YM3Emw988wH4HVed18oNWHOCw5Ms_iKjLP03ROq0IYvm75NFXObu9leqXVDAFUvKIMG_ZBzCGRAEepvn0cxxzTO5IKBNyiDLpbmn5Fjcqp-Oho7WYnfCIRPRbYv4qPbY1Pl9n_i7xhJY97cQjWG-0o629NXmULV3RxBEnxe9nItDMtBaf5nLyc54Ir0WFhC2BsFAY3KaVsSBbIQlHm8jrnAczFSEtfcbWB7B3zQjnKQNdRj1LXYQb8XNG6At37Bo2mWHEsxjxy3JH5YhWl22EnvNc1KzVrhXgo2ff07N4vfSF8hJyvI7p619Ryf8UtCHyTg07424shF7KXBaLp7kLjqRkgBZQhh9IpEqrUdOAxB9gJs65nmh_qpODiHkVvbOnzf8L6CSMgmqQJWCPismt2clW-u-V-65SwHIva2oEbaRgb5jRzEY0YPg7ug46OTvXnRD_xqrv9UoiHbuQIDNeOyujTPn6FtnYgcQpzhe4H2amx5ZMQnxom8jIqDLL0zv7fySxm8WTXUdlutbn0cAqC7qA9n0PPtm7V5KY2MTzm2rakHDf9aULXRHFeT2fDZypWYHHMUBwy4tdE4Jr9Elm6bTOowtx9vlfxBlBTxV3Og_0O6GgdkqG5rpH2viwhqikvzywfDLPqZuYNMp0ZA8BpeC1-q7s55prNWnSTDGNqh6a4WFklLyPM0G7L-BZ1_3ABFL-T4fbfyqcLZVX4xfkq8mEIa09YsduWazJzYbZ4-8I0EtpcBWbhbGYbGFa70J_ubL2i4jDzc&cid=CAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpt.friendsforever.world%2F&ds=l&xdt=1&iif=1&cor=2605904013992248000&adk=250412561&idt=155&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca3d325a1bc4c9fd2b3ab2d7504280aecb1664f6c90a5bd68f33b754236962ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42409
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame ED61 14 KB
1 KB 18ms
16ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 22:10:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame ED61 2 KB
822 B 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame ED61 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DAF0 143 B
166 B 13ms
12ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2645
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 22:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame ED61 3 KB
1 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame ED61 20 KB
8 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28343
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame ED61 202 KB
64 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Dec 2023 23:22:32 GMT

GET
H2 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame ED61 37 KB
15 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 97990
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Mar 2024 20:09:22 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D5A 0
20 B 42ms
40ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6053186454572&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D5A 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6053186454572&version=m202309260101&ct=77&x=1&cor=2030330457760623400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9D5A 20 KB
13 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CvRrcOzqRSzFDXUA6-Y0fC6eXLOCG7j47JYupgwGllU9_EuRdp52_Rhx3Q2PfsChzbirot22WIvHJC6mHhU2MZSyyzurU0X7DdqmKdYmd-kTA87G16i4xjmnnA7yJui9gw2KYjtNyHdz1vcF60Q-NwQX3pl_CdnFUJ4-yjiVsBzAcgaYA&cry=1&dbm_d=AKAmf-DsSqhyFnucCthU_uCi7rG-BHWPY2vWT31bn4SrQfkekgQu7XriSvZtEQBPlDVNWgohZffYLAfpBltsMr7RLlE4CkwY7KcirBWvELFdJuF7OOOZMTxc6_d2KGylbGc4OND9NPP2jVnUJKOBFZjLnt4-ILjPkZEfhOG9sCmDw48rt_W8O2q1nEyqS4pjKQzIswNoxPdBHTZZZAmGhDUaMMW_BSHeWgodqqPsToAqGznClXt5bD0JhL0uKtIC2NqcGDf0OqZAtTHv2SEBFAEeSTj4G81csF2gi2SLqmM1E6xm8hM_B5I4-6Cep-2E-bt-zefIb3eVTiNT-FF_ljE0Q50Cp5NzTKVadsb8zYFJP6khlb2wr4xjE-_Cllcno8chA6kHly0R1PaSzVJP-C0G1PrhPs9TBD7clpc5ueBgNxeOnIzxya-9FxYQBlJzSeKHn56R-JzsMaLz-a7-xx1Hoiu0KZhJgEBSe058fArm8-4Kc0NUEPiQ2ibRnciOFmiBTWUmsAMhJvs1Lwg4sORGxc33BNy4ov2qkYEWkqOM0Uq3OVEY8-q4ZOVtii8IuB3OhbxVZWOPWBto1a82HqrIm9NPZn72qFrYkj8ToYb3t-DrG8dsSa-GOLZvNlJQoAxccLLSOSsnENptQmXZVGMHzMjFctPJp4RkH1rkhZFeB88vZ8FP_n_Gu3-XArXi36J1w1tJSweucnFEOnXVan7YfCXO3D2yVT3kuW3ZhhizvJagNGONGwAjNlR-8QCfHsepHnspfisU9P5zFP73Wt_Pt-VXbAWF7PwvLtyKzLglO881q941B0scSSJ3xODskOiJfcjS_E-b7j4eu2RNKoPgrFHXtGk0p9PlcP3Kv0Co2y0GJqR4pHmzE0KVYi8ym4AnqTAs8ElpB2YGWvdVdZf2oGnQVG1FiUvi3HjrTVAV7QFWjch-iR_VRogM2shNpv8y8NnrrLEW3nPOTrwJGs5I0JPl8umjeN0gv2s0pThnBYI2pIxh23703e1ZNu_-HkWtN6Eqp0Fd9PkkXTYKv68ZCTmvo0bfrfr_r2nb_bAm8g4B030wF1Bk3-TDlZq1L0p5PCDKiJznIi6Qt5PXo-d8IUQkASvt6GY_44YXdKW5-l5-qoVSuTf--HH2MX9s0nrYxH29tj8eKDpabXcDTvCU1PorzJugGvQxccuKuTY656C_HzuCh6rUIoWlFe3hoeUDqsPWKRWhDbt3tQlFLmsAt-4rsF0p3Iw_kDbAp4UJVDqh3UCYMyDyun1MO8OYm-AEUdzYu_Ekjz042w0b8w0ceoxIx5Is8rIHMFcyOJr_Mho8sFBlIQ8JBnBccfYYUd7q4LloJS1us07MNzrOGgFossFFekhqzNDdjoKmIMrNOEd7SyhlPI9_v7V01QiA3AoX-hCrMWm7S50piavO4WF0ib8pFFNo4sNIol8oIMDLd4SwTvQF2qI5yyL6KsbOGxR0-jtCZ0RLPmr6JvTJbiUGEz2BZta3wM-PXf5t5h7rqwzvgA8Ug0N_AWK-pHZEnWW83PSkttD0GRHN7jJU0p5s_4Nm63Vuk4VGo3JHBXpfuDJfNCyQTEQNrtbkRGnwLZmZs8c76wWvFP24nAWJ54oFxeQz7Kq8LgLkGT1y8jE95PCWDSq1cKVR05zHKh65jOVTnrAyoaJSkZb3RfkeEr4XZ-mHcjztH_VnEHPkxe3ywEnyMy3oSA8TKFoPsEqX5ijyTwzzblDsHG5N1SEOsfIpYRrkJ1dqQEO6_jLlkDJdeUot78dbpPl6l-Y4d0l2sD-TGF1XGqa1FVh3_4F_3QDWMPA6Fk7WZ1x8naw9EfZfkiriu60DDozRGP9uOXgUu_FhbiwDmlEycHYb7__Y-0DrwP9t_wCxRCjuORksHxWjM_T2YXsZt3A8q3uSOK8alLEUp4bCB2p_mFe3bu0Uky11lHI6rqg5m7j-g-LCFEovRVFWaf0mkqhiqpIEsjzIXyjx0T10vPAGfAofAXuykcvlKdkmP2ZyPHU5R3-FeFpcs-EKZlTkbSFRWSGghK4VYZsxIT2LFpUJ3os6e4qyt14HWnQqTYM6nl_EA-EJWHIJ6rJkGU-hF9Vze_XDeRmIX2cVMIUO0KbIOeI2k0V-kF1weUKNKHLfAWk2qgO3oC2tWMjqPCxLyWrmfckTbdi_xa8rkQ7aP3RIE6PeTTwFkuQzf9xJ-dwUZAyDDBge_1b_QMXK-zNM3qy0D5JxxecpLMKYzoUQ58PMljDGcnj38p6HMxBFV_IaJRpRiHIUt5i7cCRxO5FKZan6R9i4uWGSRdvKhWnlyXHGA86QcjxR_j4jMrxywwbDNvCZ2_aY3fyi2_D2uFBAkTeln-M5mZOGDJR7aZIiT3Xw6m7NDOB_asZd9xvcjGjPxVNDeGJ6pA9HM1Z6ZRPHwSOsqaY4AN5yqz74g7j4c-yFrF0MJCkZy9DkfruNMyGBB5HzS7Tbv4vydg_xoWBlRtPJDQcoHlhuF2NPahl9T37L9wJavaGMemjRRgm1_VjBom62iNhspll2qvx3gi5zO0B0Fm1r4TEcE--6WaObxoahwl677fcp9HndU0AdQRVbJgPq1UljAYa91DRVZXD8myDgMFqJPhkDs5g-K3Ktd_-OXKt-JN2ar_9aNhaS4iTI8J6pgzJVuP9DfToJfP8XqvWPIlFmiJ2lXBCbTKA3_EfT8QAmNYriA4XHjA32rZTQ2kWzC-nfZU_AciaX2BfTeKN8FeeA--nGsVt4H9jiTWVGvxV6Yew_okrN_4tacAkaqpAI5I5O04wh0xFnGcimiY2WO1WlAeFsya0kFqM2nvSv9EkaUcLK7aMTuQVXm_AG3UkOctUzE3Dolhy1f5Ff-Vm5Pl5j0hKb29u8TQrbmLobai9DjdqOhPWSaTb9k-n6_1Y-XQ5qlTVXEEhQDhIIP12vcksWxmZUO13N-Qr8K3fjiqLF5ALknRkJESmEluRE2axbaC5tvu9GrBf6fRUyFEyRsQKpES91JqexPzDDajvL9Oa9BhcjQz8HIK1a4CtjwZkBeFUv0PgYBxqA2r1-2wu275kSzq7Ba8Ed6jFQWz-8xJ9wEwb9uzs6S_Vq_qJFXJuAXZLub5m7h2kfbBTp_3SdFZccGsxugFZKTjLnv8vEvzn6SNpg6Pu1LCBsd8NSxWvMPIgZE8gMIT8fa5fRlkzmYKBYBzfqWXnnZGM0F6XveUtss5D6VWZJGbyEtUrEwEoB43I0kO-gz7rDAgRXbMXA_3TmWdxnDKW6sr2zS0fURr3XBTZ_KzCncpG-hBp4lhZw-amHCS6JnhpQOR4VDUEWnWj2MxFzo9B34YG3jH72Zy2GNvCoKS6F_16v-kH4G-ps3iAhHBfmHobflOTCXusto4ufBEdifWnG8-_GzYJxYhIJKqkGAinwcvh-3aNTE0bSaHMQwealAyOiMoSrsH52OcSA0YQlYj9ueLCjnGxo3ViiVM7CvM2yygKaUbW-e0wtNejVmkM7rprtwjTjnNV4yCz1cuoTy6ZGU0uRgXJIOunNxBDJeaDR-Y_3_hSSM7WxFOm3mNT9o1dnCto5O5Kv50YkiI1XcIfBo5tZ5dH0t3gO1zHzm58PE0qWQ_n48B7sLecV5m5DBrOKMJr0Bc6RPBt5QKdVAgsoPtMuKzI7ZsZGc4ajN6agJQwm-qyGown2N6BRFxS_yWLhXYj9GWYTwA4JaK7og7IVo5GJYFP5DxVksCwK2JehzfXfLrCL_FUW5I4RrJCDRD9Qk-mmWw0R4J1nfT7xd2NpUFz3dJmbTj2CJygg1hBgKBR92PycED_rRegAZScbWIyJ2avvX3Ea772EoC7nzo7yKocTauLtMi4UVY85-PXo_dXGLiXl2SiG972Qc588yQwbf4Fw6oYNVPTN0fTBjHHAg03mxaViJKsva0RiySQoeQOg5x1wljlxpknAyos96QtOvB2IA-QlfxxT1I4TlyBLVhR7flGJcDtV-ceICE2V3Xozn7O-nUroaHxt_gpYEZ-P5ArpE0_HtuSa5LQCSJdWrXg9JPYz&cid=CAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpt.friendsforever.world%2F&ds=l&xdt=1&iif=1&cor=2030330457760623400&adk=1964084971&idt=171&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25edc370ea51183b1b38e093b6a472ca5eb47c7ffdc3822b3bb933f155fb7efa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13760
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5DC9 143 B
166 B 7ms
7ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2645
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 22:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 35AA 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ea53832a4a6789130ba0aafb9d6de4edb297281ccd3cc080ea5c5c96a53240d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DAF0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

16ms
16ms

Document
text/html

2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:32 GMT
expires: Tue, 05 Dec 2023 23:22:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:32 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5DC9
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

21ms
21ms

Document
text/html

2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:32 GMT
expires: Tue, 05 Dec 2023 23:22:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:32 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1627455/73523880/ Frame D094 255 KB
77 KB 105ms
32ms Script
application/javascript 52.210.167.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1627455/73523880/skeleton.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-7520027584027322&ias_chanId=1&ias_placementId=20492285957&bidurl=https://pt.friendsforever.world/&ias_dealId=&xsId=ABAjH0gCNXqjv-659CPAE7UACAFU&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gCNXqjv-659CPAE7UACAFU
Requested by: Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.167.100 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-167-100.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: d6ebacb17c208049a31935d995089b2a8e9c8a7c92a7a8bdd5a45db645167c69

