sharemods.com Open in urlscan Pro
104.26.10.194 Public Scan

ns31533569.ip-162-19-138.eu

Software

XO.webservantpro /

Resource Hash

831f338d3b8d071bc5507cb8e5f0ad99e0a60d258b76e7d9cd0c14b60134490f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sharemods.com/
Origin: https://sharemods.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 13 Jan 2023 11:52:32 GMT
server: XO.webservantpro
etag: W/"63c14600-6a04"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=17280000, public
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.gstatic.com/s/ubuntu/v20/ 29 KB
29 KB 40ms
40ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;700&family=Ubuntu:wght@300;400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sharemods.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:16:18 GMT
x-content-type-options: nosniff
age: 411243
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29752
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 17:05:11 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Apr 2024 22:16:18 GMT

GET
H2 200 tag
btloader.com/ 14 KB
6 KB 48ms
47ms Other
application/javascript 2606:4700:20::681a:68b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://btloader.com/tag?o=5646025299591168&domain=sharemods.com&upapi=true
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:68b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ac79625d88a61926a6602aeb6f3731d28f73a801f53fa38e6f672d1fc04813c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 04 May 2023 16:01:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1517
etag: W/"7304487dc03562bb2bd351b49b157901"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k15DIO%2Br%2BBE2rcdGKOxRhBG8naZH7BTYZ%2F%2FnkRnDNGp5s2d2qnNPm0tRWsMf9i8z%2FHea6V0O%2FB9kewKbv6GZsboosINM3EtbWVYB8kGI6S6ZY6LoIQrn7mOD1iFIfd4WHjcDNnCjV%2BogkA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=300, must-revalidate, stale-if-error=3600, stale-while-revalidate=300
cf-ray: 7c2220b63befbb97-FRA

GET
H2 200 px.gif
ad-delivery.net/ 43 B
335 B 137ms
48ms Image
image/gif 2606:4700:20::681a:246
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1004345
x-guploader-uploadid: ADPycdtGg9okRiqDeEbyWoWzc6ZkXtnm5yuiXwoozrNUqZGrdQtz7ATFt-KwsOj76AoO5qkilFuI8iJFo3-PAonxPXTqQqZd4mFd
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wMXfZHmuqOxicJj5tlXNAuiPSg5q9r1iI%2BChthPFimK8oeZ4Zlm%2BadsPcXRT8pL7h1yNd6ZL2CBkkJnhQUxmojOTB5tkb05iUca4IKvEZCn5WvDnzncC9hrYgIw62ne0NVgq2AiJlUsuQnSOBg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7c2220b6cd981e56-FRA
expires: Sun, 23 Apr 2023 02:14:46 GMT

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
572 B 136ms
41ms Image
image/x-icon 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 03:18:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47505
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104
x-xss-protection: 0
last-modified: Tue, 08 May 2012 13:08:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 05 May 2023 03:18:36 GMT

GET
H2 200 px.gif
ad-delivery.net/ 43 B
871 B 136ms
47ms Image
image/gif 2606:4700:20::681a:246
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.5919319613408118
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1004345
x-guploader-uploadid: ADPycdtGg9okRiqDeEbyWoWzc6ZkXtnm5yuiXwoozrNUqZGrdQtz7ATFt-KwsOj76AoO5qkilFuI8iJFo3-PAonxPXTqQqZd4mFd
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 5
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Wed, 05 May 2021 19:25:32 GMT
server: cloudflare
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-goog-generation: 1620242732037093
content-type: image/gif
access-control-allow-origin: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
access-control-expose-headers: *
cache-control: public, max-age=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7RLrmZFA%2FiLF1Ax2PFZyS2Ocx4ngYjHZVK%2Bq9kzwmkU8Nc34CbNgFbPKvlPjjyImaUT2cZaPX%2BG%2FMLkJKIftFSbTEEz9Ca8focYHve8R4jvN21R%2BU9nWlcrJHB6p72MXTpSNaNzh6Wmg8Tpu4A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 43
accept-ranges: bytes
cf-ray: 7c2220b6cd9e1e56-FRA
expires: Sun, 23 Apr 2023 02:14:46 GMT

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3

200

invisible.js Show response
sharemods.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b5e45436/ Frame 65E2
Redirect Chain

https://sharemods.com/cdn-cgi/challenge-platform/scripts/invisible.js
https://sharemods.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b5e45436/invisible.js

25 KB
12 KB

45ms
45ms

Script
application/javascript

104.26.10.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sharemods.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/b5e45436/invisible.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Server

104.26.10.194 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c55faeb56fb1c86e7c6bcb6f069f654ef0db5cc45e243f7842b8d4458e415ce2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8sG2mrl6g1omUNL32U8juyERwcgq%2Fidc4xiBxfTKorSpO9CUKmq9i%2FZSP%2FCmfwQD7Z%2FcxG2X7sFZj5XrBKUlPF8IQdyJLmw22CqkSAedElEqIAJmTrGTUQedrOjdzO8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7c2220b6ccc13827-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Thu, 04 May 2023 16:30:21 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zy6GU0Msiz0PZx33069cHku0DTkx1tnfHnmvvX9Gq%2BgM7P%2FF%2BCOV39P1mjpvzoVuDMeAXqndt6Ji%2Brf3DQnZxsr6R8hJnSV1%2ButQEVzPskpUvQqtc2O156OoppVq0cQ%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/b5e45436/invisible.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 7c2220b65c2d3827-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 126ms
40ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-15082559-23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 04 May 2023 14:35:44 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 6877
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Thu, 04 May 2023 16:35:44 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 128ms
42ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsharemods.com%2F&domain=sharemods.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://sharemods.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 04 May 2023 16:30:20 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 237353
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 227 KB
56 KB 138ms
45ms Script
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e81437bacb2eadf8e9892f7c4423437a86ed8249bf77dcf71770909857779174

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 15:36:44 GMT
content-encoding: gzip
via: 1.1 75a13c74495137fb5435dc4030981df6.cloudfront.net (CloudFront), 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
last-modified: Wed, 03 May 2023 19:27:12 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P6
age: 3218
x-amz-server-side-encryption: AES256
etag: W/"e301ce991ef543783521cd0156a962ee"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: jP6Q0iRFMkO-NTOAWxPEZhRX4puKIFRnfJxu8vibz78jwf6hN80LkA==

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 127ms
42ms XHR
application/json 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230504

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

124ee144116aa416b26d2e2cfa93a3e4892ae0b056a03c99b2a3c9a511d90ad1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 04 May 2023 16:30:21 GMT
x-content-type-options: nosniff
content-encoding: br
age: 40376
x-jsd-version: 1.0.1690
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 842
x-served-by: cache-fra-eddf8230053-FRA
x-jsd-version-type: version
etag: W/"638-gS4V2PD9PsCJlD26kcjUgW/3Wj0"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

POST
H/1.1 200 481.json Show response
id5-sync.com/g/v2/ 216 B
623 B 137ms
44ms XHR
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/481.json

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

566604989f4516a8cb6811f715c9fde289c5155c9747ec9858c0f8323720d57a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Thu, 04 May 2023 16:30:20 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
372 B 127ms
42ms XHR
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsharemods.com%2F&domain=sharemods.com&cw=1&lsw=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 235462
expires: 0

GET
H2 200 country Show response
api.btloader.com/ 16 B
203 B 241ms
150ms Fetch
application/json 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/country
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5646025299591168&domain=sharemods.com&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: a04a64eb55c4a16ed352d149385a8ac8d8c2d3291f0e5b59b0f48375443b5f24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16

GET
H2 204 pv Show response
api.btloader.com/ 0
66 B 243ms
153ms XHR
text/plain 130.211.23.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.btloader.com/pv?tid=40DEE8op&w=5737349457641472&o=5646025299591168&cv=2.1.11-3-gabc8642&r=false&vr=1600x1200&pageURL=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&sid=5TcZlQ8Kz&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5646025299591168&domain=sharemods.com&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 04 May 2023 16:30:21 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
vary: Origin

POST
H2 200 cookie_sync Show response
prebid-stag.setupad.net/ 42 B
551 B 237ms
144ms XHR
application/json 104.26.8.178
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-stag.setupad.net/cookie_sync
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.8.178 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57ce2b08ef8da65d0f5627d6e41c7725efd32d3e377dea3c91025a375ae93fdf

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8EOSXxJglC%2FblbFR0toJT1fvgGJWTGaKkoxplElHWrbULDKcgCL2ntHbSD45K7PZq%2FYNflAnZW959Er8hKQQdJAey6nsXmFYR%2F6EA4zQZglNSvGVKPhsCEoEPT4cSLhRRApvcA3WexPS"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 7c2220b7bef72c23-FRA
content-length: 42
expires: 0

POST auction
prebid-stag.setupad.net/openrtb2/ 0
0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
114 B 193ms
76ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Thu, 04 May 2023 16:30:19 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 48 B
850 B 146ms
54ms XHR
application/json 185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

983775b438c242df7cb0ceb87bd2582f96ff0d4e8043f822adf3a3e93261b9a8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:21 GMT
AN-X-Request-Uuid: f5c50641-9b23-4b25-b2ca-b68df47514e7
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://sharemods.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 48
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
176 B 132ms
44ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Thu, 04 May 2023 16:30:21 GMT
access-control-allow-credentials: true
vary: Origin
access-control-max-age: 3600
access-control-allow-methods: POST

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
561 B 350ms
124ms XHR
application/json 185.86.138.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 8b9b81833890ca4d17a848f43d9e0a2f9901c114841bfda055c7b0855c8ba861

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://sharemods.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
556 B 502ms
276ms XHR
application/json 185.86.138.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 8b9b81833890ca4d17a848f43d9e0a2f9901c114841bfda055c7b0855c8ba861

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://sharemods.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H/1.1 200
OK v1 Show response
prg.smartadserver.com/prebid/ 171 B
556 B 373ms
147ms XHR
application/json 185.86.138.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://prg.smartadserver.com/prebid/v1
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 8b9b81833890ca4d17a848f43d9e0a2f9901c114841bfda055c7b0855c8ba861