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D094 111 KB
39 KB 58ms
6ms Script
text/javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Origin: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 19:51:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12666
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 06 Dec 2023 19:51:26 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/ Frame D094 11 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DsK-PzmVUMs_qA4y6wL68np0Zjk06kQTIykYPw-kjTaL8nhTSiq9WKc0HgpsrMMhoqkQ3ETX1NxHRwFaU05ehcBpL0hbXtfB55bJxhPk1vMZ1P2xJBPnzYXMdBcYnvJPrmxJ4KXoCRuLBzs6-W6b1y7fPjU3TqaQV1z9LaQU0ZUlQL7WE&dbm_d=AKAmf-DeZNFH2SxhLsjhBxDgMvNWswNpO_FcJu0DAAy8wKPeurs4miITmvEQK8ANWTW8InVm8y8aZZjhU-jsEyjBjvpn-FYFIghwILd5Wd9Po_W3uEYIYp-leMdanp71zrD96B7J3WuPqJJJ5uzPdkPABk0YM_JkEMyPM8hDm7b0xQW9WgvpcQ_uy4td8Nnn6eoFULdSb5FJFUUzaifKPmHd0Hhna3FP7JsIWTKj7NOakZyVNWSRLUhbM_zAYIUJs9jubDOOozNA4JnxNkf1Jlxf_yD8RtGcyxcquD7HiDJmwIA4SQGrrkJc_PnGvH1IivNpfL_yXo705jp_dIHorcIQjsrLN9JOXo0FmIUD3Vz9VuGtWIMNM-t9TT_1E9Ui_zaWcbMeHQTzV8yMqW4u_9_9iDFzQtcdmLJ-fPXqAa5t2PyEEPQ8N61OSI34eU5MgyQfnzE2dxMex8wvuoUp4-Lz7OpZJ6ClvQoydQmAEVITPzySbrm2apGm2PCuuksHsmh8pXk01peoXg6X1vVcAp4Yzlabmqh6689uDGFbZUF9xcMn_Vi_WMscwXCwcI-VyK433JZoERUQe-EzyaGe7Ii3k_6cd_WyUa9XMehkUJXAByYAEQsV04TVFOxIKdNsUIZ4L9hTHsjw9_UUIjs1oPez8ZP52Mz_w1RPeBQlylTyseGlzbpHcdzS68My2ptMRMNgZa6phSSQqH5wAbol0au4173fCMzOTF50OlCiVeO7yraQj6zK4x-3I2A1p7HAeKLuqXCMCMkdk-EEiBFUihvyye0p_gh_1rOB3IPB-zoEgsVndj69aFLb7vSyhCxmpu7QlTtW5nwjlfw5lh0kH4bdODdbd7BHubjfCum2YjJBjp3tYRyZ5T1IXEF1H4H1G1XKy9jq8pml8tkMOsmov0f-Um83q8hRpZUCqSSW1jP96pkCMuuU1WlaBw0W7R1Fg6bV0r2-skjKA9HYmASKX5FkYG3MvTJ97JyYNw9WDHlQ1ghdX30rXEi3djVza_nCWlIZShioZBa-p15DUHdsauaqJOK55W1xQ7losggRR-YMxf6xZpFFlpzXKRNkHEBU--x-_eaH7peev_6udUI1ejqPxSHaXGzgvA2G465CbCiO_E-YQdCwz88NPzmfMn1vdbCQ0KebbKLz4Z-TJTwVodPOANopvEemQmCGkCBlr8zwrCoihxvQfR59FOD3EttV1HDdS406knW3hPEIyE5U4KX_sEXgAKEUc-cqS_m6anHbngw48TBr0J5nMPdZKzvl0waj7AS2q2KD4NduP9EsU2t2-WVPKODMviL2zLe27xR3qgiYFpiyuWxLvnEGgvgD2nKDW9eolkp9h0qM7AR2pYp-bB0gq-5l2yQMxXWN8ftCyPiaj9ESGfvo1SY1thPGLg8rMs5lRDO3ZAdKX6B8lY4vTKt6HGAa82KPuC3jmL421euMg5ljWKeUECaLteRlg0HyV9Kb7aC1TQhbyd9RS5rDh9D0wPUlXmO6NzqAnkBUbv1pzf8HpnS9S6LEvfte-yJpI3rsHz7Jk7SOnE1leaMvwvJS83b_ThfDDup2YqYH61Atz7Rci2PSfDFvr3KPzRUPQ_tjqtC204zrg0c9V4yWZjAruV7PAg1jf0CZ3Uxqg95cYRDU7OL_o3b3A_oRu4_Spf9y60phAQTcbb-lbagqwqtbtr2duXj0S-Jt3IcR9cw0md59t2IefSWN43kb6S5y_c4QCofrNQwh3LqUrC-XH7XDy27Dg-kqjlfwJQsWIrFi4j5-KtBax5aDB7jXyAFeOJRCHFU5hBeZrDFYf7AAP-B5se_bYIEVUnON3fDDQ_6u49nTWUmB91F7WJM7E10l47ixv5dkfxUKwRWtoXXGMaBVml-AGp7A1Ex2nSutcip-hkoy9ZCWtiVeeDHdxoSotXi4_FdvzIev9yLXIeRIqzp2Rvpt7o-A3h7MinhL-Q15KRL6VYzZdomQi73istCsS3guXy2IVgWu3Kl8pnffcXEvFk1fFLoI3to6MAB1vQNu3TGoF2otg1ESFsAjvFW31wP4n58o6pMxEW1fJkccgYZ_JogXOFsQtfLJeJtWtWCv05z0zTRrd0Rj2eI0-s3PZZDcaHYKQcYUzOKKF0v0DGR-GykHNcC-7ZB4Fvx1lDBr0047bJHtVAj5pCJ-V-MwmhQgqbMjWEhAcQ_-fBRr6UTTpfelQ6PgGz_ZTYsDmvXyvMcE71e0s6ELMsJkDxOcKT4as_mRfRa5zbpjks6TvwrCy7X4OmqV_JMXsWEM1Ob7XB01c5ay-krL5YhyAhBRgb-Ah731_DpEoCGuw2iJ3kIjq13Xmp1WjsOV-NssKxQJzMQZohfDTKssUIyVr0BHFiduVcghH8OMk47_LNgEk8oqo75gUfOz0gylxpi1Ckmdc25pg46ZcnqVtYyr0-rkAjLfDEq7PCjgJZorJcK6qOVOnQqWbcHqJeypEaqGO2gbMH6PPdkQw5o4_zbneu5DM5w9t4vneLz--ZBM7HcbTxa9qlWL44fyejzRX-Z3exIvzjbe6feKrdjhOnFSBrCI0nb1ZaNnI4_OBOSfyAkRKZNof3z-16qNHCidUrgrrHsReyGsAhEWLLGLBLsRlCT_p-2K_ohg-pzRTOLBQ8cLm-QVUi39Zp7bCiKpF6S9Gx_tZxkgrru4jx0X60ii5MrRC9iKKhppZyPX-atiUOvNEoqtBQWuppDjpxmK5RaGeTCUbSuj31feuJnL1LSEJdMHjk9HI9dPi0fwl3l35L7g6Q3MV_LN7U3Uk-YHsAfLvMkm2nq3lw3j3prpIZEcwlucwu5Yy147XMaL_iQbgy6-UuTWh70v-tGFAYUkZ5hoRyK5rRr4I9zI6v5zSNMre0g6iHywuKATOcSB54pF5N0XneKVR-BhHbeck6YF6tnV_Yj4l9D741kc2eOzJeQo2eDNsNW2emv4Rs8ppUWOR8B8-0iSZbtq8UY1ynek-X0zZjyw9Rqmpuf4u28a0bBrBdQWFfW9xBgdICUVHifdCywr0k6ay2uWZOvX_jD_Arv7YM3Emw988wH4HVed18oNWHOCw5Ms_iKjLP03ROq0IYvm75NFXObu9leqXVDAFUvKIMG_ZBzCGRAEepvn0cxxzTO5IKBNyiDLpbmn5Fjcqp-Oho7WYnfCIRPRbYv4qPbY1Pl9n_i7xhJY97cQjWG-0o629NXmULV3RxBEnxe9nItDMtBaf5nLyc54Ir0WFhC2BsFAY3KaVsSBbIQlHm8jrnAczFSEtfcbWB7B3zQjnKQNdRj1LXYQb8XNG6At37Bo2mWHEsxjxy3JH5YhWl22EnvNc1KzVrhXgo2ff07N4vfSF8hJyvI7p619Ryf8UtCHyTg07424shF7KXBaLp7kLjqRkgBZQhh9IpEqrUdOAxB9gJs65nmh_qpODiHkVvbOnzf8L6CSMgmqQJWCPismt2clW-u-V-65SwHIva2oEbaRgb5jRzEY0YPg7ug46OTvXnRD_xqrv9UoiHbuQIDNeOyujTPn6FtnYgcQpzhe4H2amx5ZMQnxom8jIqDLL0zv7fySxm8WTXUdlutbn0cAqC7qA9n0PPtm7V5KY2MTzm2rakHDf9aULXRHFeT2fDZypWYHHMUBwy4tdE4Jr9Elm6bTOowtx9vlfxBlBTxV3Og_0O6GgdkqG5rpH2viwhqikvzywfDLPqZuYNMp0ZA8BpeC1-q7s55prNWnSTDGNqh6a4WFklLyPM0G7L-BZ1_3ABFL-T4fbfyqcLZVX4xfkq8mEIa09YsduWazJzYbZ4-8I0EtpcBWbhbGYbGFa70J_ubL2i4jDzc&cid=CAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpt.friendsforever.world%2F&ds=l&xdt=1&iif=1&cor=2605904013992248000&adk=250412561&idt=155&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 07:34:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56863
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 07:34:49 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame D094 31 KB
12 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:35:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28010
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11943
x-xss-protection: 0
server: cafe
etag: 4141415479739543000
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:35:42 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame D094 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 364644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
DATA 200
OK truncated
/ Frame D094 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 257d192144ca4f619dcf808c11885528cbfeb8ddcfd0d78ddbba01bafe53dbbb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9D5A 41 KB
14 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CvRrcOzqRSzFDXUA6-Y0fC6eXLOCG7j47JYupgwGllU9_EuRdp52_Rhx3Q2PfsChzbirot22WIvHJC6mHhU2MZSyyzurU0X7DdqmKdYmd-kTA87G16i4xjmnnA7yJui9gw2KYjtNyHdz1vcF60Q-NwQX3pl_CdnFUJ4-yjiVsBzAcgaYA&cry=1&dbm_d=AKAmf-DsSqhyFnucCthU_uCi7rG-BHWPY2vWT31bn4SrQfkekgQu7XriSvZtEQBPlDVNWgohZffYLAfpBltsMr7RLlE4CkwY7KcirBWvELFdJuF7OOOZMTxc6_d2KGylbGc4OND9NPP2jVnUJKOBFZjLnt4-ILjPkZEfhOG9sCmDw48rt_W8O2q1nEyqS4pjKQzIswNoxPdBHTZZZAmGhDUaMMW_BSHeWgodqqPsToAqGznClXt5bD0JhL0uKtIC2NqcGDf0OqZAtTHv2SEBFAEeSTj4G81csF2gi2SLqmM1E6xm8hM_B5I4-6Cep-2E-bt-zefIb3eVTiNT-FF_ljE0Q50Cp5NzTKVadsb8zYFJP6khlb2wr4xjE-_Cllcno8chA6kHly0R1PaSzVJP-C0G1PrhPs9TBD7clpc5ueBgNxeOnIzxya-9FxYQBlJzSeKHn56R-JzsMaLz-a7-xx1Hoiu0KZhJgEBSe058fArm8-4Kc0NUEPiQ2ibRnciOFmiBTWUmsAMhJvs1Lwg4sORGxc33BNy4ov2qkYEWkqOM0Uq3OVEY8-q4ZOVtii8IuB3OhbxVZWOPWBto1a82HqrIm9NPZn72qFrYkj8ToYb3t-DrG8dsSa-GOLZvNlJQoAxccLLSOSsnENptQmXZVGMHzMjFctPJp4RkH1rkhZFeB88vZ8FP_n_Gu3-XArXi36J1w1tJSweucnFEOnXVan7YfCXO3D2yVT3kuW3ZhhizvJagNGONGwAjNlR-8QCfHsepHnspfisU9P5zFP73Wt_Pt-VXbAWF7PwvLtyKzLglO881q941B0scSSJ3xODskOiJfcjS_E-b7j4eu2RNKoPgrFHXtGk0p9PlcP3Kv0Co2y0GJqR4pHmzE0KVYi8ym4AnqTAs8ElpB2YGWvdVdZf2oGnQVG1FiUvi3HjrTVAV7QFWjch-iR_VRogM2shNpv8y8NnrrLEW3nPOTrwJGs5I0JPl8umjeN0gv2s0pThnBYI2pIxh23703e1ZNu_-HkWtN6Eqp0Fd9PkkXTYKv68ZCTmvo0bfrfr_r2nb_bAm8g4B030wF1Bk3-TDlZq1L0p5PCDKiJznIi6Qt5PXo-d8IUQkASvt6GY_44YXdKW5-l5-qoVSuTf--HH2MX9s0nrYxH29tj8eKDpabXcDTvCU1PorzJugGvQxccuKuTY656C_HzuCh6rUIoWlFe3hoeUDqsPWKRWhDbt3tQlFLmsAt-4rsF0p3Iw_kDbAp4UJVDqh3UCYMyDyun1MO8OYm-AEUdzYu_Ekjz042w0b8w0ceoxIx5Is8rIHMFcyOJr_Mho8sFBlIQ8JBnBccfYYUd7q4LloJS1us07MNzrOGgFossFFekhqzNDdjoKmIMrNOEd7SyhlPI9_v7V01QiA3AoX-hCrMWm7S50piavO4WF0ib8pFFNo4sNIol8oIMDLd4SwTvQF2qI5yyL6KsbOGxR0-jtCZ0RLPmr6JvTJbiUGEz2BZta3wM-PXf5t5h7rqwzvgA8Ug0N_AWK-pHZEnWW83PSkttD0GRHN7jJU0p5s_4Nm63Vuk4VGo3JHBXpfuDJfNCyQTEQNrtbkRGnwLZmZs8c76wWvFP24nAWJ54oFxeQz7Kq8LgLkGT1y8jE95PCWDSq1cKVR05zHKh65jOVTnrAyoaJSkZb3RfkeEr4XZ-mHcjztH_VnEHPkxe3ywEnyMy3oSA8TKFoPsEqX5ijyTwzzblDsHG5N1SEOsfIpYRrkJ1dqQEO6_jLlkDJdeUot78dbpPl6l-Y4d0l2sD-TGF1XGqa1FVh3_4F_3QDWMPA6Fk7WZ1x8naw9EfZfkiriu60DDozRGP9uOXgUu_FhbiwDmlEycHYb7__Y-0DrwP9t_wCxRCjuORksHxWjM_T2YXsZt3A8q3uSOK8alLEUp4bCB2p_mFe3bu0Uky11lHI6rqg5m7j-g-LCFEovRVFWaf0mkqhiqpIEsjzIXyjx0T10vPAGfAofAXuykcvlKdkmP2ZyPHU5R3-FeFpcs-EKZlTkbSFRWSGghK4VYZsxIT2LFpUJ3os6e4qyt14HWnQqTYM6nl_EA-EJWHIJ6rJkGU-hF9Vze_XDeRmIX2cVMIUO0KbIOeI2k0V-kF1weUKNKHLfAWk2qgO3oC2tWMjqPCxLyWrmfckTbdi_xa8rkQ7aP3RIE6PeTTwFkuQzf9xJ-dwUZAyDDBge_1b_QMXK-zNM3qy0D5JxxecpLMKYzoUQ58PMljDGcnj38p6HMxBFV_IaJRpRiHIUt5i7cCRxO5FKZan6R9i4uWGSRdvKhWnlyXHGA86QcjxR_j4jMrxywwbDNvCZ2_aY3fyi2_D2uFBAkTeln-M5mZOGDJR7aZIiT3Xw6m7NDOB_asZd9xvcjGjPxVNDeGJ6pA9HM1Z6ZRPHwSOsqaY4AN5yqz74g7j4c-yFrF0MJCkZy9DkfruNMyGBB5HzS7Tbv4vydg_xoWBlRtPJDQcoHlhuF2NPahl9T37L9wJavaGMemjRRgm1_VjBom62iNhspll2qvx3gi5zO0B0Fm1r4TEcE--6WaObxoahwl677fcp9HndU0AdQRVbJgPq1UljAYa91DRVZXD8myDgMFqJPhkDs5g-K3Ktd_-OXKt-JN2ar_9aNhaS4iTI8J6pgzJVuP9DfToJfP8XqvWPIlFmiJ2lXBCbTKA3_EfT8QAmNYriA4XHjA32rZTQ2kWzC-nfZU_AciaX2BfTeKN8FeeA--nGsVt4H9jiTWVGvxV6Yew_okrN_4tacAkaqpAI5I5O04wh0xFnGcimiY2WO1WlAeFsya0kFqM2nvSv9EkaUcLK7aMTuQVXm_AG3UkOctUzE3Dolhy1f5Ff-Vm5Pl5j0hKb29u8TQrbmLobai9DjdqOhPWSaTb9k-n6_1Y-XQ5qlTVXEEhQDhIIP12vcksWxmZUO13N-Qr8K3fjiqLF5ALknRkJESmEluRE2axbaC5tvu9GrBf6fRUyFEyRsQKpES91JqexPzDDajvL9Oa9BhcjQz8HIK1a4CtjwZkBeFUv0PgYBxqA2r1-2wu275kSzq7Ba8Ed6jFQWz-8xJ9wEwb9uzs6S_Vq_qJFXJuAXZLub5m7h2kfbBTp_3SdFZccGsxugFZKTjLnv8vEvzn6SNpg6Pu1LCBsd8NSxWvMPIgZE8gMIT8fa5fRlkzmYKBYBzfqWXnnZGM0F6XveUtss5D6VWZJGbyEtUrEwEoB43I0kO-gz7rDAgRXbMXA_3TmWdxnDKW6sr2zS0fURr3XBTZ_KzCncpG-hBp4lhZw-amHCS6JnhpQOR4VDUEWnWj2MxFzo9B34YG3jH72Zy2GNvCoKS6F_16v-kH4G-ps3iAhHBfmHobflOTCXusto4ufBEdifWnG8-_GzYJxYhIJKqkGAinwcvh-3aNTE0bSaHMQwealAyOiMoSrsH52OcSA0YQlYj9ueLCjnGxo3ViiVM7CvM2yygKaUbW-e0wtNejVmkM7rprtwjTjnNV4yCz1cuoTy6ZGU0uRgXJIOunNxBDJeaDR-Y_3_hSSM7WxFOm3mNT9o1dnCto5O5Kv50YkiI1XcIfBo5tZ5dH0t3gO1zHzm58PE0qWQ_n48B7sLecV5m5DBrOKMJr0Bc6RPBt5QKdVAgsoPtMuKzI7ZsZGc4ajN6agJQwm-qyGown2N6BRFxS_yWLhXYj9GWYTwA4JaK7og7IVo5GJYFP5DxVksCwK2JehzfXfLrCL_FUW5I4RrJCDRD9Qk-mmWw0R4J1nfT7xd2NpUFz3dJmbTj2CJygg1hBgKBR92PycED_rRegAZScbWIyJ2avvX3Ea772EoC7nzo7yKocTauLtMi4UVY85-PXo_dXGLiXl2SiG972Qc588yQwbf4Fw6oYNVPTN0fTBjHHAg03mxaViJKsva0RiySQoeQOg5x1wljlxpknAyos96QtOvB2IA-QlfxxT1I4TlyBLVhR7flGJcDtV-ceICE2V3Xozn7O-nUroaHxt_gpYEZ-P5ArpE0_HtuSa5LQCSJdWrXg9JPYz&cid=CAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fpt.friendsforever.world%2F&ds=l&xdt=1&iif=1&cor=2030330457760623400&adk=1964084971&idt=171&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 364644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTgxODU1MjIxNDgxNQogIHNlcnZlcl9pcDogMTc1NjA3NTY3CiAgcHJvY2Vzc19pZDogNTcxMjU4NTkzCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame 9D5A 0
867 B 72ms
45ms Image
image/png 172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTgxODU1MjIxNDgxNQogIHNlcnZlcl9pcDogMTc1NjA3NTY3CiAgcHJvY2Vzc19pZDogNTcxMjU4NTkzCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDEzNzQyNDA4MTIwNzI1OTU4MzY4CmRlYnVnX2tleTogMTQwMjA2MjE1MjI2OTIwOTU4MTAKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTEyLTA1IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIxNzQ4NDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwODYzOAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f198.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x67c171d8ba4de45f0000000000000000","13":"0xb668e6866b4772090000000000000000","14":"0xd33526cf05b9123c0000000000000000","15":"0x3c1bbafff230512e0000000000000000"},"debug_key":"14020621522692095810","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"13742408120725958368"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame 9D5A 12 KB
4 KB 516ms
12ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1701818551692356&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 7092f15e79b47ada2e956d92b902c3b3d028423f9fdf05a460df32f77aa4458b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:32 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4239
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame AFC0 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 51067
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 09:11:25 GMT
expires: Wed, 04 Dec 2024 09:11:25 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js Show response
pagead2.googlesyndication.com/bg/ Frame F2D2 50 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f4d9c7c420e58b6a1d8013b9512aef088d5e019824b98db55e90fa74480346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:56:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80743
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19632
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:56:49 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 35AA 33 KB
33 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:45:01 GMT
x-content-type-options: nosniff
age: 88651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 22:45:01 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3962 38 KB
13 KB 7ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 51067
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 09:11:25 GMT
expires: Wed, 04 Dec 2024 09:11:25 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1064608057035189096/ Frame 5248 6 KB
2 KB 21ms
7ms Document
text/html 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3477a72ef1db732762ffb13ba55d7df867b64c2abf5f88a1fdff29e6dbe374d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 88647
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1879
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Dec 2023 22:45:05 GMT
expires: Tue, 03 Dec 2024 22:45:05 GMT
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D094 0
0 535ms
56ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssSbpgBFwACAz1u9v6cAO4a8fVQ1q3S8l5Z2tRXV0oDNNJoV80E59UkpnPaeBgWXtujsNGMR2OA1y6xeTPPAK4Yj8j2UhwOPJKY5b6uqtdZpl5Eauxq8F0017sKG6N2v0IoAMFT2Nqydo6p3jofkQ5XL6-QgWYb56aLqbhITBBJFbA7lMWzdpGPYd3bCjoUhQBe6LbgI10PqqXVn5qxnLXkkwCfjsnbFk1wxDauyRRMfDIq4SMRSSEIEspNFUYktdeVZr2U3vmVnrxIx5pd1hza4aKrleNVJjM4njHX3fdvULAPzEER5wuG51zXrESTtE7DL60w9jPAMFC0LqWNH3o7QvBxeYuRYbtqiR8MxDpKrlBaRI-Pn_VjraMiVrifhUJZFopA39R7VwWMaHUd2s1Lv6qfB0NegQjQMhSBGg0ujq_LdroTZhtPWi891PNptB0iVlaxbz5FOhkh7DmQ8F0shqkofBybP85BmW6eco47saVnS5_SdQ_8zttOe0DcajrizrlLOSK7l2CcjXlCuVC53uLQiA9HlPcPmahL2pf64NckCHnnCM02ALSALXjnl937Okyt-HBzRtckeB9gYbKWi77r_L5m02UABCwCO4TGwGQOBi60oB83Hjgg4Gkdx3NwGbMFVeQkGlD8U_Y0PqOuVt5lmktVwaofZPiqMf_dIo6-8e0TguAQmDVxDU3ZTRR4C8_TWtJhR6YtaB8HGeRJDdW8Xw1HITCY0HtVDYbC97ikMlQANUqkPS4DOxwRHD1Y3zZivx5bfHYFdQpdOw2yvNKUCQiotBnVDtXrE0Ky0Oc65lLXzaImc0iYhPLAvhYu7QWI8BLCxEr9pJQpf9voKOyUy9EZb0Ya1-R7jeiMMBzznnDXnYI7dqBGMu_7GneIcicrmvsJhgLDK6TZQQvUypBU669t_dCxI1QW5m31uFNlILFbNxtP5Po4uNo3xdzvtPs0XlwDJnW1_cUljfi26oumEdypNlvS-GjdUUaU8LaSktxT_hpk4FqbZdW6QaSaWESFDd5g2t8tfO89kRHBMGgdnW7U9T2p2RK5PCT4I5O9RyK5Yl2bH27zZ4mbFVxxe0A6cH1-M8i4L3fj2XqrJKCCcmbntHlRXI204xvsC5GH17Ey5DOtnzM9rRtPkLjEfbh0kuR3YQl0FFurJAa7jnq-tyt-W7wtq7cIoaMInusBj3xXI8G16zs0xV2B9NHP7x6YZCY8FQ-K7y-4kbU59tjnYPfgUW2aPhWj_-yJobubTA-Drzo4zlD7NrzPHeyS2lLqTQdvn5Otd2sr0MOnJjHWBlOGZ-k-WJWtvE_AgJcYb61KIrDlr7L_2t4cu_lijdFltOLdXOf8lZ8EObuHozFWoR3d-U2S2TFlxXcZ9_ar56FkMWLVwZs&sai=AMfl-YQkZI0O1HZ_GwiFF2713vaUVpp9gbVkRNwVP5cJaVw88S8_ICjqJ-nX57b6n8YGLZy7MrRdpYdh4WsAPDh1CmPjwIgxKWsJp7PY4mg0Ietbih6ye2ukVTqQrJuVSRT4WVqtqS0YJVgBe3TR4mKrbRvMypq6YWqi62zPxWnXH4zE_qLsHRBdxb_wslvbui9c-ck_K3duC1xk03JUMbtQrnadFendHRAYFV7JmY9s3PFcqSLP2GQw5hg5BnMStZd-REDiz-unP8QGtmVS_SjZPz79uTNMbe-eRy5QYfFPbw&sig=Cg0ArKJSzENuuYvR6pc4EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=94&cbvp=1&cstd=93&cisv=r20231204.07627&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 35AA
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CeM3mt7BvZfDaHc-_vcAP7v6OqA73mOKwdOjQ8o3fEbmb34aHKhABIPWblCpgleKQgqAHoAGEjJm8AsgBAagDAcgDywSqBNkBT9A2ryHCIXrYigHXW0kmuEGwO5UB5q8bZi110xTztLtTt5V...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212578264644738560297%22,%22debug_reporting%22:true,%22destination%22:%22https://tiktok.com%22,%22event_report_window%22:%2...

0
0

59ms
43ms

Fetch
text/css

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212578264644738560297%22,%22debug_reporting%22:true,%22destination%22:%22https://tiktok.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22663111172%22],%224%22:[%2212-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224683544545019730833%22}&andc=true

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"12578264644738560297","debug_reporting":true,"destination":"https://tiktok.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["663111172"],"4":["12-05"],"6":["true"]},"priority":"500","source_event_id":"4683544545019730833"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 05 Dec 2023 23:22:32 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"12578264644738560297","debug_reporting":true,"destination":"https://tiktok.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["663111172"],"4":["12-05"],"6":["true"]},"priority":"500","source_event_id":"4683544545019730833"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame AFC0 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 20:14:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11284
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 20:14:28 GMT

GET
H3 200 gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 9899 50 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f4d9c7c420e58b6a1d8013b9512aef088d5e019824b98db55e90fa74480346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 00:56:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80743
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19632
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 00:56:49 GMT

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame D094
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1627455/73523880/4.js?ias_dspID=3&ias_campId=1013910218&ias_pubId=pub-7520027584027322&ias_chanId=1&ias_placementId=20492285957&bidurl=https://pt.friendsforeve...
https://static.adsafeprotected.com/4.js?xsId=ABAjH0gCNXqjv-659CPAE7UACAFU&ias_xappb=&adContainerId=brand_safety_uLBvZdmHC6e69u8Py72I2Ac&cbFunctionName=goog_wrapCb_uLBvZdmHC6e69u8Py72I2Ac&true_pb=

1 KB
1 KB

22ms
22ms

Script
application/javascript

2600:9000:2046:5800:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js?xsId=ABAjH0gCNXqjv-659CPAE7UACAFU&ias_xappb=&adContainerId=brand_safety_uLBvZdmHC6e69u8Py72I2Ac&cbFunctionName=goog_wrapCb_uLBvZdmHC6e69u8Py72I2Ac&true_pb=
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:2046:5800:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 19:54:05 GMT
x-amz-version-id: 4Cmv1jyFRAmZ7XChlLsmb9GJS5ztjryA
content-encoding: gzip
via: 1.1 feff0449a1f635967cefa9b64c140c9a.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C4
age: 98908
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 04 Dec 2023 19:54:03 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: v--uipNbP8t6UwcjgoaZsp6kKC7xyo3qCLcutDYbW3ZBUKHz67AFzQ==

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: nginx
x-server-name: app01.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js?xsId=ABAjH0gCNXqjv-659CPAE7UACAFU&ias_xappb=&adContainerId=brand_safety_uLBvZdmHC6e69u8Py72I2Ac&cbFunctionName=goog_wrapCb_uLBvZdmHC6e69u8Py72I2Ac&true_pb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame F5D9 91 KB
23 KB 400ms
24ms Script
application/javascript 2600:9000:2046:5800:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2046:5800:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 27 May 2023 03:39:49 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 feff0449a1f635967cefa9b64c140c9a.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR62-C4
age: 16659764
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 5NIm9LihA233Ly4HcSG84gw1UTC55siaIwOdIaPgJaGpP-fo5yEfnw==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
215 B 492ms
119ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhQMH,pingTime:-3,time:33,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:18%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:33,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B28~0%5D,as:%5B28~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,rmeas:1,rend:0,renddet:DIV,siq:18%7D&br=c
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: nginx
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
215 B 492ms
120ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhQMI,pingTime:-6,time:34,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:34,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B29~0%5D,as:%5B29~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,rmeas:1,rend:0,renddet:DIV,siq:18%7D&tpiLookup=ao:pt.friendsforever.world*&br=c
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: nginx
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
216 B 489ms
117ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhQMK,pingTime:-2,time:36,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:429,beZ:430,mfA:432,cmA:433,inA:433,inZ:435,prA:435,prZ:444,si:447,poA:448,poZ:460,cmZ:460,mfZ:460,loA:463,loZ:464,ltA:465,ltZ:465%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:18%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:36,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B31~0%5D,as:%5B31~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:DIV,siq:18,sinceFw:17,readyFired:true%7D&br=c
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
server: nginx
x-server-name: dt24.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 457ms
41ms Preflight
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 05 Dec 2023 23:22:32 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 3962 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 20:14:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11284
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 20:14:28 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/1064608057035189096/css/ Frame 5248 6 KB
2 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce2b61e64a17f1488f20bafee5aa20a8d8ec897b990f709634f5bd1cc620e6b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210432
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2000
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:20 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 5248 70 KB
25 KB 17ms
16ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2317282
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 25267
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-62b3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z3GUE49fHXlR8ow3M%2BEVe39ZsA6hd3vwoBOZj3Saf6gN4aDm%2BqGWgqCMD9DeoR7n0zmmADp%2FoO6gF1JYXiJ%2FqAJY4r1BMqt2mDAMaYgm07lSIr7u3fAPgmCY05ZxdrSJ6O2cdiz82lb6Nkc52Qrm0LNZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 831008236e1fbb79-FRA
expires: Sun, 24 Nov 2024 23:22:32 GMT