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:20 GMT
content-encoding: br
transfer-encoding: chunked
vary: Accept-Encoding, Origin
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://sharemods.com
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: no-cache,no-store
access-control-allow-credentials: true

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
361 B 131ms
40ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://sharemods.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 507 B
2 KB 276ms
51ms XHR
application/json 2602:803:c003:200::31
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=13606&site_id=154926&zone_id=1969856&size_id=2%3B15%3B15&alt_size_ids=55%2C57%3B2%2C16%2C57%3B2%2C16%2C57&rp_schain=1.0,1!setupad.com,125,1,,,&rf=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&tk_flint=pbjs_lite_v6.6.0&x_source.tid=75badc15-55e7-4b60-8696-af959dde96a7%3B2e8ec953-038d-4e76-982a-e28265efce14%3B635bd98d-5fd6-4ccc-a8a1-3746ba795c7f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.9748698855602149
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::31 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 3fa910416a2012ff0b0d50a9949ad2485097692ecd7974bbfb3d32ed0353c041

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://sharemods.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 187ms
89ms XHR
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 326c399bd8684677206d47b2097571fd5844029cc24fbbbbf01a2798514dcf7f

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:21 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://sharemods.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1836
Expires: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
168 B 135ms
43ms XHR
text/plain 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Thu, 04 May 2023 16:30:21 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://sharemods.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
184 B 407ms
120ms XHR
text/plain 198.148.27.133
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL: https://bid.contextweb.com/header/ortb?src=prebid
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.148.27.133 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
access-control-expose-headers: Access-Control-Allow-Origin
date: Thu, 04 May 2023 16:30:21 GMT
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
server: envoy
x-no-bid-reason: Passback by decision

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 154ms
52ms XHR
application/json 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.6.0&cb=81373854540

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 536 B
884 B 212ms
107ms XHR
application/json 185.255.84.151
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&PublisherDomain=https%3A%2F%2Fsharemods.com

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.151 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

5cb2b24ebfae2dc3cebf166c2f9b05b96bc0d2176b806397875df57399c21e81

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 58
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 536
expires: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
205 B 47ms
46ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=722352449&t=pageview&_s=1&dl=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&ul=en-us&de=UTF-8&dt=Download%20LFS%20setup%20rar&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=1679198095&gjid=556489692&cid=151210928.1683217821&tid=UA-15082559-23&_gid=45536344.1683217821&_r=1&gtm=457e3510&jsscut=1&z=1647439977

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pica.js
sharemods.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 65E2 6 KB
4 KB 44ms
44ms Other
application/javascript 104.26.10.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sharemods.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.26.10.194 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

608f8e909fafd4d8d40aeb09b0e788582031d1c09e0d691198526790b1d947cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3NtLLmFY22eb2dcRdT%2BEUpVXRXTj3tNgCnYNF%2BhWlvllO3uzvqEav7wMDU7lK%2FZqMrzPDnjrO5j74a5vo1%2Fz1HVlC1XQ%2FvVsfX8crs1Jb5EJ4KgdHA102LYYE%2Bjd3Dc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7c2220b75d913827-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 570814_5m.jpg
cdnt.onnetwork.tv/poster/5/7/ 21 KB
22 KB 208ms
100ms Image
image/jpeg 217.182.102.223
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnt.onnetwork.tv/poster/5/7/570814_5m.jpg

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.182.102.223 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

d174b44385b81158573717412867bdde8c1641dbb83e086f7794aa3789e023aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 07 Feb 2022 09:30:47 GMT
server: XO.webservantpro
etag: "6200e6c7-55f8"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=17280000
accept-ranges: bytes
content-length: 22008
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 570804_5m.jpg
cdnt.onnetwork.tv/poster/5/7/ 10 KB
11 KB 209ms
100ms Image
image/jpeg 217.182.102.223
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnt.onnetwork.tv/poster/5/7/570804_5m.jpg

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.182.102.223 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

c00fd1fce75f8aaf02c223b7140caf4b537e7c5660c7bba78a63d799baaf5cbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 07 Feb 2022 09:22:50 GMT
server: XO.webservantpro
etag: "6200e4ea-2995"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=17280000
accept-ranges: bytes
content-length: 10645
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 570832_1m.jpg
cdnt.onnetwork.tv/poster/5/7/ 21 KB
21 KB 263ms
155ms Image
image/jpeg 217.182.102.223
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnt.onnetwork.tv/poster/5/7/570832_1m.jpg

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.182.102.223 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

971ee47efa3517204e4cf69c23c891f00cb2da7e88fd3381e5b6e12ccbb113b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 07 Feb 2022 09:41:25 GMT
server: XO.webservantpro
etag: "6200e945-542b"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=17280000
accept-ranges: bytes
content-length: 21547
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 570840_5m.jpg
cdnt.onnetwork.tv/poster/5/7/ 26 KB
26 KB 426ms
318ms Image
image/jpeg 217.182.102.223
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnt.onnetwork.tv/poster/5/7/570840_5m.jpg

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.182.102.223 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

c3eefd5595d59072bfa4e2fe0f26df33c1013b7eeb3f1176c0b411b14c14f8df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 07 Feb 2022 09:47:37 GMT
server: XO.webservantpro
etag: "6200eab9-6803"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=17280000
accept-ranges: bytes
content-length: 26627
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 570858_5m.jpg
cdnt.onnetwork.tv/poster/5/7/ 29 KB
30 KB 426ms
318ms Image
image/jpeg 217.182.102.223
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnt.onnetwork.tv/poster/5/7/570858_5m.jpg

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.182.102.223 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

43f7beebc22497f827ada6ee9c1f2e5b84264621a69bd47c9130709f3ce47f13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 07 Feb 2022 09:58:20 GMT
server: XO.webservantpro
etag: "6200ed3c-751e"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=17280000
accept-ranges: bytes
content-length: 29982
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 embed.php Show response
video.onnetwork.tv/ 3 KB
1 KB 66ms
66ms Script
text/javascript 178.33.138.136
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://video.onnetwork.tv/embed.php?mid=NTcwODE0LDE2eDksMyw1MCwyNTU3LDk3ODQsMSwwLDIsNTAsMCwwLDIsMCwxLDEsMCwwLDQsMCwwLDAsMCwwLDAsMywxLC0xOy0xOzIwOzIwO0JSOzIwOzIwOzIwOzU2LDAsMCwwLDAsMCwwOzA7MDswOzA7MDswLDA=&iid=1683217821124&cId=pid1683217821124&widget=808

Requested by

Host: video.onnetwork.tv
URL: https://video.onnetwork.tv/widget/widget_scrolllist.php?widget=808

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.33.138.136 , France, ASN16276 (OVH, FR),

Reverse DNS

vh11.eris-n.of.pl

Software

XO.webservant /

Resource Hash

3df56ea00c86b31023aa16131650bba9f9bebcf3f53c180f47f8463a4c3135f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 04 May 2023 16:30:21 GMT
last-modified: Thu, 04 May 2023 16:30:20 GMT
server: XO.webservant
vary: Accept-Encoding
p3p: CP="ALL CAO DSP COR IVD IVA PSD PSA TEL TAI CUS ADM CUR CON SAM OUR IND"
content-type: text/javascript;charset=utf-8
cache-control: no-store, no-cache, must-revalidate, post-check=1, pre-check=1
feature-policy: fullscreen *; autoplay;
content-length: 1357
expires: Thu, 04 May 2023 16:30:20 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
344 B 144ms
48ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-15082559-23&cid=151210928.1683217821&jid=1679198095&gjid=556489692&_gid=45536344.1683217821&_u=YEBAAUAAAAAAACAAI~&z=133415302

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 04 May 2023 16:30:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 embed.min.js Show response
cdn.onnetwork.tv/js/player90/ 77 KB
25 KB 51ms
50ms Script
application/javascript 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onnetwork.tv/js/player90/embed.min.js?s=1683212733

Requested by

Host: video.onnetwork.tv
URL: https://video.onnetwork.tv/embed.php?mid=NTcwODE0LDE2eDksMyw1MCwyNTU3LDk3ODQsMSwwLDIsNTAsMCwwLDIsMCwxLDEsMCwwLDQsMCwwLDAsMCwwLDAsMywxLC0xOy0xOzIwOzIwO0JSOzIwOzIwOzIwOzU2LDAsMCwwLDAsMCwwOzA7MDswOzA7MDswLDA=&iid=1683217821124&cId=pid1683217821124&widget=808

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.165.21.156 , France, ASN16276 (OVH, FR),

Reverse DNS

server-108-138-4-150.fra56.r.cloudfront.net

Software

XO.webservantpro /

Resource Hash

afa4d3776b0dd4b239e247db35499054a4b90e50f871040fe0716c088f5191e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sharemods.com/
Origin: https://sharemods.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 04 May 2023 15:05:33 GMT
server: XO.webservantpro
etag: W/"6453c9bd-1331c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=17280000, public
expires: Mon, 20 Nov 2023 16:30:21 GMT