GET
H2 200 CustomEase.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/ Frame 5248 7 KB
4 KB 15ms
14ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.0/CustomEase.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2286501
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 3299
last-modified: Tue, 01 Aug 2023 16:38:45 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "64c93515-ce3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6kY2lyh0u4bKD7HRYFOax5gRslR%2FxKd9L9LwxDG4pnP4J4J4OP94AZ7Ge5CZvTcX3OMOaJwUBtRPVKO42Kwp6OJSIO1IXuPxNQ%2B7lkV70%2BbxVqs3B15qMcyY0e4VNuz15cpzMYeYaGV8iS6cnnAAQFq2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 831008236e21bb79-FRA
expires: Sun, 24 Nov 2024 23:22:32 GMT

GET
H3 200 dyson.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 2 KB
1 KB 9ms
9ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/dyson.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210432
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:20 GMT

GET
H3 200 rtbIcon.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 2 KB
800 B 10ms
10ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/rtbIcon.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 15:16:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115562
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 771
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 15:16:30 GMT

GET
H3 200 arrow.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 429 B
349 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ace6c1d1cccc4686d29e81c0821be209d2e2d8b7ba44ee24649a698a5230f6ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 13:53:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34146
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 320
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 13:53:26 GMT

GET
H3 200 dyson-v15s-submarine.svg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 25 KB
8 KB 8ms
7ms Image
image/svg+xml 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/dyson-v15s-submarine.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69e1767c60e702480b7a4604f7a71a344e3e03caa6e21f6a352a9f63908dc500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210432
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8356
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:20 GMT

GET
H3 200 1-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 33 KB
33 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/1-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

539cc993691ac34295a0b8e0b720aa3db63a2e80c78d49e1c4c4132bb4a5dc09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 02:04:14 GMT
x-content-type-options: nosniff
age: 76698
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33567
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 02:04:14 GMT

GET
H3 200 2-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 33 KB
33 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/2-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8833293f6762feb57c976e996042e2dcf201b282c034504008e2bf0a98dd3527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 17:17:43 GMT
x-content-type-options: nosniff
age: 21889
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33601
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 17:17:43 GMT

GET
H3 200 3-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 25 KB
25 KB 17ms
15ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/3-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e3479d14727cf6b6581add352dad3c9fb8a89b1586d49dc0e606249e7abe437

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:45:40 GMT
x-content-type-options: nosniff
age: 88612
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25911
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 22:45:40 GMT

GET
H3 200 4-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 9 KB
9 KB 16ms
13ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/4-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f430ad6611692180cc5bfba88afb989ac5cde063c2e929a28026be4c2c3e9f45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 19:41:43 GMT
x-content-type-options: nosniff
age: 13249
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8971
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 04 Dec 2024 19:41:43 GMT

GET
H3 200 5-min.jpg
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 12 KB
12 KB 14ms
11ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/5-min.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d60255211b63ebd7ab57221ffe52ae073eab1c1c3a93c48df42b224e7f7c527

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 22:43:23 GMT
x-content-type-options: nosniff
age: 88749
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12054
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 22:43:23 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/1064608057035189096/script/ Frame 5248 4 KB
959 B 10ms
10ms Script
application/x-javascript 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/script/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc757f9ba6603eb9913106a4cd83c7a7c0a8a4f845a0aceb1103606bc324ad00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 23:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86315
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 930
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 03 Dec 2024 23:23:57 GMT

GET
H/1.1

200
OK

request.php Show response
hal900029.redintelligence.net/ Frame 9D5A
Redirect Chain

https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

157ms
136ms

Script
application/x-javascript

88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 804867a100fe4e8e62e783e8e36ee7628dc4b0b04e8b4d029a0493e4f9bf4a05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 23:22:32 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 52239300001964104444550012530029
Connection: close
Content-Length: 1349
Expires: Tue, 05 Dec 2023 23:22:32 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 23:22:32 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 05 Dec 2023 23:22:32 +0100

GET
H3 200 dysonfutura-book.woff
s0.2mdn.net/sadbundle/1064608057035189096/assets/ Frame 5248 8 KB
8 KB 10ms
8ms Font
font/woff 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1064608057035189096/assets/dysonfutura-book.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1064608057035189096/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1064608057035189096/css/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 03 Dec 2023 12:55:21 GMT
x-content-type-options: nosniff
age: 210431
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7928
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 18:29:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 02 Dec 2024 12:55:21 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D094 0
0 46ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssSbpgBFwACAz1u9v6cAO4a8fVQ1q3S8l5Z2tRXV0oDNNJoV80E59UkpnPaeBgWXtujsNGMR2OA1y6xeTPPAK4Yj8j2UhwOPJKY5b6uqtdZpl5Eauxq8F0017sKG6N2v0IoAMFT2Nqydo6p3jofkQ5XL6-QgWYb56aLqbhITBBJFbA7lMWzdpGPYd3bCjoUhQBe6LbgI10PqqXVn5qxnLXkkwCfjsnbFk1wxDauyRRMfDIq4SMRSSEIEspNFUYktdeVZr2U3vmVnrxIx5pd1hza4aKrleNVJjM4njHX3fdvULAPzEER5wuG51zXrESTtE7DL60w9jPAMFC0LqWNH3o7QvBxeYuRYbtqiR8MxDpKrlBaRI-Pn_VjraMiVrifhUJZFopA39R7VwWMaHUd2s1Lv6qfB0NegQjQMhSBGg0ujq_LdroTZhtPWi891PNptB0iVlaxbz5FOhkh7DmQ8F0shqkofBybP85BmW6eco47saVnS5_SdQ_8zttOe0DcajrizrlLOSK7l2CcjXlCuVC53uLQiA9HlPcPmahL2pf64NckCHnnCM02ALSALXjnl937Okyt-HBzRtckeB9gYbKWi77r_L5m02UABCwCO4TGwGQOBi60oB83Hjgg4Gkdx3NwGbMFVeQkGlD8U_Y0PqOuVt5lmktVwaofZPiqMf_dIo6-8e0TguAQmDVxDU3ZTRR4C8_TWtJhR6YtaB8HGeRJDdW8Xw1HITCY0HtVDYbC97ikMlQANUqkPS4DOxwRHD1Y3zZivx5bfHYFdQpdOw2yvNKUCQiotBnVDtXrE0Ky0Oc65lLXzaImc0iYhPLAvhYu7QWI8BLCxEr9pJQpf9voKOyUy9EZb0Ya1-R7jeiMMBzznnDXnYI7dqBGMu_7GneIcicrmvsJhgLDK6TZQQvUypBU669t_dCxI1QW5m31uFNlILFbNxtP5Po4uNo3xdzvtPs0XlwDJnW1_cUljfi26oumEdypNlvS-GjdUUaU8LaSktxT_hpk4FqbZdW6QaSaWESFDd5g2t8tfO89kRHBMGgdnW7U9T2p2RK5PCT4I5O9RyK5Yl2bH27zZ4mbFVxxe0A6cH1-M8i4L3fj2XqrJKCCcmbntHlRXI204xvsC5GH17Ey5DOtnzM9rRtPkLjEfbh0kuR3YQl0FFurJAa7jnq-tyt-W7wtq7cIoaMInusBj3xXI8G16zs0xV2B9NHP7x6YZCY8FQ-K7y-4kbU59tjnYPfgUW2aPhWj_-yJobubTA-Drzo4zlD7NrzPHeyS2lLqTQdvn5Otd2sr0MOnJjHWBlOGZ-k-WJWtvE_AgJcYb61KIrDlr7L_2t4cu_lijdFltOLdXOf8lZ8EObuHozFWoR3d-U2S2TFlxXcZ9_ar56FkMWLVwZs&sai=AMfl-YQkZI0O1HZ_GwiFF2713vaUVpp9gbVkRNwVP5cJaVw88S8_ICjqJ-nX57b6n8YGLZy7MrRdpYdh4WsAPDh1CmPjwIgxKWsJp7PY4mg0Ietbih6ye2ukVTqQrJuVSRT4WVqtqS0YJVgBe3TR4mKrbRvMypq6YWqi62zPxWnXH4zE_qLsHRBdxb_wslvbui9c-ck_K3duC1xk03JUMbtQrnadFendHRAYFV7JmY9s3PFcqSLP2GQw5hg5BnMStZd-REDiz-unP8QGtmVS_SjZPz79uTNMbe-eRy5QYfFPbw&sig=Cg0ArKJSzENuuYvR6pc4EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=708&vt=11&dtpt=614&dett=3&cstd=93&cisv=r20231204.07627&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AFC0 0
20 B 44ms
44ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BNUd4uLBvZdmHC6e69u8Py72I2AcAAAAAOAHgBAI&bg=!t7SltPvNAAY3kmNgF5I7ADQBe5WfOOdSV21N-bnx4--10yWrS_emKyLV2ExwmOdCHmceavhErF27fJahertbwVyYLRKoAgAAAH9SAAAAAmgBBwoAV_pnEIdd7r0NQG-kCRLDceD-QN6GmoT-sMhcVaRdsGVW2zrWLAhA4C-FDUDN-v2c8oeWQUxPjHgHLKLeHGus5jwk5s4YI4S_XoBDXjzCMWVr7MzwaQiKCZkDF-1irNWfI67M3dE6_al4K69imCiF6TTJg41DaY9luFwaHZb5yEJHADavhY1nJvbDKXLh6E0MRMQxYPDZ59OccSKg68Dq7RaCmcVM2_C3ztICatOE_4MbzfY3SFq2msAp4rO-uNPfk_oVq0VFOdVL-sdf7VZP3vx99zDRxT10pBvE6ppCFk48xymJZgmcTpqICFWTzHUTVbKDopCQESPsJVHBBFEwkg69zps-lU0p2sklj_RB6jKBqrs9KrRLbIalN8Yt0B_292ioAjrnG89QELmS1tD5YMNrnactBniohQv9N_nlMuKdNqXUrazW02ZfNZNSLVRVl9LZhl3ZGqGTE8THS-kPxqSAcWtGVPHlDEtyKl7-EYlO2Jgzmimlk3xnZV-vG6r2qlUURNyby5t6WrGuvHXSsySBTlIZPs1RUEMzzU6Sj1Qr1ll2BmpDLYXYRug976EbGBeYmGZaxTw78QeCYdxEJ6obqTBa7XcmS481xTen4ip0oeFR5qCnbbwMQLQDv0l0IkZ8VWYew3pG9msR-jA8GiLWMef3byG5swYJkF_0tAXEIvdvmCV-estAwuJDCX4ioZZ0BBSTEXvaYKDkM1o0SPVHw-fl4FJpxBEzlu4Hs2WdLPVyKNrsN87kBBG5lnhNpUIZgJj1GjnmZjLffcgN5gB1vSH3UnM4WuKKWSDQ2CIrBBCp4FgVkvu-KwTZxtHc0RID6DzJ5Hlq2HgcRx6-_Sp2wkpDnT9REV_iz9aVO0kngs8mfSrKnWJ3x9uyXX8wpa9DkogwOdRIadby73Uif5eVu-VWVIjbRzBTbQ325uhv5BH4UMOe5iL-pX3T2JKFZnQAe999-jaWumtiYnJQhtGASw8QwE2L6NcW08J_jYin7gfEwbudSilHIguFAEmujVZYaCOogbqdhiMQzImrMVuA8ByYxk4Lahm4Mh_ZmQghvREfgJWeV0s4vvT335BYJBLcC0J1AiiItMuukZUys6gYCL_NTk4ALKlEhj6WFT0h0MdQOUc_dC89GM0FAZu-a38loYT6_6zp0p2MRguTTYHc

Requested by

Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3962 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BRk4AuLBvZZ-ODY-e3gPh7bKQAgAAAAA4AeAEAg&bg=!JSalJmnNAAY3kmNgF5I7ADQBe5WfOF_L3agr_yRBfELmFVeeJO5hqd0Q7ZKtstq734Q81azvawBKXdNiNoTpc4z-dCjlAgAAAFNSAAAAAmgBBwoAL1i95GB_1mzl4qKOlsSzIdpFLU4UrbDgS_BwlwUX4j9ARRbUyUgMctcqtmGUQQOnmQMTBciy0PP656_n8-rDW6ApCjHu2roCsfYq-dOddD7k_NCf7P1g-VDyQVn02rlFJ6lYSrdAWuJhFssna2EhfMJe7Hnto0ZsDomtlWj9J7t3KybPeIKjp6c1ObsKI6-aR18u8OkZlPzLZL4l41FqDnph5rAGEfX2WIY6Luxi7K1WFyc4AZY19wRbiaIkSAQlr311Ol2xQrF6NGT3q9KQAo_VzDWiIaZHRLfq1enO55J7VbAUweh8UTBixwJu9JBsJxc9x3QJX5c_tIydUz-SRemnR2VxNxWFamTKx8wlB9jt6qrGIPUWLXXYwOTbz1R7Ybc2vFeh2Jxv3MqD37K5-cM7Pojx5aYn6_TW2UaY_3K2k8I4Eef-wPZ6SPBqhatme8J5-kRvvJkf_JDEUybuIwSLWWQrFUqrvZ-CFbifikdAux6WXeyECOHfykWm6hxUdnWtbpP9e6f4qzV_bJyizCdMKx4V2FpfX_dHx7S7K0VWlcs305apsD_JPQFJQT6l60C1_rewfqAZKrtJZFXp4xPU2WrXREIXAXd-CIMymGBXIQlZnnbMUlCmXYteMbdA4VaJo7JYhkfEqAFlyLKoMsi3HpeG35EgIF_HsaLz4pI4I78Tvm-ydJmgeKjf6oQRxK_hW1xBVkOpTQy_4_SUa5noyKIdo3x4PqUYjpSCb7YNpOyDxnNuLnNHmK1sY6nlQK4y9BCuC74tboqg3qidxGCRU6-7rs17zpaH2LjWyRwMns9x1rYiyftCbzduzFXV9CNQAcKUnDYZzkq-i1iDqRkng4Jl10U7t1UL8J99EwfT1JRIXD2XvDu_4VGiWKsmOHwzdYLcHMSJQrrCsJWyEXyFWJfncyWu_f5Vb6uiSYse5xgAUqhxlZ2Ei19zpSzs_YWxqovSsHw5-Xqpp5yHGlY9QSRfP-QQ2Et1w7_qbrF7lzoxYMLniIfiltFiAzOKFONU-fCmJFon4mx5WvT9rgpXnUJbpYd1XQgm-OkqP6vBTMbXDHGuE6Y8WtDDuWPCuZvsYYWlhvHavQrBearQHvSrfiIvIg

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:32 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame ACB5 0
326 B 62ms
17ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=52239300001964104444550012530029&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Tue, 05 Dec 2023 23:22:33 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 / Show response
adv.office-partner.de/ Frame 46C0 930 B
923 B 48ms
6ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 05 Dec 2023 23:22:33 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 12 Dec 2023 23:22:33 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 e99aace94e6e58733936cdd965d03e75 Show response
pv.medialead.de/trck/epv/ Frame 9D5A 0
326 B 61ms
16ms Script
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=52239300001964104444550012530029&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 0
proxy-host: pv.medialead.de

GET
H2 200 e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 9D5A 43 B
361 B 59ms
15ms Image
image/gif 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=52239300001964104444550012530029&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 9D5A 43 B
703 B 140ms
82ms Image
image/gif 104.64.118.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=52239300001964104444550012530029&pv=1

Requested by

Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=0523aa992b&subid=&uid=b0648a05403cb5f6&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC1yUFt7BvZYShKou_9u8P7vOa6Aem5b2gaYWVnKfJD_AuEAEgm4OijwFgleKQgqAHyAEJqQLmMhcWuCWyPqgDAcgDmwSqBIYCT9C4he4UeobyFvos48twZCl8vU1cgFpEs2kWoOuG5yvLEm8entyFOvydRh-VyVtkyPsK4bwbtMd30b_j5NrGl6NMmYN6_toHfsw2o1y3phEb5rkgKPAC_fAiS81VFSIwyCMu_bayL3GAfucmp5mFVnfMOLdXlTNpgrRiLbgfVPOA8lp3pOqp2fcaZLVOnX8DWW_KcQldhfI30XC6SdN5bcPYIn0MeVA1VmbJ_V8Ca7V2JzD5kX1TfMQByIyB5sPfLnQGmvpG8365mQnWqRucpOvVuIPrkcefSJEHuhdUuoNdSAsR_PsY0NMhAJ-x74Ir7xAbQLZ7loWD2UrxFi7X8NpM81ZgccAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgdMgKqAjoCgEBIvf3BOliDvvqRuPmCA4AKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwjP5vqRuPmCAxWLn_0HHe65Bn2wE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ%26sig%3DAOD64_2B3AZvcrQToQ4IP12R46Axmua5sw%26client%3Dca-pub-7520027584027322%26dbm_c%3DAKAmf-AijKVxiH7oy2dBcW9ZksK7n5i5MQWL0PQAmvXOzMaWLEVJS_Wk34r1dhzOiYC8LcOHaxLqLCfQ_mNYRr3UlYq9EnsWjAi-OrSwmrUuYrTnJQ7Hq9onXdTG2nRXqTa7ZXkJtRhSN6YWBBdddGtnn2ydD-BPmSSvDpkSxIPSEiYcKzzCHIU%26cry%3D1%26dbm_d%3DAKAmf-D3kkzEuoygZ0DDu9OM1wMCwnFzFBB9vetAXxfle03d4JFFrWzho3Ns-IdBan1E2WLTLKp1WkVT_7nn7AqrYewdj5oRDIGw5Rdvv_ymh-oERm7nisS85d94Ur_JxwyxDMSzNK4BcExAv_vCmjVNSRu4A5WazwCDGYv5uSAtyLEBHEU-gqeYrmtwF311zmPLqgYQIsJnYEpFB-J4DJO5OqZyS6nGuN92Ouu1HLi6PcIUyGchEQunO-kQvytwWjeoLM4M1mDuAwbLOa8TxO1EMNIPhhA1hviMUiE2T5sjPjhLqSA1-4WIrHVagZHuSjDQizgcqOb9RP6K1efFPv0G4YsB9ptvHKBuyHzss--jApOerVecmkh_ZTYkJ0wzTFaeuCFGRwZqSGINCg5ChDOczgkFrJQNyPNcISuFEgcMsXwybEQs2TlGg2hDBo3a-XjbSz2pJmYVaw6jNdWBT690DxaC70r4ulR5eVtV1611X1NZwNSYpfPvjqbcqxy-4hvd3F5JuoNJRhGQLJcTgKBT8N9FcZpZly5xkX3pDrKZvCmsyk2ehQBgzMe57dpGVNKZOcBVKkqH%26adurl%3D&documentReferer=https%3A%2F%2Fpt.friendsforever.world%2F&ancestorOrigins=https%3A%2F%2Fpt.friendsforever.world&random=5909628937220&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.64.118.247 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-64-118-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 23:22:33 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 46C0 175 KB
63 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

26cfba712f85cb9fd60fc5c48994a8cff23737f4e0b452426312fca93b38add3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64116
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 23:22:33 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
215 B 118ms
117ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhQYH,pingTime:-10,time:777,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTkuMC42MDQ1LjE5OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1701818553179%7C%7C0e541a507ac0aecb1be660d7f2672f1d%7C%7C9d9fcb00733e98b40e93b73c4ea99695%7C%7Cb5033249bc28ea8ca7b2f92c0dc794a1%7C%7C9050935361c94ac57efbd13ee9f3855b%7C%7Cf73a938118b7d0e63ee571162f791c59%7C%7C1de7f439ad8a75729f035f7d35bd9303%7C%7C6cc071ef92922c5b85475412f1143ab4%7C%7C1663701684%7D
Requested by: Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 link.html Show response
track.webgains.com/ Frame 9D5A 2 KB
2 KB 170ms
81ms Script
text/html 3.11.198.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=52239300001964104444550012530029&nw=1
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.198.160 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-198-160.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 99fc51bda73e31e666483f5b0dfdce9b6aff48a232bcf5e5beb0be819b76c11c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
last-modified: Tue, 05 Dec 2023 23:22:33 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 05 Dec 2023 23:23:33 GMT

GET
H2

200

activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523 Show response
5994599.fls.doubleclick.net/ Frame 6C2E
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523?

391 B
326 B

52ms
51ms

Document
text/html

142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523?

Requested by

Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f6.1e100.net

Software

cafe /

Resource Hash

f06b58517cd1aa312f2a3bc89b82fb030b2c2f24bfa4cd2f97f50c007c2c5746

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:33 GMT
expires: Tue, 05 Dec 2023 23:22:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900029.redintelligence.net/ Frame 6598 7 KB
2 KB 32ms
11ms Document
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: f0a42eac218399ca8a844f8c0f5b2aa36de6e45ff276a175904c9a46ca48c589

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2065
Content-Type: text/html; charset=utf-8
Date: Tue, 05 Dec 2023 23:22:33 GMT
Expires: Tue, 05 Dec 2023 23:22:33 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 9D5A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2aa36df6ccc2af936a2489bf4d484f145593d054730555fea0dfa9bad9f67162

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 46C0 274 KB
91 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9fd6b390bcd0bd75ace63ff12d860b1f4b0636674bd595799847ec3664dfeadd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93075
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 23:22:33 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6598 2 KB
434 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 23:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 22:06:35 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 23:22:33 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6598 17 KB
17 KB 36ms
14ms Image
image/png 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: e7785dc6a6aed23ed78bfc28e7c7dccf0b40271189befe3ab8b4eac3ce5121dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:33 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16985
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6598 16 KB
16 KB 33ms
12ms Image
image/png 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 42def4d86e8d2c207a55ccb8ffde4eacd8fc7c70b8d90ae87f57a18c3f7d35a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:33 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16514
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 6598 11 KB
11 KB 34ms
13ms Image
image/png 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 7a37a315d93f1fc25a9b1d530ee8a0898dc65fdbc68f20fb63a1f375fda05645

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:33 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10940
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900029.redintelligence.net/ Frame 6598 0
150 B 33ms
12ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/viewability?s=52239300001964104444550012530029&a=097b910b&vb=m
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/request_content.php?s=52239300001964104444550012530029&a=d1240c52
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:33 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D094 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuRdKIMaEHEuqUihP4C_tJPadj_tOMT8TkyYbSNArKBL1P7MrajS2QHjp605zEtmqdF2O36oNguxJD45C8SnPMk76HOT8Sxz8CSxiiVsbKpf6SUrNNWISN00GUx3YotxowveLwO506GWPJL&sai=AMfl-YSZqWoICBvea4Po-fEWJjrqG4kx_4hXEaFRyKclU0WVPF-cVK2FolR-8_Gjmik7jB7GhnnfWK1n_EtjokQ8SV__PhkozwNh_PhNgeRLAeG7qILEfzqZd1E4Nkf2Ek_BcZEq0d24UvDqtSbwdconPWlvp3eNZdY0fTr5&sig=Cg0ArKJSzHo9zFLVTxToEAE&cid=CAQSTwDICaaNs_hOVYiJwQK-Pi4UVj_81zsDzIvQ-Hoc3mJgUHVkmWXjC6LC8rX-joaQA5HIieQlj-U9rpMQOHFramcnsAuXwl4GRg06m1uUzVUYAQ&id=lidar2&mcvt=1000&p=103,436,193,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231204&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2727974958&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701818551973&rpt=286&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523
adservice.google.com/ddm/fls/z/ Frame 6C2E 42 B
401 B 67ms
46ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CKfK25K4-YIDFcvLOwIdF-cDWw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5138527202260.523?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 9D5A 53 KB
19 KB 142ms
37ms Script
application/javascript 65.9.95.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=52239300001964104444550012530029&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-34.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 01:58:46 GMT
content-encoding: gzip
via: 1.1 77d19519a1c9ed821ab469548b9d17f4.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 77028
etag: W/"1180a1bfee0aad979766ecd6180b923e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: x3ZzxH7CmZMcs0DhjOiIXmI_MyVTmg9LnU_NKMhkhcv2f2dTvvLDYA==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 9D5A 3 KB
3 KB 56ms
13ms Image
image/png 18.239.50.21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1701818853&Signature=Jra1Q5DqBekw1Z1f1x3n7Kz76GhzpA0Q5BNVumqEMi9ovrM8FycIsSUmXa1GehPQyUoDgRcxOTx106wkib3r~xsMNPB9EQgd4yblPoj~ukDmcfbuNyis3u-1vZv4NTnbPXRxV3knpDvTEvfgPOZ5G~AQpCQITXYWnxa60ND0Z8EXEqQQ~jRbzCn0ORVHHAHwlal75R~axFaCo7CqNgFU45OGt1BvsJGy9PXo~gSMs9N1Y5CIat-hppaq8e2l5lgTVeA8tcx7z2sLAyFJS8KkbWBEpftBKSKI-21~ykA9XawAT3kKXVHr0~tPmDmsSsk6bt8DXZ4nWkqpiVMDSnNi5g__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
URL: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.239.50.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-239-50-21.ams58.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 05 Dec 2023 03:26:27 GMT
via: 1.1 b6e86319773f95421e5e42f048890d7c.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: AMS58-P3
age: 71802
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: OFbUcuP9LEPkNk6z30RAMnfQZtiLhzhI5FycJaDR8GG1tBgGgrkYSQ==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
215 B 118ms
117ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhR37,time:1051,type:e,im:%7Bpci:%7Btdr:1003%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:13,o:1039,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1035~0,0~100%5D,as:%5B1035~728.90%5D%7D%7D,%7Bsl:i,t:1039,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B12~100%5D,as:%5B12~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:128,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:18,sis:488%7D&br=c
Requested by: Host: pt.friendsforever.world
URL: https://pt.friendsforever.world/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 35AA 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvhFA9eaCQKUsHt9AYDn9XUrNro-UDRm9KGAuZv643e8J-YPC3H46wdNZkvpRj1HTI02lsWO2zvxKy3xRFGIwyu3-nfY7Xpk9WH4dk7yvLeODTlPotJIkgFg8gOHTQFJmpHrLhq0cju4IX_&sai=AMfl-YQuaKKglVVAaOJJyz9r4XSeby93sGDYYyWJ-wUnRxDI7KAvdZDo4FvAQY21VyS51i5X_mogFsTlu3IpZXsA4DjQwLHEZCer2y-gJPtsVzArt93rxZZ9Wo6w0zmr7v57tG8gROzBr5nrePl0W29LNte0bZCXuHSw1hU&sig=Cg0ArKJSzETr4fAtLOhaEAE&cid=CAQSTgDICaaNFiRcciqcf3CZQQK4bgZBJx_VFo4MNfYnEoc0G6U9PHCnrVxIx3duOpq3xlnywhpgFnABT81Q_LdlIkR4blYXhX31fDe7wzaULRgB&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=83,767,1000,1117,1140&tos=83,684,233,117,23&v=20231204&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701818552127&rpt=210&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 56ms
55ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231204&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3214cbefb2edba9d04a6f97504515068c125974c7f75a01e8637d3b0800a0f5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12251
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 109ms
107ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Dec 2023 23:22:33 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F2EA 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 11261
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 20:14:52 GMT
expires: Wed, 04 Dec 2024 20:14:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A1BE 829 B
560 B 17ms
17ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

13ba978e7ad1c18f445ad3312bf7ed97042dd7bf444ec891450c864cfeecc625

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-B4A-I_NFsCBn0yC2ZsvCTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-B4A-I_NFsCBn0yC2ZsvCTw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:22:33 GMT
expires: Tue, 05 Dec 2023 23:22:33 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame F2EA 39 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 20:14:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 11285
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 20:14:28 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A1BE 0
0 40ms
40ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231204&jk=291141450960331&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F2EA 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?9MP46Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:33 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D094 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1925164581815&version=m202309260101&ct=76&x=1&cor=2605904013992248000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 9D5A 16 B
209 B 56ms
56ms Fetch
application/json 35.177.10.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.177.10.97 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-177-10-97.eu-west-2.compute.amazonaws.com

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 101ms
21ms Preflight 35.177.10.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.177.10.97 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-177-10-97.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 05 Dec 2023 23:22:34 GMT
server: nginx

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
43ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231204&jk=291141450960331&bg=!IyClIG_NAAY3kmNgF5I7ADQBe5WfODV8V6sLgM-l6EiuKh9tOFZQbVMzfr9mv7TLUIV97yuNJQEeuLFXR0rO0-HPf7oTAgAAADtSAAAAAmgBB5kCv6UjwcfeDMHyfQmiKENyGVysUnd-prc9SW6-_a6_v6cPphM7NN7-GmK0nWgcplOBBy4HuR9BEnbPtAnqClgQVWXemJLTMMuvW5mjqU1U1fEXtN4VMYsjBQW6EZ42SReGaWeV4UAnmK8uj_NqH7PNJ3NlO4QEbT-lj9Ki1O6kLnbjrPDRNrV6fy4JsHvwdekDQ102BLdbMUIuWQ7c8_DCEmfZVy4O8Pwl_LLk31x_lL2Qhdimut4FotysW4-dx_ghtOV2SW2TP7s3JrNb4DHZp5GO-ymEGi5Pg0qTpGGaeX30uOBtXwpS2MUdjxqgYEfBaRF5jWRNIfBy6JeeXsVFVPnIu9euQK_QJCHzjqi9Fr4bBD2tzB5MoghUh-AZ4DBrZ-odN01yP3BfKEoZ2feJ0aURWZrZBdduSkgqDDHt62rbRDlg3Zkd9FxPiwDroJY0ikULu-njUbdV1YaN3c9fPYfMHboBjCpgqg3jc8aQNZfbMgzubF3sglOmXv6uK3IJKV_fygH5diPCCiJonk_laN_ckzWf43SdgF5YoRsP5L4RUIU_otX1BH5QcBwcVvJPfdey8qBQk1LktdFtiTiHUrecFyXs6L7O1Vf5tvr_996DNWm7PXNA48jdj_yUrnXvfwY85qjIJVCeOmmkIGBTQzlssvTbfVgXzratg8LrPS2zAljncDXvTU0fUp-s7qbGXV0jLQ93qJE-N-VTqqnj3MoAicBp38z11-P0Kvy9cfsjkte0JK5KJsoG1CJK5-J2aKeZQXMeTC2rK_wSsn5vac5c0ZhEQtq0q4UId4_hkT_acwZhZWreoIGY6Afk_8CPMOIGp61itLAVPqXvFyeY86G0AK_vOFbkNnNJBxno6QmmKCz9LZp_avCMgGz3AFKkE1Zi_a-IYjW7kCK1pXTIPEInLMzs1GEyqu9BH96IAx8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
215 B 118ms
117ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhRj4,pingTime:1,time:2040,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:18%7D,%7Bpiv:100,vs:i,r:,t:1039%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:1039,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1035~0,0~100%5D,as:%5B1035~728.90%5D%7D%7D,%7Bsl:i,t:1039,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1000~100%5D,as:%5B1000~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:121,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:18,sis:488%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
server: nginx
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D094 43 B
215 B 119ms
119ms Image
image/gif 2600:1f18:1aca:4282:f238:b199:bc69:7947
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1627455&asId=c29739b4-3cc2-32dd-b751-152c2275ae89&tv=%7Bc:vYhRj5,pingTime:1,time:2041,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:18%7D,%7Bpiv:100,vs:i,r:,t:1039%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:1039,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1035~0,0~100%5D,as:%5B1035~728.90%5D%7D%7D,%7Bsl:i,t:1039,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:121,fm:tXBTdf4+11%7C12%7C13%7C14*.1627455-73523880%7C141%7C142%7C143%7C151%7C152%7C1611%7C1612%7C171%7C172,idMap:14*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:18,sis:488%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4282:f238:b199:bc69:7947 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
server: nginx
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D5A 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6053186454572&version=m202309260101&ct=77&x=1&cor=2030330457760623400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 37ms
12ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpt.friendsforever.world%2F&domain=pt.friendsforever.world&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://pt.friendsforever.world
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 05 Dec 2023 23:22:34 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 206206
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
256 B 163ms
118ms XHR
application/json 35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002MpxP1AAJ&gdpr=0
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://pt.friendsforever.world
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H/1.1 200
OK / Show response
id.a-mx.com/sync/ 66 B
275 B 98ms
12ms XHR
application/json 131.153.158.209
SECUREDSERVERS-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=null&u=https://pt.friendsforever.world/&v=7.18.0&vg=pwpbjs&us_privacy=null&gdpr=0&gdpr_consent=
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 131.153.158.209 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU, US),
Reverse DNS
Software: /
Resource Hash: e3e795fde9bd88ac54d1ecfecff3508d7fd7ec26fe8481017ff19979d84560ce