GET
H2 200 a_cntg.png
cdn.onnetwork.tv/cnt/ 126 B
332 B 159ms
60ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntg.png?ts=1683217821399&d=9784&wsc=00&typ=embed&mobile=0&c=43
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
last-modified: Thursday, 04-May-2023 16:30:21 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 39ms
39ms XHR
application/json 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsharemods.com&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 008161c189e893c7422b3220bdcccd7ce8709a55fff6d6fa17dbc572040c6c9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 14:56:13 GMT
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
age: 5647
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://sharemods.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 3606
x-amz-cf-id: g6n03VvuGNLvuyRDHRRbssUbSxeWgjHPepdMIAR6hR0AurAAT50y-Q==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
462 B 221ms
87ms XHR
text/javascript 108.138.4.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&pid=YKpHQIlWrkQ54&cb=0&ws=1600x1200&v=23.426.459&t=500&slots=%5B%7B%22sd%22%3A%22sharemods_com_980x250%22%2C%22s%22%3A%5B%22970x250%22%2C%22728x90%22%2C%22970x90%22%2C%22980x200%22%2C%22980x250%22%5D%2C%22sn%22%3A%22%2F147246189%2C21696195204%2Fsharemods.com_980x250%22%7D%2C%7B%22sd%22%3A%22sharemods_com_970x250_2%22%2C%22s%22%3A%5B%22970x250%22%2C%22728x90%22%2C%22980x200%22%2C%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F147246189%2C21696195204%2Fsharemods.com_970x250_2%22%7D%2C%7B%22sd%22%3A%22sharemods_com_970x250_3%22%2C%22s%22%3A%5B%22970x250%22%2C%22980x200%22%2C%22728x90%22%2C%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F147246189%2C21696195204%2Fsharemods.com_970x250_3%22%7D%5D&schain=1.0%2C1!setupad.com%2C125%2C1%2C%2C%2C&pubid=d14c8d3d-c09a-40c7-8c08-b5d7cd1d7fac&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.150 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 b4bf06ec43f99543c974d975a6c597da.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: XYA88EASMVG419T5DDE9
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://sharemods.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: o450pzBePKqTv6SoLIIJadYEYh0IQNySUybTQJJw6WXo--q1VLOqDQ==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 120ms
40ms XHR
application/javascript 108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

x-amz-version-id: ZtsI5FMPcYjgnUSe6fFwOoK3szNfqbqS
content-encoding: gzip
via: 1.1 c0c6d7afa25d841027d75444425d2010.cloudfront.net (CloudFront)
date: Wed, 03 May 2023 23:52:29 GMT
x-amz-cf-pop: FRA56-P6
age: 60151
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 27 Apr 2023 23:46:51 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: IMcIYpssmMWLFKdKv5LAh_dVvMj2vEBAnW6uH4sFnEnIacRSMjP3Xw==

POST
H3 200 7c2220b22ea419ad Show response
sharemods.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 65E2 2 B
618 B 67ms
64ms XHR
text/plain 104.26.10.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sharemods.com/cdn-cgi/challenge-platform/h/g/cv/result/7c2220b22ea419ad
Requested by: Host: sharemods.com
URL: https://sharemods.com/cdn-cgi/challenge-platform/scripts/invisible.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.10.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cln1zjDjxpeKnicu6%2FA0knRJFl7aATvnIpGy58siST1Zbhkg5DUiwH%2F1z8hsqoGi9UTzX1BRWel4ZpEGY5RKW%2BOyAigPbNNXOT5yRwHHgaCmv84aLDcqZNymq3cXc90%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7c2220b8af443827-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 370ms
117ms Preflight 44.206.92.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.92.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-92-231.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://sharemods.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Thu, 04 May 2023 16:30:21 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 213ms
42ms Script
application/javascript 23.215.22.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-22-18.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "38c0-5e92054540ea5-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 5252
expires: Thu, 04 May 2023 16:45:21 GMT

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 213ms
43ms Script
application/javascript 23.215.22.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-22-18.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Thu, 04 May 2023 16:45:21 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 38 KB
12 KB 223ms
114ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b4a0aeb3f2db12edff7b757d79dc72c1964f48040a73651ca0e6f24c775f1264

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 00:30:12 GMT
content-encoding: gzip
via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 00:13:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 57610
x-amz-server-side-encryption: AES256
etag: W/"dc01f342ec44b3f8f5767d7b93fe1ac8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: x_wIyZASrL26k5Bu1lQWw9LXyDWIxtPII3XpLT2er0WEtLE1mJ8tiA==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 391ms
58ms Script
application/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&ref=&_it=amazon&partner_id=533
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f329a0d3e082589a14177df4778b45ea8cb3826ce3b945fcbb0721baca5825

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 18 Nov 2022 10:57:44 GMT
server: cloudflare
x-amz-request-id: HCP18NGB747326Q9
age: 2449
etag: W/"2280e2148e4ee3c06f679f8fac039778"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7c2220badbce2bcb-FRA
x-amz-id-2: KbZ9NgFa2bn0C9xZwnKlp+RVzQg9EzsqAoZhIJmzk7In/Z4ogbyP1rORTM78n9zoUbgos2ctSt8=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 174ms
63ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0325b6c9e68ae3f6ec25f6817b4daef364bd99c2ff5f04588fd6f956bf983b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: 9Q7EVAR423JQ6AAJ
age: 363
etag: W/"b58faeda0c1d193bc50dd25a7640d8ba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c2220b97f1b3820-FRA
x-amz-id-2: HmUf+GCCKXI/yHvrr6D/mRmwlqbg0bGRnl3PvHyUL7FgC6egL1tGjNzZdXmGbHiIFvkx4BMS36g=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
459 B 121ms
120ms XHR
text/plain 44.206.92.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.92.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-92-231.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Thu, 04 May 2023 16:30:21 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 a_cntg.png
cdn.onnetwork.tv/cnt/ 126 B
331 B 59ms
58ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntg.png?ts=1683217821556&d=9784&wsc=00&typ=embed&mobile=0&c=40
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
last-modified: Thursday, 04-May-2023 16:30:21 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 41ms
41ms Script
application/javascript 23.215.22.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-22-18.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
server: Apache
etag: "c4b6-5e920545406d3-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17042
expires: Thu, 04 May 2023 16:45:21 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
332 B 177ms
58ms XHR
application/json 34.246.24.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.24.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-24-167.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: c7758abdf4b1ba2efe785226dfe65896f7bb5ecedd0225c571851fdfcf2e91d0

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://sharemods.com
cache-control: no-cache
x-server: 10.45.6.183
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 139ms
51ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=sharemods.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 137ms
48ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=sharemods.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 250 KB
67 KB 566ms
566ms XHR
text/plain 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=125135119191809&correlator=391882171883965&eid=31074114%2C31074171%2C31074243%2C31074272%2C31074314&output=ldjh&gdfp_req=1&vrg=202305030101&ptt=17&impl=fifs&iu_parts=147246189%3A21696195204%2Csharemods.com_970x250_2%2Csharemods.com_980x250%2Csharemods.com_970x250_3%2Csharemods.com_interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=970x250%7C728x90%7C980x200%7C336x280%7C300x250%2C970x250%7C728x90%7C970x90%7C980x200%7C980x250%2C970x250%7C728x90%7C980x200%7C336x280%7C300x250%2C1x1&ifi=1&adks=605329121%2C3771485005%2C1413971331%2C3462287164&didk=122412821~587753367~122412822~2009814026&sfv=1-0-40&ists=1&fas=0%2C0%2C0%2C8&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=origin%3Ddirect%26ECT%3D4g%26hb_rf%3D0&sc=1&cookie_enabled=1&abxe=1&dt=1683217821800&lmt=1683217821&dlt=1683217820639&idt=569&adxs=315%2C220%2C315%2C-9&adys=567%2C339%2C649%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C-1&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&frm=20&vis=1&psz=970x0%7C1160x0%7C970x0%7C0x-1&msz=970x0%7C1160x0%7C970x0%7C0x-1&fws=4%2C4%2C4%2C2&ohw=1600%2C1600%2C1600%2C0&ga_vid=151210928.1683217821&ga_sid=1683217822&ga_hid=722352449&ga_fc=true&cbidsp=CpUDCAEyBnY2LjYuMBIdCglhZGZvcm1TMlNSCWFkZm9ybVMyUxD6ASADOAISHwoKcnViaWNvblMyU1IKcnViaWNvblMyUxD6ASADOAISGQoIcHVibWF0aWNSCHB1Ym1hdGljEIECIAISGQoIYXBwbmV4dXNSCGFwcG5leHVzEPcBIAISGQoIcnRiaG91c2VSCHJ0YmhvdXNlEPMBIAISIwoNc21hcnRhZHNlcnZlclINc21hcnRhZHNlcnZlchD0AyADEhUKBm9uZXRhZ1IGb25ldGFnEPIBIAISFwoHcnViaWNvblIHcnViaWNvbhCYAiACEh0KCmx1cG9ubWVkaWFSCmx1cG9ubWVkaWEQ-gEgAhIdCgpwdWxzZXBvaW50UgpwdWxzZXBvaW50EJkDIAISFQoGY3JpdGVvUgZjcml0ZW8Q8wEgAhIbCglhZHlvdWxpa2VSCWFkeW91bGlrZRD1ASACGAIiJDJlOGVjOTUzLTAzOGQtNGU3Ni05ODJhLWUyODI2NWVmY2UxNCoECAMgAEoAQPoB~CpUDCAEyBnY2LjYuMBIdCglhZGZvcm1TMlNSCWFkZm9ybVMyUxD6ASADOAISHwoKcnViaWNvblMyU1IKcnViaWNvblMyUxD6ASADOAISGQoIcHVibWF0aWNSCHB1Ym1hdGljEIECIAISGQoIYXBwbmV4dXNSCGFwcG5leHVzEPcBIAISGQoIcnRiaG91c2VSCHJ0YmhvdXNlEPMBIAISIwoNc21hcnRhZHNlcnZlclINc21hcnRhZHNlcnZlchD0AyADEhUKBm9uZXRhZ1IGb25ldGFnEPIBIAISFwoHcnViaWNvblIHcnViaWNvbhCYAiACEh0KCmx1cG9ubWVkaWFSCmx1cG9ubWVkaWEQ-gEgAhIdCgpwdWxzZXBvaW50UgpwdWxzZXBvaW50EJkDIAISFQoGY3JpdGVvUgZjcml0ZW8Q8wEgAhIbCglhZHlvdWxpa2VSCWFkeW91bGlrZRD1ASACGAIiJDc1YmFkYzE1LTU1ZTctNGI2MC04Njk2LWFmOTU5ZGRlOTZhNyoECAMgAEoAQPoB~CugCCAEyBnY2LjYuMBIfCgpydWJpY29uUzJTUgpydWJpY29uUzJTEPoBIAM4AhIZCghwdWJtYXRpY1IIcHVibWF0aWMQgQIgAhIZCghhcHBuZXh1c1IIYXBwbmV4dXMQ9wEgAhIZCghydGJob3VzZVIIcnRiaG91c2UQ8wEgAhIjCg1zbWFydGFkc2VydmVyUg1zbWFydGFkc2VydmVyEPQDIAMSFQoGb25ldGFnUgZvbmV0YWcQ8gEgAhIXCgdydWJpY29uUgdydWJpY29uEJgCIAISHQoKbHVwb25tZWRpYVIKbHVwb25tZWRpYRD6ASACEg8KA2FteFIDYW14EOwBIAISFQoGY3JpdGVvUgZjcml0ZW8Q8wEgAhIbCglhZHlvdWxpa2VSCWFkeW91bGlrZRD1ASACGAIiJDYzNWJkOThkLTVmZDYtNGNjYy1hOGExLTM3NDZiYTc5NWM3ZioECAMgAEoAQPoB~

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73d77e277748c3390518d1d9cc3a50e418d863711aff540a2efcc6720881904a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68974
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sharemods.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 02C4 6 KB
3 KB 193ms
49ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:21 GMT
expires: Fri, 03 May 2024 16:30:21 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/ 36 KB
12 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl_page_level_ads.js?cb=31074314

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71c437943f2d7aeaa09aa51e12e7244d3bdf38e7a51fe0940c98c20ddca6053a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 19:39:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 75079
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12729
x-xss-protection: 0
server: cafe
etag: 10236394106377334640
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 02 May 2024 19:39:02 GMT

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 184ms
92ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

78cf7f92ec9841d3afea2c9db9cc22e4ff8acc52bee7060b50a28a71cb262093

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:13:32 GMT
server: nginx
etag: W/"642e8d3c-15c1d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 05 May 2023 16:30:21 GMT

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
395 B 186ms
47ms XHR
application/json 2a02:fa8:8806:12::1460
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1460 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:21 GMT
server: nginx
vary: Origin
content-type: application/json
access-control-allow-origin: https://sharemods.com
cache-control: max-age=1800
access-control-allow-credentials: true
content-length: 190
expires: Thu, 04 May 2023 17:00:21 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 98 B
287 B 145ms
145ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=sharemods.com&url=https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&ref=&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0fbf870cdc01d0a6280eaa1ed2f2ae04f4d09bdac39bd094798c6fb6ad2c0d1

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 7c2220bcef7992a5-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 246ms
134ms Preflight
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=533&sync=0&domain=sharemods.com&url=https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://sharemods.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 7c2220bc0ec392a5-FRA
content-length: 0
content-type: application/json
date: Thu, 04 May 2023 16:30:22 GMT
debug: OPTIONS block
expires: Fri, 03 May 2024 16:30:22 GMT
server: cloudflare

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 197 KB
58 KB 42ms
40ms Script
application/javascript 23.215.22.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-22-18.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: bf5b5a4196e2df193d794a6e8b0228e41b49e6bcc4531179b8ed8d5293300586

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
last-modified: Thu, 13 Oct 2022 18:23:24 GMT
server: Apache
etag: "31332-5eaee9adb933b-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 59461
expires: Thu, 04 May 2023 16:45:22 GMT

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 183ms
91ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

78cf7f92ec9841d3afea2c9db9cc22e4ff8acc52bee7060b50a28a71cb262093

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 06 Apr 2023 09:13:32 GMT
server: nginx
etag: W/"642e8d3c-15c1d"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 05 May 2023 16:30:22 GMT

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 109 KB
35 KB 177ms
45ms Script
application/x-javascript 143.204.89.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-24.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9dd295f1b8047318855e74e81dbeb02d463452670f2997dd64764a6ad88f3884

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

x-amz-version-id: FdZQKnEndO3mqmnRp7XQ3uMfeJERmMlw
content-encoding: br
via: 1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront)
date: Thu, 04 May 2023 02:44:15 GMT
x-amz-cf-pop: FRA50-C1
age: 49568
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:96f94076-69de-4a4b-8bd0-6fb739c06860
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-md5: e16bd58aa55fcc98af3b10870aad5974
last-modified: Thu, 19 Jan 2023 10:03:36 GMT
server: AmazonS3
etag: W/"0820c3a8da5dbe428619a7328c53b95f"
vary: Accept-Encoding
content-type: application/x-javascript
x-amz-meta-codebuild-content-sha256: 3efbae2e7f7f574316dfc685479946d213531c0b483ab4a61e653a0088f0cae8
cache-control: must-revalidate,public,max-age=86400
x-amz-cf-id: 8aAHCddspkLKIC2mUFCVa3GiFLvTG21WgjP235Pm9MT1O00RT8Fm0Q==

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 183ms
90ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202305030101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc2f8f252f43d89b70888702513c0a2c42640c05952eba5122cde5e3a16d2846

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11292
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame CCB3 15 KB
6 KB 46ms
46ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=sharemods.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3014acc16bf3744b41bb869785bf686290d9834a5e6f69d4583c4e39fca26bff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 449924
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 533 Show response
a.ad.gt/api/v1/u/matches/ 11 KB
4 KB 154ms
53ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/533?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&ref=&_it=amazon&partner_id=533
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25e9788b47548e2bc40fa32cac139f5f6c96acedb6cb36e31510c2d61bb12e65

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 04 May 2023 16:25:23 GMT
server: cloudflare
age: 299
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 7c2220be6d39697b-FRA

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 2 KB
2 KB 170ms
40ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3b89401fea631023de67ae75bf8f246b1af109a9a4247c3862016949eacc462b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:11:54 GMT
via: 1.1 google
age: 1108
x-guploader-uploadid: ADPycdtW_dkF7ZWzTtDfP3HyPEw6vMHslFwxeKGNdRms1nQJuRBtx9NLkZQXlfc4NUFAPcdmtOebi5Ygvdjpm2yMhtOOo2JCoREd
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1938
last-modified: Thu, 27 Apr 2023 19:53:17 GMT
server: UploadServer
etag: "0a4a90264145ed4c5c647dae5dfb0429"
x-goog-generation: 1682625197861193
x-goog-hash: crc32c=jhvysQ==, md5=CkqQJkFF7UxcZH2uXfsEKQ==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 1938
accept-ranges: bytes
expires: Thu, 04 May 2023 17:11:54 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 59ms
59ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-9c21"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 05 May 2023 16:30:22 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 45ms
44ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cf4fc9350f69e442ebfdf130d4e601377e9273b642282a1ebb4f79d6116e8c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 00:30:12 GMT
content-encoding: gzip
via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 00:14:05 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 57611
x-amz-server-side-encryption: AES256
etag: W/"37e703da55f96b973658b8e7aeed0e93"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: O1PoRU5Y9HeGYMcarcaOv-X4-DmbR4bk10fexowBMX6xkvIFhYlmFQ==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 224ms
39ms Script
text/javascript 2600:9000:2250:ce00:a:e047:752:b361
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:ce00:a:e047:752:b361 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 00:14:10 GMT
Via: 1.1 90bb130ecccb71953b38a1c0e3b5721a.cloudfront.net (CloudFront)
Last-Modified: Thu, 04 May 2023 00:14:06 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P2
Age: 58573
ETag: "4d5acbf33f4a0592ac0515db92fe88e6"
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1858
X-Amz-Cf-Id: Av6XpZSOvwd6mVVhvcAdh4Q6qAEB73U50nWtL-O3f4I210zGOT8F9g==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 142ms
39ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 19 Apr 2023 15:58:01 GMT
content-encoding: gzip
age: 1297941
x-guploader-uploadid: ADPycdsuws19q6gut2HVw5Cbtoy2R9nMFWEkfsW4j28cg71BlAh_maBVLR9J0a9wek9aI3l80Gjw2adcfLZSJ2do6Qt7pQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 18 Apr 2024 15:58:01 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 59 KB
17 KB 50ms
49ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d961a31d3d2fdb93a35a4024f9878b2ed896cd86a084ceb8df6af3bc53e29125

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: RJG8P9KGT25NARJA
age: 2067
etag: W/"110f0c3c343ee36404c8a2300f4755c3"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c2220be0ce03820-FRA
x-amz-id-2: p9caGrESjWYwkHsxUB/95tSAMOAWdfigQO7CUyIVO+HkWK6LxeSkGY+AhjJC0xfpQ02CliLtx7w=

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 85ms
40ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

QUIC, , AES_256_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
age: 12612
x-jsd-version: master
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 732
x-served-by: cache-fra-eddf8230087-FRA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 container.html Show response
7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8CC9 6 KB
3 KB 41ms
40ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:21 GMT
expires: Fri, 03 May 2024 16:30:21 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sid Show response
mug.criteo.com/ Frame CCB3
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=sharemods.com&sn=ChromeSyncframe&so=0&topUrl=sharemods.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=wLK9uXxiNHg5TW5RZU5acHpiT09GeCt5Y3RIV1pMdmFSellJckNPWjF5eDNaZTViTmJXelppcHpIWnozUCt6T1hjTEFnUE1pcFlZR2hlUVBTZm5BVHZGVmNsNy9sZ1JIanZydTFrcmhuTnQ4dUZuVXJBejNDM3FoR3FIWT...