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.friendsforever.world
date: Tue, 5 Dec 2023 23:22:34 GMT
access-control-allow-credentials: true
content-length: 66
content-type: application/json

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
397 B 38ms
13ms XHR
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpt.friendsforever.world%2F&domain=pt.friendsforever.world&cw=1&lsw=1

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:33 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 214610
expires: 0

GET f
fid.agkn.com/ 0
0

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
424 B 30ms
10ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

c03d773dc1e1f956cde7fe63c78d64efa28ec457089224dfea4df757e47818dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.friendsforever.world
date: Tue, 05 Dec 2023 23:22:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
428 B 99ms
31ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=z9q9llu&fmt=json
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 6b9fb8a227bb109917487967472f26d72d0a4ba39b3383ac8bfa0d9c48b3b730

Request headers

Referer: https://pt.friendsforever.world/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://pt.friendsforever.world
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Thu, 04 Jan 2024 23:22:34 GMT

GET
H2 200 pbjs Show response
sync.quantumdex.io/usersync/ Frame 660C 5 KB
1 KB 126ms
118ms Document
text/html 2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/usersync/pbjs
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea66ac0992e1b301d19fbf2ffe16e306e901b2deaf030761285e35011fbfa83b

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8310082e99169193-FRA
content-encoding: gzip
content-type: text/html
date: Tue, 05 Dec 2023 23:22:34 GMT
server: cloudflare

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame A65C 52 KB
17 KB 35ms
6ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 53061
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 05 Dec 2023 23:22:34 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 341, 398573
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230044-FRA
X-Timer: S1701818555.677674,VS0,VE0

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame E676 281 B
555 B 49ms
6ms Document
text/html 23.35.229.251
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-251.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 05 Dec 2023 23:22:34 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame F7ED 0
82 B 36ms
16ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 05 Dec 2023 23:22:34 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 4975 25 KB
9 KB 50ms
22ms Document
text/html 95.101.148.20
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU75OYJ3&prvid=2034%2C2033%2C273%2C233%2C157%2C159%2C236%2C237%2C117%2C437%2C51%2C97%2C55%2C99%2C56%2C59%2C3012%2C122%2C3007%2C246%2C4%2C126%2C203%2C446%2C9%2C208%2C2055%2C171%2C173%2C294%2C251%2C175%2C450%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C3015%2C3014%2C337%2C338%2C459%2C70%2C77%2C38%2C182%2C184%2C261%2C141%2C262%2C186%2C461%2C188%2C145%2C222%2C102%2C225%2C468%2C10000%2C80%2C108%2C229%2C109%2C82&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.148.20 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-101-148-20.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

b0a6c1fbdc65aa3a8dbf6da640512e24dd965b922f85c4d300763132e388b7d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8660
content-type: text/html; charset=UTF-8
date: Tue, 05 Dec 2023 23:22:34 GMT
expires: Thu, 07 Dec 2023 23:22:34 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame C122 0
0 341ms
109ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dXYyk0o2ur7BmNrkHcnnVW&gdpr_consent=undefined&us_privacy=undefined
Requested by: Host: fdyn.pubwise.io
URL: https://fdyn.pubwise.io/script/605322b5-5a11-4e15-8be0-5f8758178068/v3/dyn/pws.js?type=ffworld-desktop
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP001 /
Resource Hash

Request headers

Referer: https://pt.friendsforever.world/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
server: 33XP001
x-33x-status: 2000208

GET v1
lb.eu-1-id5-sync.com/lb/ 0
0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame A65C 0
597 B 13ms
13ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
an-x-request-uuid: 8b474ed4-36f1-4d8c-a731-09c90072e4d2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E676 46 KB
13 KB 9ms
8ms Script
text/html 23.35.229.251
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.229.251 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-229-251.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 96fe9ca0bdf99e0ac4dbccecdf21a0908da690de37f89f6fa0c790d3167aa47c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 23:22:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Dec 2023 12:00:39 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=45485
Connection: keep-alive
Content-Length: 13236
Expires: Wed, 06 Dec 2023 12:00:39 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame E676 7 B
380 B 53ms
7ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET
H2

200

setuid
sync.quantumdex.io/ Frame 660C
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dappnexus%26uid%3D%24UID
https://sync.quantumdex.io/setuid?bidder=appnexus&uid=3470481633142174832

43 B
105 B

118ms
118ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=3470481633142174832
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8310082f79919193-FRA
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
an-x-request-uuid: ca6afd4b-2f6a-49e5-b43f-ef6fecd17e50
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://sync.quantumdex.io/setuid?bidder=appnexus&uid=3470481633142174832
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

setuid
sync.quantumdex.io/ Frame 660C
Redirect Chain

https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D
https://ads.betweendigital.com/match?bidder_id=43894&callback_url=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dbetween%26uid%3D%24%7BUSER_ID%7D&crf=1&rts=310679055145922638
https://sync.quantumdex.io/setuid?bidder=between&uid=7aaf60a4-f326-5254-acfd-159fc992a525

43 B
94 B

103ms
103ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=between&uid=7aaf60a4-f326-5254-acfd-159fc992a525
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 831008309a319193-FRA
content-length: 43
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=between&uid=7aaf60a4-f326-5254-acfd-159fc992a525
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 660C 0
277 B 77ms
19ms Image
text/plain 216.52.2.16
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsovrn%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.16 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 05 Dec 2023 23:22:34 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2 200 0.gif
id5-sync.com/i/495/ Frame 660C 43 B
921 B 21ms
7ms Image
image/gif 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dinmobi%26uid%3D%7BID5UID%7D

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 05 Dec 2023 23:22:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2

200

setuid
sync.quantumdex.io/ Frame 660C
Redirect Chain

https://ssp.disqus.com/redirectuser/?partner=valueimpression&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dzeta-global%26uid%3DBUYERUID
https://sync.quantumdex.io/setuid?bidder=zeta-global&uid=ua-405eeb60-19f0-3c0a-94ad-a1497bf7766c

43 B
94 B

121ms
117ms

Image
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=zeta-global&uid=ua-405eeb60-19f0-3c0a-94ad-a1497bf7766c
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 831008315ac09193-FRA
content-length: 43
content-type: image/gif

Redirect headers

location: https://sync.quantumdex.io/setuid?bidder=zeta-global&uid=ua-405eeb60-19f0-3c0a-94ad-a1497bf7766c
pragma: no-cache
date: Tue, 05 Dec 2023 23:22:35 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2 204 v1
match.sharethrough.com/FGMrCMMc/ Frame 660C 0
35 B 35ms
7ms Image
text/plain 52.59.107.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/FGMrCMMc/v1?redirectUri=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsharethrough%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.107.120 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-107-120.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT

GET
H2 204 /
s.ad.smaato.net/c/ Frame 660C 0
243 B 52ms
14ms Image
text/plain 2600:9000:2127:1e00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=p&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dsmaato%26uid%3D%24UID
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:1e00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sync.quantumdex.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:21:50 GMT
via: 1.1 6fc3cae9692b6db972e4990be9921fae.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: PRG50-C1
age: 44
x-cache: Hit from cloudfront
cache-control: no-cache, must-revalidate
x-amz-cf-id: pdkWN6VM7JQ7Y1km3kLLCrET_s3VPfhCjz_h2sKe60BRNywrUbxr8w==

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 6942 0
134 B 50ms
14ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=185416&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 05 Dec 2023 23:22:34 GMT
Server: nginx

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 28AB 0
134 B 50ms
14ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=148144&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 05 Dec 2023 23:22:34 GMT
Server: nginx

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 56D4 0
134 B 48ms
14ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=149271&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxapads-mw%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 05 Dec 2023 23:22:34 GMT
Server: nginx

GET
H2 200 sync-iframe Show response
cs-server-s2s.yellowblue.io/ Frame 6E7F 0
368 B 285ms
95ms Document
text/html 54.145.99.161
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Drise%26uid%3D%7BpartnerId%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.145.99.161 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-145-99-161.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://sync.quantumdex.io/
content-length: 0
content-type: text/html
date: Tue, 05 Dec 2023 23:22:35 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2
x-reason: could not perform CS due to GDPR policy: gdpr is not applied

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame D839 2 KB
1 KB 35ms
27ms Document
text/html 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7b1737cb5c0bc021dcc1059cc0617cd33773a297b81dd445933bce85c1b41f1

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8310082f6d0636dc-FRA
content-encoding: br
content-type: text/html
date: Tue, 05 Dec 2023 23:22:34 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ejc9M7DSndURCbTXXBcniWOHizvfnKP2eV1KbdGc3ZgKqFSdsQznM3bf9tJMdSGpgqJpS6BMf8lZ6Dyh59RojU3sK5cWe%2Bng3ywDRGlJ7mit8FvTa9e%2FLeN%2FJ%2FFDzZes7SCuSX98hUMnhg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ Frame 9172 0
0 29ms
7ms Document
text/plain 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2bb78272a859ca6

Requested by

Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2

200

sync Show response
eb2.3lift.com/ Frame 774A
Redirect Chain

https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1

1 KB
2 KB

11ms
11ms

Document
text/html

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: e1ae9c66dc12065eada757395a249d9cf31da13f4e22abc9c4eab77a4b9b53b4

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1343
content-type: text/html; charset=utf-8
date: Tue, 05 Dec 2023 23:22:34 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 05 Dec 2023 23:22:34 GMT
location: /sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 3524 0
134 B 43ms
13ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=184388&r=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dxap-184388%26uid%3D%7BUID%7D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 05 Dec 2023 23:22:34 GMT
Server: nginx

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 011A 16 KB
6 KB 30ms
7ms Document
text/html 184.30.16.195
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.16.195 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-16-195.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=123728
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Tue, 05 Dec 2023 23:22:34 GMT
expires: Thu, 07 Dec 2023 09:44:42 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

setuid Show response
sync.quantumdex.io/ Frame DBFA
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT}&us_privacy=${US_PRIVACY}&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dunruly%26uid%3D%5BRX_UUID%5D
https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=

43 B
94 B

118ms
118ms

Document
image/gif

2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=
Requested by: Host: sync.quantumdex.io
URL: https://sync.quantumdex.io/usersync/pbjs
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer: https://sync.quantumdex.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 8310082fc9c49193-FRA
content-length: 43
content-type: image/gif
date: Tue, 05 Dec 2023 23:22:34 GMT
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html
date: Tue, 05 Dec 2023 23:22:34 GMT
etag: OPTOUT
expires: 0
location: https://sync.quantumdex.io/setuid?bidder=unruly&uid=OPTOUT&us_privacy=
pragma: no-cache

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 011A 0
42 B 88ms
17ms Script
text/plain 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=6848605&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
content-length: 0

GET
H2

200

usersync.aspx
dis.criteo.com/dis/ Frame D839
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=01ecba1a61534f60bb903333305a7ea6
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

43 B
362 B

13ms
13ms

Image
image/gif

178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:35 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 183404
expires: Tue, 05 Dec 2023 00:00:00 GMT

Redirect headers

Location: https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@
Date: Tue, 05 Dec 2023 23:22:35 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 0
Request-Time: 7

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame D839 70 B
148 B 39ms
29ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame D839
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEit50Iv5euCvy1nBS59wcY&google_cver=1

43 B
736 B

24ms
23ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEit50Iv5euCvy1nBS59wcY&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fNc%2BaQ0z8%2Bqo8de7rN40lGpHWwcoXyaiZosww0Edvyu7dFbiIyznJRuAK%2BZUr5fkT9dlnoU1WPWNhb16RM7vpUPHkQ3vF0fj%2Bu1Tmdi%2Fgq7RJOf54UyMYL%2BFL9hMI8W8oCXfyjhQ0Blj2w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8310082fdc491e56-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEEit50Iv5euCvy1nBS59wcY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame D839
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

144ms
144ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 23:22:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: RYFPRSJ8E71NQB81V7H0
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 23:22:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: BVK37B1J8KNKMVHQ1YZJ
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame D839 43 B
601 B 114ms
40ms Image
image/gif 2a05:d018:d29:3605:f06e:6a0f:4f28:b438
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:f06e:6a0f:4f28:b438 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2 200 tp_out
d.adroll.com/cm/index/ Frame D839 42 B
181 B 141ms
32ms Image
image/gif 2a05:d018:cc3:fe04:ffa8:51ae:9be1:eddc
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d018:cc3:fe04:ffa8:51ae:9be1:eddc Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.22.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.22.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame D839
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191

42 B
716 B

34ms
34ms

Image
image/gif

63.35.136.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D

Protocol

Server

63.35.136.25 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-35-136-25.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-06db7c088.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: 107ZfHb9Qi4=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-2-v054-099548ed2.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: Kqys7teLRHI=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=ZW.wuCBawGXdfJk4xUYQKAAA%263191
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 sync
x.bidswitch.net/ Frame D839 43 B
146 B 40ms
7ms Image
image/gif 3.123.238.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=index
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.123.238.130 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-238-130.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 setuid
sync.quantumdex.io/ Frame D839 43 B
117 B 228ms
225ms Image
image/gif 2606:4700:10::6816:2460
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.quantumdex.io/setuid?bidder=ix&uid=ZW-wuCBawGXdfJk4xUYQKAAADHcAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192922&cb=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dix%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:2460 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8310082fb9ba9193-FRA
content-length: 43
content-type: image/gif

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 774A 70 B
148 B 32ms
30ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2

200

ebda
eb2.3lift.com/ Frame 774A
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDcxMDc4NDQyMzg2NjgyODk0NQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