451 B
655 B

239ms
43ms

Fetch
application/json

178.250.1.11
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=wLK9uXxiNHg5TW5RZU5acHpiT09GeCt5Y3RIV1pMdmFSellJckNPWjF5eDNaZTViTmJXelppcHpIWnozUCt6T1hjTEFnUE1pcFlZR2hlUVBTZm5BVHZGVmNsNy9sZ1JIanZydTFrcmhuTnQ4dUZuVXJBejNDM3FoR3FIWTVCMVJaOXZ0dHhqaXd3SVJzRTBrZmwxekpsaGRtRy9HN2VkRERVaGNjeHBxQjBVN0FzblI1eDhRNFpqcGdTdjFjSHhpdEVQajJlOHlPcGQ4WTNhdHBzVHZ5L05qOG8yK3pMNmxOb2hBZHUrU1dsdGE5SEpnOHdRNjFsZU1oRXdnVmVsbkRlKzRXaTAxbUVLeWczZFRIYWpPOUl5bldEdz09fA&cppv=2

Protocol

Server

178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ee4f531587fca07b69b0fbece9dce1dc00f4641aa133ee812a7b51a1246ad19a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1439422
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:21 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=wLK9uXxiNHg5TW5RZU5acHpiT09GeCt5Y3RIV1pMdmFSellJckNPWjF5eDNaZTViTmJXelppcHpIWnozUCt6T1hjTEFnUE1pcFlZR2hlUVBTZm5BVHZGVmNsNy9sZ1JIanZydTFrcmhuTnQ4dUZuVXJBejNDM3FoR3FIWTVCMVJaOXZ0dHhqaXd3SVJzRTBrZmwxekpsaGRtRy9HN2VkRERVaGNjeHBxQjBVN0FzblI1eDhRNFpqcGdTdjFjSHhpdEVQajJlOHlPcGQ4WTNhdHBzVHZ5L05qOG8yK3pMNmxOb2hBZHUrU1dsdGE5SEpnOHdRNjFsZU1oRXdnVmVsbkRlKzRXaTAxbUVLeWczZFRIYWpPOUl5bldEdz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 436740
content-length: 0
expires: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/032304262219000/ Frame 9C8F 222 KB
61 KB 150ms
40ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032304262219000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80c05820e285233345f554a3df4126a2730cfd3e4aa06f5fabe1ba715cd79f12

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 May 2023 22:41:55 GMT
age: 150507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61815
x-xss-protection: 0
server: sffe
etag: "de7be9f62a430d4f"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 May 2024 22:41:55 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/032304262219000/v0/ Frame 9C8F 15 KB
5 KB 219ms
109ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032304262219000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a39d28f78d96f29523eee3db2d6657e6436565fb175a70e6c84c3106c53dde20

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 May 2023 22:41:55 GMT
age: 150507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5222
x-xss-protection: 0
server: sffe
etag: "4fd619331b8f64df"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 May 2024 22:41:55 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/032304262219000/v0/ Frame 9C8F 94 KB
28 KB 225ms
116ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032304262219000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

004dccc422f9d07025eb214e959cea7b998666e94fb15d5d254d7c581063d680

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 May 2023 22:41:55 GMT
age: 150507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28884
x-xss-protection: 0
server: sffe
etag: "6451d33588c99856"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 May 2024 22:41:55 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/032304262219000/v0/ Frame 9C8F 5 KB
2 KB 239ms
129ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032304262219000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0fa2fafb5adcf4a630ac19299166f2db7fad934b4c00be42447afbba5c36c852

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 May 2023 22:41:55 GMT
age: 150507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1906
x-xss-protection: 0
server: sffe
etag: "83933b769a9f5701"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 May 2024 22:41:55 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/032304262219000/v0/ Frame 9C8F 40 KB
13 KB 240ms
131ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032304262219000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5b19727f965f05638f8fbb07196eb4aaae8722e495c7d38dc1815e676178831

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 02 May 2023 22:41:55 GMT
age: 150507
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12938
x-xss-protection: 0
server: sffe
etag: "3f9bab308b30f46e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 01 May 2024 22:41:55 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9C8F 9 KB
1018 B 56ms
52ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 04 May 2023 14:34:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H2 200 container.html Show response
7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4EB2 6 KB
3 KB 40ms
39ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:21 GMT
expires: Fri, 03 May 2024 16:30:21 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 164B 6 KB
3 KB 42ms
42ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:21 GMT
expires: Fri, 03 May 2024 16:30:21 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9C8F 2 KB
3 KB 171ms
81ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 63969
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Thu, 04 May 2023 22:44:13 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9C8F 295 B
399 B 173ms
83ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 68914
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Thu, 04 May 2023 21:21:48 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9C8F 0
0 84ms
84ms Image
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C0BsSnd1TZKKMOfuA7_UP96OQ4A7Y7P_Nb-b3tYOEEZeinZm2OhABII3kvSlglYKFgpgHoAGk3ZqLA8gBAeACAKgDAcgDCqoEngJP0NaV339RtFGJxw4vg_4LAgyiQIDZ2eepT41whdsq7X9LaMBo0kwyM5xPFb5jlK-7GeYkq4HLUvs7-6ZUCJOq-ld0NSrpXYtmvL2q0xo6C_bvN8nZetySuycO7VFNQxDyTVvIYgfu1lsNeSksJfs-LsM3JW3ldobH2ZQ-4yZrXCmaYa45bNtl_TT_aMZp576oZEnhQdckBdni0GgGI-yiPuODDViV9UqJamRPRVrHHGRMGapENGlhnbQ5bXycm_BHoy6KnjI_wdRyVffGWXdyfVxHCwmULrEJhMLHQP1ZVT-WZZzyi0ihISw1XSVvUH6OSxJ551byoKRiQllX0ybZGjRd_8BQXmMIcDGwgOY24c4uoITJbrypLE1qYaomwASh_dyo7gPgBAGSBQQIBBgBkgUECAUYBIAHxKLldKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEENKcGNIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTE3OTM5MjE0MzU1NTQ5MTmACgPICwHYEwyIFALQFQGAFwGyFx4KHAgAEhRwdWItMzk3MDI3NzUzNTUyODYxMxiV4h8&sigh=pg4Q8LZ8e54&uach_m=[UACH]&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
209 B 131ms
40ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 9C8F 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 352cccba180eb4f823e9534f92586c8dfe11079579b0c2abea5f4915b548e28c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DDC4 624 B
504 B 175ms
87ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGIXhnOEBMAE&v=APEucNVQWduvjSr-HFGTvQfCKo_s6p_RM8T_bz9eQe05adQuXHO10I68Ims-XQUQ9YZ4nHN9j_K9z3z95XCnZOkW6-O3WyN9rI8zvfNouoT8eIGBdiy5Bg5OIEPcn4MRPC0RQF78Q04Yydn170XOM9vdg1hCMoWPPvNq9EdeiykLFGMKFP_CVnLga-AqEN4aKahviYcvFPOmJ7OLHNFeJpC4NNbfCm2egA

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:22 GMT
expires: Thu, 04 May 2023 16:30:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8CC9 78 KB
28 KB 188ms
102ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CC9 42 B
110 B 227ms
142ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AMnRNYZf_viG9Tb5tWVIpA9Tjdn9De83TiVBLQ6q-4gQRFGdO3D6Jo4p7nOyjuzSLofvApeCfdnB4Q09nkLuaF3Ud0egXcm3DChDKDyO-whXbh5RU

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CC9 0
121 B 226ms
142ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4364319810599599318&x=1&ct=77

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ad.php Show response
www.usemax.de/ Frame 8CC9 5 KB
3 KB 153ms
40ms Script
text/html 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/ad.php?w=99883&wf=7&wf_w=300&wf_h=250&umcid=7280&campaign_o=50005&iframe=1&subid=19686216648&cachebuster=1683217821935457&click_c_enc=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=C2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB&ae=1&num=1&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&sig=AOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw&client=ca-pub-7383171830614216&dbm_c=AKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw&cry=1&dbm_d=AKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA&adurl=
Requested by: Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: 90384722fc0d85853350c69b624f87cfbf77c109285c1ff3a584ba2864db5f97

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:22 GMT
Content-Encoding: gzip
Server: Apache/2.4
Vary: Accept-Encoding
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
Content-Type: text/html
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Connection: Keep-Alive
Keep-Alive: timeout=3, max=70
Content-Length: 2530
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 8CC9 3 KB
1 KB 107ms
50ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/window_focus_fy2021.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 09:18:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 18 May 2023 09:18:53 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 8CC9 19 KB
8 KB 97ms
39ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0be8ceb2d04986e171369b3adac55b939dd5aa721857190ed77868420c95b59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 17:56:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7943
x-xss-protection: 0
server: cafe
etag: 8166942304926428282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 17:56:47 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8CC9 534 KB
111 KB 147ms
48ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f27179d920ffa620f75766771bfedbf0cd34f0b81af42125cbd5a6fed8ea0399

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112655
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683113006724128"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
322 B 122ms
41ms XHR
text/plain 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sharemods.com
date: Thu, 04 May 2023 16:30:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
331 B 57ms
57ms XHR
application/json 34.246.24.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.246.24.167 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-246-24-167.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2c2de67a4ccd3862bbd6dc2a27b45ed9fc72cb7337b115066ffde53a3f66a7bc

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://sharemods.com
cache-control: no-cache
x-server: 10.45.6.183
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FD7D 624 B
825 B 147ms
81ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGNHlnOEBMAE&v=APEucNUB3gV_sDvgFsckrlyyagGPWXL98OK704vRJXOsnRR5XMAusvElQil_1cZzKig3xRxuHmU62evhpSKUUEA6WpYyZZ5HJCAU9Z83G0qSKmvIzAX7nnLhljMhAT7j0b9mjC-_PgNen6lg-vuqxgEhX9-DlQoIT-4TqwV0l5MBEEZNnyXqwOOj6Ep9sIeoFZWCWjX6rpUp_UmvfbX-vSpoJTEwQsxVPw

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:22 GMT
expires: Thu, 04 May 2023 16:30:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4EB2 78 KB
27 KB 176ms
95ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EB2 42 B
63 B 221ms
142ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DnRVtaIUBZ00W8nZh9ouo-5JxEVWPKHPA7No1Ke3iRon6IAWMkOLo88xTieIqtx0mhHjm5LFeTyZ0Q6v4pfxJp8WWJqSZUzJXQbkCbefT3INn6E-A

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EB2 0
20 B 220ms
140ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17416845490826622617&x=1&ct=77