10ms
8ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 774A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO8ae7-dHEUAoASmbtP1YjU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
355 B

10ms
10ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO8ae7-dHEUAoASmbtP1YjU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 05 Dec 2023 23:22:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEO8ae7-dHEUAoASmbtP1YjU&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 774A
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDcxMDc4NDQyMzg2NjgyODk0NQ%3D%3D

170 B
188 B

25ms
25ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDcxMDc4NDQyMzg2NjgyODk0NQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s01-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzQ2NDcxMDc4NDQyMzg2NjgyODk0NQ%3D%3D
date: Tue, 05 Dec 2023 23:22:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 774A 0
648 B 216ms
180ms Image
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3464710784423866828945&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 81F08D572D144ED1BF01A5D1B3E01462 Ref B: FRAEDGE1910 Ref C: 2023-12-05T23:22:34Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYLy4JwpwRaQOsYMCUWDw==

GET
H2 200 3464710784423866828945
pr-bh.ybp.yahoo.com/sync/triplelift/ Frame 774A 43 B
426 B 106ms
36ms Image
image/gif 2a05:d018:d29:3605:f06e:6a0f:4f28:b438
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/triplelift/3464710784423866828945?gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:f06e:6a0f:4f28:b438 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:34 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

sync
x.bidswitch.net/ Frame 774A
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=3464710784423866828945&gdpr=0&gdpr_consent=${GDPR_CONSENT}
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=3464710784423866828945&gdpr=0&gdpr_consent=${GDPR_CONSENT}
https://cm.smadex.com/sync?sm_did=bds&bds_ssp_id=triplelift&bds_param=188933c5-efc5-4199-b05e-fb28ff576cde
https://x.bidswitch.net/sync?dsp_id=340&user_id=2b0ca226-62ff-450d-992e-8cf677d9472c&expires=10&ssp=triplelift&bsw_param=188933c5-efc5-4199-b05e-fb28ff576cde

43 B
145 B

7ms
7ms

Image
image/gif

3.123.238.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=340&user_id=2b0ca226-62ff-450d-992e-8cf677d9472c&expires=10&ssp=triplelift&bsw_param=188933c5-efc5-4199-b05e-fb28ff576cde
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Protocol: H2
Server: 3.123.238.130 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-123-238-130.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 23:22:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/sync?dsp_id=340&user_id=2b0ca226-62ff-450d-992e-8cf677d9472c&expires=10&ssp=triplelift&bsw_param=188933c5-efc5-4199-b05e-fb28ff576cde
date: Tue, 05 Dec 2023 23:22:34 GMT
via: 1.1 bb390afd921c223e0fe4921fbc23bbe8.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
x-amz-cf-id: 3695cbwmKXT8G9MuSWhibhJ3P1dC7lRSq_91HnvqH1-Jivit_OUY-w==
x-cache: Miss from cloudfront

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 774A 43 B
363 B 55ms
12ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=44&p=75&cp=triplelift&cu=1&gdpr=0&gdpr_consent=&us_privacy=&gpp=${GPP_STRING_28}&gpp_sid=&url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D2711%26xuid%3D%40%40CRITEO_USERID%40%40%26dongle%3D013b

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 237795
expires: Tue, 05 Dec 2023 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame 774A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=3470481633142174832&dongle=4d58&gdpr=0&gdpr_consent=

37 B
355 B

10ms
9ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=3470481633142174832&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 05 Dec 2023 23:22:34 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
an-x-request-uuid: 9df8bc54-6e56-4b05-aed4-994c85508535
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://eb2.3lift.com/xuid?mid=3335&xuid=3470481633142174832&dongle=4d58&gdpr=0&gdpr_consent=
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame 774A 43 B
1 KB 15ms
14ms Image
image/gif 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=triplelift_native&gdpr=0&gdpr_consent=&uid=3464710784423866828945

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.quantumdex.io%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID&ld=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:34 GMT
an-x-request-uuid: 96056ca2-184b-4d60-94c1-10bdc2ea4395
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame A65C 0
597 B 14ms
13ms Script
text/html 185.89.210.101
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:35 GMT
an-x-request-uuid: 75200f67-3ad2-426f-b8f3-63b8a186df61
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 138.199.38.133; 138.199.38.133; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 14ms
13ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978&_p=1701818550990&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAg&_s=4&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=page_location&epn.percent_scrolled=90&_et=1&tfd=6103
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:36 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 14ms
13ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-LBTPVBQZBX&gtm=45je3bt0v894806200&_p=1701818550990&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1986389205.1701818551&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EEAI&_s=2&sid=1701818551&sct=1&seg=0&dl=https%3A%2F%2Fpt.friendsforever.world%2F&dt=Pr%C3%AAmio%20de%20Melhor%20Amigo%202023!%20Desafie%20seus%20amigos%20AGORA!&en=scroll&epn.percent_scrolled=90&_et=22&tfd=6107
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LBTPVBQZBX&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.friendsforever.world/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 23:22:36 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pt.friendsforever.world
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fid.agkn.com
URL: https://fid.agkn.com/f?apiKey=2054351419&r=https%3A%2F%2Fpt.friendsforever.world%2F

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity/envelope?pid=109

Domain: lb.eu-1-id5-sync.com
URL: https://lb.eu-1-id5-sync.com/lb/v1

Verdicts & Comments Add Verdict or Comment

298 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

58 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.3lift.com/sync	1970-01-20 18:53:14	Name: sync Value: CgoIoQEQxLOp4sMxCgoIkQIQxLOp4sMxCgoItAIQxLOp4sMxCgoI5gEQxLOp4sMxCgoIhwIQxLOp4sMxCgoItwIQxLOp4sMxCgkIOhDEs6niwzEKCgiMAhDEs6niwzEKCQhfEMSzqeLDMQoJCB8QxLOp4sMx
i.liadm.com/s	1970-01-20 17:26:50	Name: _li_ss Value: CggKBgjdARDUFg
pt.friendsforever.world/	1970-01-20 17:26:50	Name: __bqs Value: aHR0cHMlM0ElMkYlMkZwdC5mcmllbmRzZm9yZXZlci53b3JsZCUyRiZ1cT1Jdk55WDJsdWtmeDQ=
.friendsforever.world/	1970-01-20 16:45:04	Name: _gid Value: GA1.2.1855048781.1701818551
.friendsforever.world/	1970-01-20 16:43:38	Name: _gat_gtag_UA_126527512_18 Value: 1
.friendsforever.world/	1970-01-20 16:43:38	Name: _gat_gtag_UA_207152156_9 Value: 1
.friendsforever.world/	1970-01-21 02:19:38	Name: _ga_G1CPQJTCEQ Value: GS1.1.1701818551.1.0.1701818551.0.0.0
.friendsforever.world/	1970-01-21 02:19:38	Name: _ga Value: GA1.1.1986389205.1701818551
.friendsforever.world/	1970-01-21 02:19:38	Name: _ga_9QKBNZJYL1 Value: GS1.1.1701818551.1.0.1701818551.60.0.0
.friendsforever.world/	1970-01-21 02:19:38	Name: _ga_LBTPVBQZBX Value: GS1.1.1701818551.1.0.1701818551.60.0.0
pt.friendsforever.world/	1970-01-20 17:26:50	Name: _pbjs_userid_consent_data Value: 3524755945110770
.friendsforever.world/	1970-01-21 01:29:14	Name: _sharedid Value: a9f5c826-5e2b-46a1-b56f-7495822696e5
prebid.a-mo.net/	1970-01-20 16:43:38	Name: _Amc_b Value: 0
.prebid.a-mo.net/	1970-01-21 01:29:14	Name: __amc Value: 1_1701818551_1701818551
.quantumdex.io/	1970-01-20 16:58:02	Name: uid Value: b5b2a186-8025-4ebf-b7c3-cb796b5dec19
.rubiconproject.com/	1970-01-21 01:29:14	Name: khaos Value: LPSYTQ9P-28-JYFS
.rubiconproject.com/	1970-01-21 01:29:14	Name: audit Value: 1\|naVuGyos1qq/09utODSIDXjc0/aJelRdbjRFtGIHH0v8WIacSke7l1giH1jw7crIXdpeynZXN55CaOH26V6HG4s5wH34cDMbJhsHlJbldDcrGvc3c9TZMCKPLRELhl3xGLmP30iNJH4=
.doubleclick.net/	1970-01-21 02:05:14	Name: IDE Value: AHWqTUkBKXXsS8c76CgCyeLWd29vXiublr3BYMfrTT8ndrNUMeSrGBfDmXYKJWrF
.adnxs.com/	1970-01-20 18:53:14	Name: uuid2 Value: 3470481633142174832
.casalemedia.com/	1970-01-20 18:53:14	Name: CMPS Value: 3191
.casalemedia.com/	1970-01-21 01:29:14	Name: CMID Value: ZW.wuCBawGXdfJk4xUYQKAAA
.casalemedia.com/	1970-01-20 18:53:14	Name: CMPRO Value: 3191
.friendsforever.world/	1970-01-21 02:05:14	Name: __gads Value: ID=3f930b794445605b:T=1701818551:RT=1701818551:S=ALNI_MaTEmXJzWbxRxkIBcI_FPxQTNyZWA
.friendsforever.world/	1970-01-21 02:05:14	Name: __gpi Value: UID=00000d0b4bcf6b80:T=1701818551:RT=1701818551:S=ALNI_MbR_oedaTbanWc3PiHYQTPtiAc3iQ
.doubleclick.net/	1970-01-20 21:02:50	Name: APC Value: AfxxVi6HNuWZxuV02PznHUKsPPGMHGNY0SGgkcdSPDJDaXomOANeLg
.doubleclick.net/	1970-01-20 16:43:42	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 17:26:50	Name: ar_debug Value: 1
.googleadservices.com/	1970-01-20 18:53:14	Name: ar_debug Value: 1
.redintelligence.net/	1970-01-20 18:53:14	Name: 8lcfmzhxc8d6_uid Value: cc507ad559a51e6d
.office-partner.de/	1970-01-21 02:19:38	Name: source Value: {"webgains_webgains":{"timestamp":1701818553231,"clickCookie":false}}
.awin1.com/	1970-01-20 16:53:43	Name: awpv11601 Value: 113440\|1701818553\|2adab240-93c5-11ee-a3ae-223050cf75aa
.awin1.com/	1969-12-31 23:59:59	Name: AWSESS Value: 357526:3266505
pt.friendsforever.world/	1970-01-20 16:43:42	Name: _lr_retry_request Value: true
pt.friendsforever.world/	1970-01-20 17:26:50	Name: _lr_env_src_ats Value: false
pt.friendsforever.world/	1970-01-20 18:10:02	Name: pbjs-unifiedid Value: %7B%22TDID_LOOKUP%22%3A%22FALSE%22%2C%22TDID_CREATED_AT%22%3A%222023-12-05T23%3A22%3A34%22%7D
.3lift.com/	1970-01-20 18:53:14	Name: tluid Value: 3464710784423866828945
.ads.pubmatic.com/	1970-01-20 16:45:04	Name: KCCH Value: YES
.adnxs.com/	1970-01-20 18:53:14	Name: anj Value: dTM7k!M4.gDYRWSF']wIg2In2i/2Z%!]tbO8i_iqf!oN/@E'zz<Z0Q8Q)2qY2=4`!u>gpTp>amHqRf=7-8o(/65@TD._Pl[gSnU+i7n#Dm3kSG4ghFr3jpKq3Nl%m_IU2C#e`jAnA1U!!)P*.SlEp
.adnxs.com/	1970-01-20 18:53:14	Name: uids Value: eyJ0ZW1wVUlEcyI6eyJ0cmlwbGVsaWZ0X25hdGl2ZSI6eyJ1aWQiOiIzNDY0NzEwNzg0NDIzODY2ODI4OTQ1IiwiZXhwaXJlcyI6IjIwMjQtMDMtMDRUMjM6MjI6MzRaIn19LCJiaXJ0aGRheSI6IjIwMjMtMTItMDVUMjM6MjI6MzRaIn0=
.bidswitch.net/	1970-01-21 01:29:14	Name: tuuid Value: 188933c5-efc5-4199-b05e-fb28ff576cde
.bidswitch.net/	1970-01-21 01:29:14	Name: c Value: 1701818554
.bidswitch.net/	1970-01-21 01:29:14	Name: tuuid_lu Value: 1701818554
.yahoo.com/	1970-01-21 01:29:36	Name: A3 Value: d=AQABBLqwb2UCEGfTm0OR4LFDsBokGUq5-OUFEgEBAQECcWV5ZQAAAAAA_eMAAA&S=AQAAAi5xnWunOJQ5jp2H2D0_bLo
.betweendigital.com/	1970-01-21 01:29:14	Name: dc Value: lux1
.betweendigital.com/	1970-01-21 01:29:14	Name: tuuid Value: 7aaf60a4-f326-5254-acfd-159fc992a525
.betweendigital.com/	1970-01-21 01:29:14	Name: ss Value: 1
.demdex.net/	1970-01-20 21:02:50	Name: demdex Value: 81460015841948006521797408197920149815
.betweendigital.com/	1970-01-21 01:29:14	Name: ut Value: ZW-wugAOqehp76wjTcwi7WhQc4LgYdiqzhFlCQ==
.dpm.demdex.net/	1970-01-20 21:02:50	Name: dpm Value: 81460015841948006521797408197920149815
.linkedin.com/	1970-01-21 01:29:14	Name: bcookie Value: "v=2&8ec9dd79-2183-4244-80d3-f26d1b9ad42d"
.linkedin.com/	1970-01-20 21:02:50	Name: li_gc Value: MTswOzE3MDE4MTg1NTQ7MjswMjH7iX7fmhmFk/yLiLOorPsvxjRbB+5hTTAVZ5Jtl8i5GQ==
.linkedin.com/	1970-01-20 16:45:04	Name: lidc Value: "b=OGST00:s=O:r=O:a=O:p=O:g=3155:u=1:x=1:i=1701818554:t=1701904954:v=2:sig=AQH_h97hsZnlOFMHqqVlNLz_fgi4QJ-n"
.smadex.com/	1970-01-21 01:22:02	Name: smxtrack Value: 2b0ca226-62ff-450d-992e-8cf677d9472c
.smadex.com/	1970-01-20 16:58:02	Name: smxbds Value: 1
.disqus.com/	1970-01-21 01:29:14	Name: zeta-ssp-user-id Value: ua-405eeb60-19f0-3c0a-94ad-a1497bf7766c
.liadm.com/	1970-01-21 02:19:38	Name: lidid Value: 01ecba1a-6153-4f60-bb90-3333305a7ea6
.amazon-adsystem.com/	1970-01-20 21:44:36	Name: ad-id Value: AxPhHltw3U4Kt92w6f52Glw
.amazon-adsystem.com/	1970-01-21 02:19:38	Name: ad-privacy Value: 0