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ad.php Show response
www.usemax.de/ Frame 4EB2 5 KB
3 KB 135ms
41ms Script
text/html 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/ad.php?w=99883&wf=7&wf_w=970&wf_h=250&umcid=7319&campaign_o=50005&iframe=1&subid=19686280044&cachebuster=1683217821935459&click_c_enc=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB&ae=1&num=1&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&sig=AOD64_0WMAJUAXcyzDGmBSfo55W44gYlag&client=ca-pub-7383171830614216&dbm_c=AKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc&cry=1&dbm_d=AKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw&adurl=
Requested by: Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: cfc8ab9c987f0bd52c711d53b37eb3fab16fd7940670b51ab92621968760b653

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:22 GMT
Content-Encoding: gzip
Server: Apache/2.4
Vary: Accept-Encoding
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
Content-Type: text/html
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Connection: Keep-Alive
Keep-Alive: timeout=3, max=70
Content-Length: 2534
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 4EB2 3 KB
1 KB 87ms
51ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/window_focus_fy2021.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 09:18:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 18 May 2023 09:18:53 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 4EB2 19 KB
8 KB 79ms
44ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0be8ceb2d04986e171369b3adac55b939dd5aa721857190ed77868420c95b59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 17:56:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7943
x-xss-protection: 0
server: cafe
etag: 8166942304926428282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 17:56:47 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4EB2 534 KB
110 KB 250ms
173ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f27179d920ffa620f75766771bfedbf0cd34f0b81af42125cbd5a6fed8ea0399

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112655
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683113006724128"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v46/ Frame 9C8F 29 KB
29 KB 41ms
41ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v46/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45a61a04904fc2115c440a349a65dc93d2965b0b24dc5a8172bd8b792bdbf103

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sharemods.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:26:30 GMT
x-content-type-options: nosniff
age: 410632
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29728
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 16:59:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Apr 2024 22:26:30 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 115ms
98ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305030101/pubads_impl.js?cb=31074314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 164B 5 KB
659 B 50ms
50ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

831997ce334905a4fc3c7f0673c30bd34701f9810d87b19335aea228804ae38a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 04 May 2023 15:16:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1D3A 9 KB
921 B 50ms
49ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 04 May 2023 15:08:39 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 1D3A 2 KB
819 B 97ms
96ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 17:56:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 17:56:47 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/ Frame 1D3A 22 KB
9 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/abg_lite_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d25d283cffb27454f0defc451d2f1d42ea8ce681aa56a395817871b895420cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 17:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81264
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8767
x-xss-protection: 0
server: cafe
etag: 1250930375877819641
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 17:55:58 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 1D3A 3 KB
1 KB 97ms
96ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/window_focus_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 09:18:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25889
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 18 May 2023 09:18:53 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/ Frame 1D3A 19 KB
8 KB 83ms
82ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0be8ceb2d04986e171369b3adac55b939dd5aa721857190ed77868420c95b59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 17:56:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7943
x-xss-protection: 0
server: cafe
etag: 8166942304926428282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 17:56:47 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1D3A 534 KB
110 KB 160ms
118ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f27179d920ffa620f75766771bfedbf0cd34f0b81af42125cbd5a6fed8ea0399

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112655
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683113006724128"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H2 200 dc885651c24f3a38cf2b2dda4c5c7197.js Show response
www.gstatic.com/mysidia/ Frame 1D3A 32 KB
14 KB 127ms
40ms Script
text/javascript 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dc885651c24f3a38cf2b2dda4c5c7197.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14c77f954be37da1e7fba8efd1279e7ece7e384d33b8375d6e6a1ce013daaf47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Tue, 02 May 2023 00:42:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 229657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13586
x-xss-protection: 0
last-modified: Thu, 27 Apr 2023 20:09:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 31 Jul 2023 00:42:45 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230502/r20110914/elements/html/ Frame 164B 19 KB
8 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230502/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0761599a569a3a6c03de9e05afc2cf135fb6581abb26c89b3615f46988b31fad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Wed, 03 May 2023 18:09:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80426
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8031
x-xss-protection: 0
server: cafe
etag: 4566461469134147509
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 17 May 2023 18:09:56 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 164B 205 B
294 B 132ms
50ms Image
image/png 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 14:29:50 GMT
x-content-type-options: nosniff
age: 7232
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 03 May 2024 14:29:50 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 164B 604 B
918 B 130ms
48ms Image
image/png 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 14:11:39 GMT
x-content-type-options: nosniff
age: 8323
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 03 May 2024 14:11:39 GMT

GET
H2 200 frame86.php Show response
video.onnetwork.tv/ 28 KB
8 KB 82ms
82ms Fetch
text/html 178.33.138.136
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://video.onnetwork.tv/frame86.php?id=ffONNP0739b18c4fe985be9e1167a24ca7fb5916832178215521&iid=1683217821124&e=1&widget=808&lang=7&onnsfonn=1&mid=NTcwODE0LDE2eDksMyw1MCwyNTU3LDk3ODQsMSwwLDIsNTAsMCwwLDIsMCwxLDEsMCwwLDQsMCwwLDAsMCwwLDAsMywxLC0xOy0xOzIwOzIwO0JSOzIwOzIwOzIwOzU2LDAsMCwwLDAsMCwwOzA7MDswOzA7MDswLDA%3D&wtop=https%253A%252F%252Fsharemods.com%252Ftdggwalircgi%252FLFS_S3_6T_setup.rar.html&apop=0&vpop=0&apopa=0&vpopa=0&cId=pid1683217821124&rrpt=%7B%22origin%22%3A%5B%22direct%22%5D%2C%22ECT%22%3A%5B%224g%22%5D%2C%22hb_rf%22%3A%5B%220%22%5D%2C%22CxSegments%22%3Anull%7D

Requested by

Host: cdn.onnetwork.tv
URL: https://cdn.onnetwork.tv/js/player90/embed.min.js?s=1683212733

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.33.138.136 , France, ASN16276 (OVH, FR),

Reverse DNS

vh11.eris-n.of.pl

Software

XO.webservant /

Resource Hash

693dad9cefcdd13b1003fa99e34b8e18eee69fb4c62d9c312d3734d7ddb41991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 04 May 2023 16:30:22 GMT
last-modified: Thu, 04 May 2023 16:30:22 GMT
server: XO.webservant
vary: Accept-Encoding
p3p: CP="ALL CAO DSP COR IVD IVA PSD PSA TEL TAI CUS ADM CUR CON SAM OUR IND"
access-control-allow-origin: https://sharemods.com
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, post-check=1, pre-check=1
feature-policy: fullscreen *; autoplay;
access-control-allow-credentials: true
expires: Thu, 04 May 2023 16:30:23 GMT

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&rid=esp&cc=1

85 B
202 B

152ms
152ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 9103f4a33e27a139f92452edb936310b19651fc926d2751f344d23bff2b1afde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-JuNJIs08dqeHJLAT0Oyz5Vq4i5s"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sharemods.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Thu, 04 May 2023 16:30:22 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://sharemods.com
location: /esp?url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
360 B 59ms
58ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: d588b45a2fe451c21b4970adf6aeb649a17cfc1738ff9697d1e39b9cd52d605f

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
via: 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 628d4ddf9a610915dc3ad8484550b848
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 142ms
54ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://sharemods.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://sharemods.com
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Thu, 04 May 2023 16:30:22 GMT
server: Google Frontend
vary: Origin
via: 1.1 google
x-cloud-trace-context: 2b6757a0dba4e5de8c496a844d81cd83

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 39CD 143 B
228 B 40ms
39ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1164
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:10:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 player86.css
cdn.onnetwork.tv/css/ Frame 5494 45 KB
11 KB 50ms
49ms Stylesheet
text/css 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onnetwork.tv/css/player86.css?s=1682023137

Requested by

Host: cdn.onnetwork.tv
URL: https://cdn.onnetwork.tv/js/player90/embed.min.js?s=1683212733

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.165.21.156 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

1367738087a6140807a1aa171ee29616ba01546e44a5ec72ee72e282f36f77c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:22 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 20 Apr 2023 20:38:57 GMT
server: XO.webservantpro
etag: W/"6441a2e1-b5d7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=17280000, public
expires: Mon, 20 Nov 2023 16:30:22 GMT

GET
H2 200 roboto.css
cdn.onnetwork.tv/css/ Frame 5494 6 KB
998 B 51ms
50ms Stylesheet
text/css 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onnetwork.tv/css/roboto.css

Requested by

Host: cdn.onnetwork.tv
URL: https://cdn.onnetwork.tv/js/player90/embed.min.js?s=1683212733

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.165.21.156 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

939919488f3ad816cb78b5d032ae673c1c02c88b238cfdb6e1328cd5d04d7947

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:22 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 01 Jul 2021 08:44:40 GMT
server: XO.webservantpro
etag: W/"60dd8078-194c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=17280000, public
expires: Mon, 20 Nov 2023 16:30:22 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 5C0A 13 KB
5 KB 42ms
39ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 6305
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 14:45:17 GMT
expires: Fri, 03 May 2024 14:45:17 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 03FF 783 B
1 KB 142ms
50ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b958845f9cccb8cb8b4a0da8ef7a30ca6554a9e3c710e77397dbbb49168619db

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-s5SmA6S79TE3RGylU746QA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 515
content-security-policy: script-src 'report-sample' 'nonce-s5SmA6S79TE3RGylU746QA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:22 GMT
expires: Thu, 04 May 2023 16:30:22 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FD7D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1

43 B
632 B

67ms
40ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGNHlnOEBMAE&v=APEucNUB3gV_sDvgFsckrlyyagGPWXL98OK704vRJXOsnRR5XMAusvElQil_1cZzKig3xRxuHmU62evhpSKUUEA6WpYyZZ5HJCAU9Z83G0qSKmvIzAX7nnLhljMhAT7j0b9mjC-_PgNen6lg-vuqxgEhX9-DlQoIT-4TqwV0l5MBEEZNnyXqwOOj6Ep9sIeoFZWCWjX6rpUp_UmvfbX-vSpoJTEwQsxVPw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:22 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FD7D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZFPdnoxwkaikeJ1jBEq.FgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1&google_hm=2

43 B
632 B

41ms
40ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGNHlnOEBMAE&v=APEucNUB3gV_sDvgFsckrlyyagGPWXL98OK704vRJXOsnRR5XMAusvElQil_1cZzKig3xRxuHmU62evhpSKUUEA6WpYyZZ5HJCAU9Z83G0qSKmvIzAX7nnLhljMhAT7j0b9mjC-_PgNen6lg-vuqxgEhX9-DlQoIT-4TqwV0l5MBEEZNnyXqwOOj6Ep9sIeoFZWCWjX6rpUp_UmvfbX-vSpoJTEwQsxVPw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame FD7D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKDRRoW19V1nE5RqxAk7Nb0&google_cver=1

43 B
1 KB

44ms
44ms

Image
image/gif

185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKDRRoW19V1nE5RqxAk7Nb0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGNHlnOEBMAE&v=APEucNUB3gV_sDvgFsckrlyyagGPWXL98OK704vRJXOsnRR5XMAusvElQil_1cZzKig3xRxuHmU62evhpSKUUEA6WpYyZZ5HJCAU9Z83G0qSKmvIzAX7nnLhljMhAT7j0b9mjC-_PgNen6lg-vuqxgEhX9-DlQoIT-4TqwV0l5MBEEZNnyXqwOOj6Ep9sIeoFZWCWjX6rpUp_UmvfbX-vSpoJTEwQsxVPw

Protocol

HTTP/1.1

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:22 GMT
AN-X-Request-Uuid: a0395231-1d30-44c6-b1db-988d5e160c3e
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKDRRoW19V1nE5RqxAk7Nb0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FD7D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAxNjc0NTM0ODQyMTYxMTkyOQ%3D%3D

170 B
243 B

50ms
49ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAxNjc0NTM0ODQyMTYxMTkyOQ%3D%3D

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 04 May 2023 16:30:22 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 076ed319-4739-4b0d-9115-e37c7db6d321
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDAxNjc0NTM0ODQyMTYxMTkyOQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DDC4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1

43 B
766 B

68ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGIXhnOEBMAE&v=APEucNVQWduvjSr-HFGTvQfCKo_s6p_RM8T_bz9eQe05adQuXHO10I68Ims-XQUQ9YZ4nHN9j_K9z3z95XCnZOkW6-O3WyN9rI8zvfNouoT8eIGBdiy5Bg5OIEPcn4MRPC0RQF78Q04Yydn170XOM9vdg1hCMoWPPvNq9EdeiykLFGMKFP_CVnLga-AqEN4aKahviYcvFPOmJ7OLHNFeJpC4NNbfCm2egA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:22 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DDC4
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZFPdnoxwkaikeJ1jBEq.FgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1&google_hm=2

43 B
766 B

41ms
41ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGIXhnOEBMAE&v=APEucNVQWduvjSr-HFGTvQfCKo_s6p_RM8T_bz9eQe05adQuXHO10I68Ims-XQUQ9YZ4nHN9j_K9z3z95XCnZOkW6-O3WyN9rI8zvfNouoT8eIGBdiy5Bg5OIEPcn4MRPC0RQF78Q04Yydn170XOM9vdg1hCMoWPPvNq9EdeiykLFGMKFP_CVnLga-AqEN4aKahviYcvFPOmJ7OLHNFeJpC4NNbfCm2egA
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJiMjIvOHXz1exegPGEnGOI&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame DDC4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKDRRoW19V1nE5RqxAk7Nb0&google_cver=1

43 B
1 KB

89ms
76ms

Image
image/gif

185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKDRRoW19V1nE5RqxAk7Nb0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNTBjucCENCfpLMEGIXhnOEBMAE&v=APEucNVQWduvjSr-HFGTvQfCKo_s6p_RM8T_bz9eQe05adQuXHO10I68Ims-XQUQ9YZ4nHN9j_K9z3z95XCnZOkW6-O3WyN9rI8zvfNouoT8eIGBdiy5Bg5OIEPcn4MRPC0RQF78Q04Yydn170XOM9vdg1hCMoWPPvNq9EdeiykLFGMKFP_CVnLga-AqEN4aKahviYcvFPOmJ7OLHNFeJpC4NNbfCm2egA

Protocol

HTTP/1.1

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:22 GMT
AN-X-Request-Uuid: 46d126f8-c620-45ec-985a-433ad20ff21b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKDRRoW19V1nE5RqxAk7Nb0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DDC4
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzMxMDEwMjM2MzcyODc0NzUxNg%3D%3D

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzMxMDEwMjM2MzcyODc0NzUxNg%3D%3D

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 04 May 2023 16:30:22 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e1d33f20-595e-450a-a922-2c5ae87950ff
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzMxMDEwMjM2MzcyODc0NzUxNg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 9C8F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

55ms
54ms

Image
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H3
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Redirect headers

date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 player_utils.js Show response
cdn.onnetwork.tv/js/player86/ Frame 5494 11 KB
4 KB 50ms
49ms Script
application/javascript 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onnetwork.tv/js/player86/player_utils.js?s=1682523310

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.165.21.156 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

df15e63ad5ce4b1384a4625f4c6797a30e4d74dadd0ffc8346cb85d94d8e73bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:22 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Wed, 26 Apr 2023 15:35:10 GMT
server: XO.webservantpro
etag: W/"644944ae-2dee"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=17280000, public
expires: Mon, 20 Nov 2023 16:30:22 GMT

GET
H2 200 gpt_proxy.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 5494 78 KB
28 KB 148ms
40ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/gpt_proxy.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75042e3e6d8673eb87f9c2112f7c90d93a385226eab78d44db3132fa847bdfee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:17:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 768
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28565
x-xss-protection: 0
last-modified: Mon, 01 May 2023 15:19:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=900
accept-ranges: bytes
expires: Thu, 04 May 2023 16:32:34 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 5494 360 KB
120 KB 190ms
82ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e346af76b362ff2265b23e118a2e57685ab897a142270e85903afcb463c4b34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122872
x-xss-protection: 0
expires: Thu, 04 May 2023 16:30:22 GMT

GET
H3 200 hls.min.js Show response
cdn.jsdelivr.net/npm/hls.js@1.1.3/dist/ Frame 5494 315 KB
95 KB 41ms
41ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/hls.js@1.1.3/dist/hls.min.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

QUIC, , AES_256_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

920230cba1a6e09330a6cc76c634c78e547fcf67b7a9cc03213dde43ceea0baa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1954214
x-jsd-version: 1.1.3
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 96461
x-served-by: cache-fra-eddf8230087-FRA
x-jsd-version-type: version
etag: W/"4eaf2-/CwIB8b0ZgFLVgmQTHnomAXuiz4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 player.js Show response
cdn.onnetwork.tv/js/player86/ Frame 5494 282 KB
76 KB 100ms
99ms Script
application/javascript 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onnetwork.tv/js/player86/player.js?s=1682523310

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.165.21.156 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

938047d4aed77a64b1dd35bf5028a62f5b769dddb954577e9a337a072d9679a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sharemods.com/
Origin: https://sharemods.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:22 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Wed, 26 Apr 2023 15:35:10 GMT
server: XO.webservantpro
etag: W/"644944ae-468c8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=17280000, public
expires: Mon, 20 Nov 2023 16:30:22 GMT

GET
H2 200 a_cntg.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 50ms
49ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntg.png?ts=1683217822715&d=9784&wsc=00&typ=embed&mobile=0&c=44
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:22 GMT
last-modified: Thursday, 04-May-2023 16:30:22 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 39CD
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
147 B