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://pt.friendsforever.world/ Message: Access to XMLHttpRequest at 'https://fid.agkn.com/f?apiKey=2054351419&r=https%3A%2F%2Fpt.friendsforever.world%2F' from origin 'https://pt.friendsforever.world' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
network	error	URL: https://fid.agkn.com/f?apiKey=2054351419&r=https%3A%2F%2Fpt.friendsforever.world%2F Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pt.friendsforever.world/ Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=109' from origin 'https://pt.friendsforever.world' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=109 Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
acdn.adnxs.com
ad.doubleclick.net
ads.betweendigital.com
ads.pubmatic.com
adservice.google.com
adv.office-partner.de
analytics.webgains.io
ap.lijit.com
api.pubwise.io
api.rlcdn.com
api.webgains.io
bid.pubwise.io
cdn.track.production.webgains.team
cdnjs.cloudflare.com
cm.g.doubleclick.net
cm.smadex.com
contextual.media.net
cs-server-s2s.yellowblue.io
d.adroll.com
dis.criteo.com
dpm.demdex.net
dsum-sec.casalemedia.com
dt.adsafeprotected.com
eb2.3lift.com
eus.rubiconproject.com
f884d3db5788d58ad3052f466f695524.safeframe.googlesyndication.com
fastlane.rubiconproject.com
fdyn.pubwise.io
fid.agkn.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hal9000.redintelligence.net
hal900029.redintelligence.net
i.liadm.com
ib.adnxs.com
id.a-mx.com
id5-sync.com
image6.pubmatic.com
img.friendsforever.world
lb.eu-1-id5-sync.com
lexicon.33across.com
match.adsrvr.org
match.sharethrough.com
onetag-sys.com
p2e9r4n9.stackpathcdn.com
pagead2.googlesyndication.com
pfx.api.botman.ninja
pr-bh.ybp.yahoo.com
prebid.a-mo.net
prebid.media.net
prg.smartadserver.com
pt.friendsforever.world
pubwise-d.openx.net
pv.medialead.de
px.ads.linkedin.com
region1.analytics.google.com
region1.google-analytics.com
s.ad.smaato.net
s.amazon-adsystem.com
s0.2mdn.net
securepubads.g.doubleclick.net
ssc-cms.33across.com
ssc.33across.com
ssp.disqus.com
ssum-sec.casalemedia.com
static.adsafeprotected.com
stats.g.doubleclick.net
superal.github.io
sync.1rx.io
sync.adkernel.com
sync.quantumdex.io
token.rubiconproject.com
tpc.googlesyndication.com
track.webgains.com
u.openx.net
useast.quantumdex.io
www.awin1.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
api.rlcdn.com
fid.agkn.com
lb.eu-1-id5-sync.com
104.64.118.247
13.248.245.213
130.211.34.132
131.153.158.209
142.250.184.194
142.250.184.230
142.250.185.66
147.75.84.158
15.197.193.217
151.101.65.108
151.101.66.217
151.139.128.10
162.19.138.117
172.217.16.198
172.64.151.101
178.250.1.9
18.239.50.21
184.30.16.195
185.64.190.78
185.89.210.101
188.42.196.115
2001:4860:4802:32::36
2001:4860:4802:34::178
216.52.2.16
216.58.212.162
23.35.229.251
2600:1f18:1aca:4282:f238:b199:bc69:7947
2600:9000:2046:5800:8:48e:53c0:93a1
2600:9000:2127:1e00:1b:5138:8a40:93a1
2602:803:c003:200::45
2606:4700:10::6816:2460
2606:4700:20::681a:571
2606:4700:20::ac43:48e0
2606:4700::6811:180e
2606:50c0:8002::153
2620:1ec:21::14
2a00:1450:4001:800::2002
2a00:1450:4001:808::200a
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:810::2001
2a00:1450:4001:810::2002
2a00:1450:4001:813::2003
2a00:1450:4001:81c::2001
2a00:1450:4001:828::2002
2a00:1450:4001:828::2004
2a00:1450:4001:829::2003
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2006
2a00:1450:400c:c0c::9b
2a02:2638:3::c
2a05:d018:cc3:fe04:ffa8:51ae:9be1:eddc
2a05:d018:d29:3605:f06e:6a0f:4f28:b438
2a0b:4d07:102::1
3.11.198.160
3.123.238.130
34.107.161.123
34.120.63.153
34.149.20.76
35.177.10.97
35.244.159.8
35.244.193.51
44.206.51.168
46.228.174.117
5.161.35.131
50.16.53.197
51.89.9.252
52.210.167.100
52.46.143.56
52.59.107.120
54.145.99.161
63.35.136.25
65.9.95.34
65.9.95.40
67.202.105.23
69.173.144.138
77.245.57.72
78.46.23.46
88.99.219.174
89.149.192.64
91.121.248.44
95.101.148.20
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0ea53832a4a6789130ba0aafb9d6de4edb297281ccd3cc080ea5c5c96a53240d
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
13ba978e7ad1c18f445ad3312bf7ed97042dd7bf444ec891450c864cfeecc625
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1af8189c0a005cdfcd47482d36288517428abf24dd6dff2a84b98e2f5729e3cf
1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
257d192144ca4f619dcf808c11885528cbfeb8ddcfd0d78ddbba01bafe53dbbb
25edc370ea51183b1b38e093b6a472ca5eb47c7ffdc3822b3bb933f155fb7efa
26cfba712f85cb9fd60fc5c48994a8cff23737f4e0b452426312fca93b38add3
27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4
2a7e4bf63bc70f8c050d0d52aea5b15dddaaf64fd51036cd996130cbb5f58b14
2aa36df6ccc2af936a2489bf4d484f145593d054730555fea0dfa9bad9f67162
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e3479d14727cf6b6581add352dad3c9fb8a89b1586d49dc0e606249e7abe437
2e7e70ae818df9b6d1d339cd71c104d8b96fa84a1e5f76d72ea05d8319dc896e
2eeffe9ade4f82dd23a01540e23e8ac2d29bcc251e3c082ac08bf0f1390a87b2
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
3214cbefb2edba9d04a6f97504515068c125974c7f75a01e8637d3b0800a0f5f
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642
39c832603d09d081c9192ee0c0330f5affc87714c81110957fc09f925917419a
3b6dfeb59f7464899e64068a09afaa80fdae61e9767a041f9bc60aae5362c599
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40cd7c42ce18274b6c599fcbbb1148656807b12c48acd4c81474de8bf0658131
41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
42def4d86e8d2c207a55ccb8ffde4eacd8fc7c70b8d90ae87f57a18c3f7d35a4
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4ce2c84c474fb80b33e347ae6f356796021d6fd42e88a6352fc6e9ca0b22bd63
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50f54fbc6ed7b4c728674e8e7828ca99b911595bb2cd3dd3b312a14d39a7aa46
539cc993691ac34295a0b8e0b720aa3db63a2e80c78d49e1c4c4132bb4a5dc09
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57f6d3807b91f5746bee342a67bb053029f637f59ed6afee9f224ab8ef394757
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63e6f24715518dd6a3520f0b6d768b24ce278787b788154d6fbccc10ac062c1b
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
69e1767c60e702480b7a4604f7a71a344e3e03caa6e21f6a352a9f63908dc500
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b9fb8a227bb109917487967472f26d72d0a4ba39b3383ac8bfa0d9c48b3b730
6e5f38456e85c91724979e7df314dc38b568bed6a75d0fa42c5c76bd94c07ad7
7092f15e79b47ada2e956d92b902c3b3d028423f9fdf05a460df32f77aa4458b
737473b145a0fb2d97963ba71104b42ea59d434e17d43de3db67ddffc24200ac
7a37a315d93f1fc25a9b1d530ee8a0898dc65fdbc68f20fb63a1f375fda05645
7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9
7c9d9926c25c642b38c61db699c38c2e5029fb03788c08b0f39a4ca74138423c
7d60255211b63ebd7ab57221ffe52ae073eab1c1c3a93c48df42b224e7f7c527
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
804867a100fe4e8e62e783e8e36ee7628dc4b0b04e8b4d029a0493e4f9bf4a05
80f4d9c7c420e58b6a1d8013b9512aef088d5e019824b98db55e90fa74480346
81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8833293f6762feb57c976e996042e2dcf201b282c034504008e2bf0a98dd3527
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b
966ae054fb01b6518dd949476622ad377803b83ff8f0bc5bfd6fecfb91930068
96fe9ca0bdf99e0ac4dbccecdf21a0908da690de37f89f6fa0c790d3167aa47c
98d275c5fee6b2c633d8ae4531a879216028c3468a7843d4a2fe8e928da98463
99bc25d0e108e627a0f594c4f0f452bc709d1ea5de3fa1bf5ac999ed749ea744
99fc51bda73e31e666483f5b0dfdce9b6aff48a232bcf5e5beb0be819b76c11c
9a03674bfe83fe09eee7aae6106943918be73a009be21468c2bdb1b4ce958fdc
9a73ec51d0e62c2fdb04d631b841b43d1d61a18fd1c09ffc243db565ef05bbe4
9fd6b390bcd0bd75ace63ff12d860b1f4b0636674bd595799847ec3664dfeadd
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a5270b4442df921b38b1241f7152a12f1cc932633bae9ec745515477369e4939
a84cb06c27b7617c81b075bdb123e0e63e8da1b70feee763f86899a4fc3f3623
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aa75586e9689241b28f92dab52280da1b2bf690601ab184167caeba9fce092c5
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ac7c82b8bb1d0f85cd4e112e5789568360d256d2f3200aabab6f9d1dbce9663c
ace6c1d1cccc4686d29e81c0821be209d2e2d8b7ba44ee24649a698a5230f6ff
ae639a7506587163bc81082e5066794377d3573ed38ae6cb41051778cd0e08aa
ae87eca13f4f819535be7d4bff6619d7432d07b329ae57d5e3e0e926c542bffa
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b0a6c1fbdc65aa3a8dbf6da640512e24dd965b922f85c4d300763132e388b7d2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1f61d95c90c3ba60d0c9591a32133b57fbeda216e0d049fa8f99178c1e8426e
ba1cd9af530aa23f4fa4d81aa7047b128d8f78a62b1a7c3fa1f9fb9ea0550558
ba67e5d2e5db0a26ca087c9a9bcdf1ca76a909b0e00de8b692c187c98bfa82e1
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbde0fd637840b04806e70ee7610047e1cfe5568854929dc58c310a861d93ca6
bc3f72b5fd9d8db2907974cf2c815903dd438134ab524f6c9be1d3c8a8fa84f4
bde870db9f69ed3c0d98de250435d2a17e919736ad5fae9ef3aa66c50c1a2013
bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2
c03d773dc1e1f956cde7fe63c78d64efa28ec457089224dfea4df757e47818dc
c190eb38a3f491bcbf96b136cf4a4ab534ac1293d37d9047fd77db6365c86682
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c3477a72ef1db732762ffb13ba55d7df867b64c2abf5f88a1fdff29e6dbe374d
c72c5cdb8ee97ed1e23f49f9cc0884c795f9c70e85a566453d9701f12cebfe9f
c868679a384546d80661e6085c6a40e95de3be2ad0487c56e116703ffd1850bf
c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1
c936bca314b30e3c48bbad667c920cac28e3e43b72f5f372c706e885a0aa2743
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca3d325a1bc4c9fd2b3ab2d7504280aecb1664f6c90a5bd68f33b754236962ff
caac6db1bffec25e329e05610f10bf99c20ede03d4961741fea3d732aa53df00
cdb0b68c764f20f483b8077b9eb2080ac6871fcc65e6a214089eaa5571f84d55
ce2b61e64a17f1488f20bafee5aa20a8d8ec897b990f709634f5bd1cc620e6b0
ce56080747fb3b762486b9ccc59bc01f871c9647d354a1c27b52cdb73fc1bfe1
cf9c6fa44989dd4c596f901f16c35fe611d383f46754231f92457dffa58ca006
d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4
d3e4cdbb12defe352221c7446f538206d487f314187f7883e6f261d9246ab3af
d544a042adc760c2d4c0e55dfb54eee3e64209733c7db5fc3bbf028d63c86c16
d6ebacb17c208049a31935d995089b2a8e9c8a7c92a7a8bdd5a45db645167c69
db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d
db668b70fd0021a224a50338fc80f62881fc5e678e84987ff62785d86ab3f320
dcea90774b4efef72411006fda4ff5af93fc59b26ec28d6f93cdf7dac0cb8927
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de456781e54a563016157873f502b4314950b959e42e789967d3bcd060d1ef3f
e008c4298a5b3e7d5da28902166d987f328eaa2bbe022c9cb38f8b0c71eb4e60
e04a40af8692b8e76780c014a3f5ad8d55d98fe8a6cd671bbebd32413117888d
e1ae9c66dc12065eada757395a249d9cf31da13f4e22abc9c4eab77a4b9b53b4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e795fde9bd88ac54d1ecfecff3508d7fd7ec26fe8481017ff19979d84560ce
e5e166567ad908883ca1d769c38b6f65959bb067295e5ea3c2f850ec5fa2b8d9
e7785dc6a6aed23ed78bfc28e7c7dccf0b40271189befe3ab8b4eac3ce5121dc
e7b8d433b88d210c6aeb414da6fc440f45c471fad1b5aaae9f0b66c50122c62b
e90de18068fd669d9dbbe1d39c2c8e7e252ef474deb2eb270b933d5d5c0c5048
e9d326d143e17ce184ce94bd819a52c092a13b2cea37cac67fc423984914562c
ea66ac0992e1b301d19fbf2ffe16e306e901b2deaf030761285e35011fbfa83b
eb0fd579388b546353dbf540497787a7fd40b983b99391a764706b984545667d
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
eb8727019f2f9986f7d2f6c3f3d454d1aa7d68498019eb96c2dcc596c7a5895a
ebb21fd1c8aa540e056691b1af18b7fcf9860fc8c88a263ebafd80723044c805
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f06b58517cd1aa312f2a3bc89b82fb030b2c2f24bfa4cd2f97f50c007c2c5746
f0a42eac218399ca8a844f8c0f5b2aa36de6e45ff276a175904c9a46ca48c589
f430ad6611692180cc5bfba88afb989ac5cde063c2e929a28026be4c2c3e9f45
f6cbe31747c16c069d861a8ed01b15186eaee8c381f74ca1712087811c39f4d4
f7b1737cb5c0bc021dcc1059cc0617cd33773a297b81dd445933bce85c1b41f1
fa40858bc00aa25239b434a313f9b30b4b604715b21395c0f278a3055cd31deb
fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd
fbe2dbe2acf3d8629c626f25807486e251958d7d1c38be4b44ee39275cb7b12c
fc757f9ba6603eb9913106a4cd83c7a7c0a8a4f845a0aceb1103606bc324ad00
fd15dccc78b33bb29115461ac9504869f4af29b5bdc93111b8ecff5d58469206
fedca70f477e2b6a0b5fed74374b64dd6159f4dae5c6ac3cf0638ed7ac047b8c
ffbd03246f6fb03f3ad1a8a6194401ada2a15f6c82b39a3c608d13359669468b

pt.friendsforever.world Open in urlscan Pro 2606:4700:20::ac43:48e0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

272 Requests

90 %HTTPS

37 %IPv6

60 Domains

90 Subdomains

78 IPs

10 Countries

3050 kBTransfer

8293 kBSize

58 Cookies

4 Outgoing links

Page URL History

Redirected requests

272 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

pt.friendsforever.world Open in urlscan Pro
2606:4700:20::ac43:48e0 Public Scan

Screenshot
Live screenshot

Full Image

272
Requests

90 %
HTTPS

37 %
IPv6

60
Domains

90
Subdomains

78
IPs

10
Countries

3050 kB
Transfer

8293 kB
Size

58
Cookies

272 HTTP transactions
3 data transactions