55ms
54ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:22 GMT
expires: Thu, 04 May 2023 16:30:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:22 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CC9 0
20 B 141ms
140ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=737591103681&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CC9 0
20 B 140ms
140ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=737591103681&version=m202301230201&ct=77&x=1&cor=4364319810599599000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8CC9 15 KB
11 KB 76ms
74ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BRjjxGICjhx2j0cqsyKMKkheBMpeO10BZzUa2tQORrXuGE7kQNpIz_MgJH35XO7fLFSwdbP6I_5QnSxob-k4ZiC2aKj1kpXxP5O_e5KE7Rg1sfH0lKSJHvogzf35OJQdpXNXp4g9GedP75qMPewleyMTtk2TGlBb6RaOr8WoT4cSiwqpM&cry=1&dbm_d=AKAmf-BXTVutLKLFsQd_qCIchj7p0KHMEmL2Yqe7qwF-_ihTMkWuMZD8cyXYU1PrKY3RxiHUBbIvmKDZhUO1UlgxGD1IQ2sKcXnz0kQxEm76vdvDcxQQNOSSALQZ_GwGTLHAfpGM6CWLEfeWXkjwxqc62zWZebapHY1SXOqr0V4nHXo_QgUXQ9gOJnhjpn6Ire4lDqzTxEH-zR9j7TNpB9RjmORx1KuA_jLonlcnlkq5gEpA5kOJIc1SSaMgcWC6-d3qopL79qTHHY3Py3YBIMzoMlU7ZWWdfQzeP3UmQgFUFkkJ8vXJdqeeE_aLAes4aNwIacE2X1sEkmJXqMFLlGtFK5CsRA7sZiZtAXnaydWDsKRmYDukUORiYTkHToIh5vNNp0CTZ7cSzoWpADgpgGUPaFulDtpgo2a59RnbagoV9mADlva5wkUP7RSkmxR349Z2a05x0brzF_wEGntiUJbBR10Imsq6981Fu0GvHoPJQ4akpllTmLyfNPTz0g1YjmgshhkOexvPT6wzJt-dK0dwfsA7A7v3HG-TtfEhjAp-n_3pbCzxnhmWViw57rv8viVW8llKARLhagCXfasCbqTqUok6EAzHmQbPg7-end9ZnteL3n6iL_iyNCGX21SKu8E-Af7NJaFrLh6HwCuV-gF3oeKzZMBImdf7viHyb0X6LO39bL-WTEh2H9AoQ6aMsoGcv0V6KnAErk74VCwpkirrJAt4cf8Jh3QWVajYfrbAY3ycbMSbi2_ovzTz-fy-5bv6pSunsfa4C3P3U-nEOQxnnaDzRXlg7Ab0xFbA9ifLMaEc0eod7kARDZqPxepBDVMBH9wlD2o48tXPIak1g0bX_jCNX9hTcQ-Ssj4FHjrE8yN3NXascXBMCmaYOdJx7zHik0bZ4rrXykiyVamMZUE94nO1o0isnKtCUWiLfSUdJpLqnTJOT-Py9IMHNtW_u_f8OYRzLwZgH5XytUDGjb7kMQNrWw8s-g7b1EnNVrkZfizjnLbncd4tYl5GVVlywQM6z3SmV0m4kk6fncxoNhi4H4WDI3iN0p2xTGqXJLOnyPpL2xbfsZLh5SmmD_nRBplolioN3V1vNXh7NbrpzGh6-Z78KvMFahUdik2y6gjPf8CQtIqTHTnRtYa9qDcadK3IH4vGAFYaCZgdaPtu82F1anZtP53VGKNw9R-c4-pmuW1N4p0_kwLGK0-hDGn9EtsuG8V92Zy6nxDK2liVurNZs5MxbOeoE2KtcSPEgIWY-KqC78jR6nC-OGWJvrO4uEIewD9Msx39EXVaRPRuh5Ptri2GYDX1Xl5TekiKIuLnnlksWlzrW44u11odQz0eGVmAHg1qG_ycaxp7Ajyiz1FL5V0Pv9bFRVEFPa2IFRyoT5nu35jFAkNoe7anRWzfsmEu3bXmz9uj0Y9HWSZE3sz1rp--T65eEiixyJtqmc9hxc4yd4dB2UP42naP2EDmb9iqpPcQksgbAblGXeUgo_wgC1Prkpn4iOLxnuhUtCRrD_paQq0V6OFcevUfvGb47aaH7eIrxW89vQ4NrhFh0EHNeD0yx9sbLM9FXU21ATNDxPAeda_CrlGcGONDCpGn0SkYcQceg_ZoT075U582BXLmPkrEkZbQdeGl9NI1XpAdCnaAePb9BzZmVeyOFqbFxkzWQatLW1P4x7QK40vf6HXLm99mb9lviJsL9kBNAp3Wr9skgc1IY16qSZEnuxPtS0PhCxkNMH8OSf4EBPFSQP0pbC6TN-ZqTDN426hK7F3TL5aKY97F4CtOVado89P435wSPfv6De8TcFzydIkjWsXwFJhEbEreckLhpTsayS85yH3D67QC25VJBmtcSdt1vU50XcCxXGlc1PGjtxbRuNh8G1CtVGhlWzOwBkgH0ckyLJ8rjDdvjInbfzpjHYxd9ubqHv4dgFMQW9h93fe_e-3rdywdwHHicMoIrA9azuU6JebWsYY25UNN7ML41ipZk1oqvtoKFWvs5v-X8_8E01F5sQ513cWgKljCOmFwNbp7lU2Qk45a5uuDKVqTDp70dG6dqnuT66eG1wvJ61uFul9VjBIjNoE_NVyr3eoAvyTrnSSdKN5cP62Jf0pLNgH17FcsQjrCH2Lt8UXd2FuwLmLFb6H0f_lsNRDhpEa-VtJNLbJ1oancGGK1YUFHQfDq_O5bXJjQ0IRkEnuXlfUXpIdFYuLHWhaanctFbRH1w1-4CIHpwDQMcqhks-XIvKCzJfPxwX3nc5961W_c9e7dVDx3fYWh2qb9asb9Ds4xd0N15POi_jWH3dg04ul3fXI51QtQLE_DA-qCyBYGELqA1Qnrexbxi-J-0gQT6agiguw7X0rKBAInsKkFwdz08MawoA8iTuEGgqs5uK-HC47EpSbkXhmIwRHVeG0iNJ_Kd36nIwWn4j4JvD6MaD_d8czd_3J0ziLOmGC8Sz1-wLYFRaXEcrWW4lKJO2CkcN8GYc0CeyFMFowpSc5NmqjRB1-_ZjeAlhdm1OzluC7UbjSYrXAHDpmXPQD2a9mxMOPsPrV6cqS9Gr3-qM-WoHRI9KxlLZjO7QzrRVMdaFeh1cmTqE41rKKvqqdaNp_E7tLi8wbPC27b6j-z2aU3kbhQdBPXkaAc5kyGYqZB543vl7cTnG5qvWeHfF5UoS8Ib3AUq9g2bmHWjfrMdZrbOD0Uk2P2o7bruwsh1vb0V4IaxbvdkJHBHpcaULRxKZATb-xr6pYzX0vN6EeUpN5uBt8sCCw409pTmxUplj7G5F6nd16tksrY_KFnhihp_5b9RZyzu-MAC9-vA_ckbU9dXDWyPfammHNt9lvGPdSCjkjwtQh_gp_3dtIZ8IkXPbFBFZiT8H2Qb3ouUC_e3DDfvl0xRsl6dOR4-Z21S3szd3VXuAhHizde9ZW6BgdZT3yh2PV9dBm_Q5iY_8egBuXuFLVl0zrrrfXCeJy_y7ZIELBBVxSgs6xtEHOUh92MhMxaMqPmYNkfhjLWcHXiOxPWgSZr2BgwbvT7qifB8CMDwYgzISzFCEghI0-b__siiM52YmGzfoE9_tQg5lhLxhmWmFv0xo4DXCUjXyitDGns4kUETuSRSXG9QhJ1odZTmQUf9mVZmERfXZM4CVjeW8xA26Iq5P6-VA05-sXRprZuUfoAmxH7IPRkgrwF4K4y78iO6RJp-UdcP-_4Vd9X6uuDM_zcTL6c2sALE53qym2FS3Ev1B2WMywTqJT9JyiwTeH7P1FZIRMcUVQxpWQ9FNRi0MQpM5Ty6hxsM3kg8U-V5iIaECAknay2K4bO7iYoRJoGXqW5R7Uo_OcwyDNfJwWv9_j1eScaw_25VwjEzrwA54kCdtTt6SyTM2DA9Ga8qf4i7kgDs6CqgNLbRDJ31HqJlMtLMhXFs9cSel0RM1atLaOjOPy2fs_p3nJdqdWN1ihpSfXsZf7NkGefS5pr6BN6A1P0TI2uzn52Tbx5q1_jZgvGgv09VXQ4ij76PODUTqjRBQTeJUqxJBEHGsCF1us6zAf7uKSG0HPvPWrb29SJU85Z5nhHmFxJXPUMVKrawZwPKzris_f7COjDvGzRD6Ia4sThqMOswS3EFWgeRNf_7txiigMwyf-eToUxVHpmRheEYIk6D9z-n_o-uuEjKZuFe-YR6Rs7Bo1AZ5r0Zh-srF2nu9GcSjh_zUcWThPLui09cpx-TIxvBVV9X8oRhqiLyphixe9UnJBsO-TNlKV59zMeNPKg9cw3Mxv0JNDAHA&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=4364319810599599000&adk=1964084972&idt=227&cac=0&dtd=19

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bce65a01d106d68508402ef2b49863ec8ef356b0135aa6a331c760c0d6ca01bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11371
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EB2 0
20 B 140ms
140ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9945202429115&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EB2 0
20 B 140ms
139ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9945202429115&version=m202301230201&ct=77&x=1&cor=17416845490826623000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4EB2 15 KB
11 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bt5BPxdktofwNEqqqyKPFHB0MJFlB08ELlkfLLWDSj_PvHzKdZN2QnqQlvGQ41MeqvBkNmOx4JqD47alVAn_J7liYlEayUfMsiaGVQPA0pRo5_0_7I5l6r1gOYbOKehpe25eTQEDST77XccmBTybxYxe4DYbj08tsmDrXWmW-fjCe4bGc&cry=1&dbm_d=AKAmf-CZbnmNCOaWiwJG1GntNYwJp_v4Xzxb04iTv0fGt-qGNkkU8PFiqV6O1YsNX_qwV7E2dYkwaSU3wL1gPVyBQS-f4uv9t4OkTZHweAcB6vXlH8GuR8UT9_dIS4zyTXQ1B_v6k06bwMRVUoMm8HXkPiFx9mcBxXjL0GHq0Lw4jhffo2Kuc9z9XFI9HDNr04opb29pQ9z5pKuPwDoIJ0ZeaRKivQH6HR4NRVzl4X258R4h7B81LsPHhTOa90PFXBX64PI4xgJFbPv7q4e9w83sXeXUoBc8J5rHXrW0oJ6J0m77e8ZA1NvH0s5rWZ0fh-2fs2vxtBDLDIg3kVqPW0GViXht1fZP5XMdfse5XGJX5JgyI7T6fRMV1BRVas-5asbnZHMB-KC3hN1E10If6EEkuxns41mmWjaHYMJusulpI6L2xEKO-S-TwC-3SX7pabqtoVsexXD8NYkrcmY4isqJJFI11AG02up7ajLUljXI2adsjQHn84CySPLNNNzWheXHcChQhlzXufhT3pPYHc97-8VUCMXpLE3HoMltMyxQ2gCFnWae-Tpyhpfv3gNkqEgWu9TcWiGPCu_ynEmrC7-TsoxNLJYBLZ566l4x9fHWOk81ymP5gjfoFZNlShPsVyxauCnIQJUsnJa1eaMQ1gk9SEy7SqG3M26DtxjA9HkzQvVDWpsPVuKt_q1lMFWqyNsd_riVD7LBRUK08lYSkQcCCg7UOOYebw25S7vbjKeMpksKUQp7nywqpXR7JJ7RLRcF3DHVhs-m8EfpCEwWmOYn4bqbaWvu9Y3Ju2MYrVYb_DCKEpVUVEE9v-CVnf6ffM47MUBl-GY7l32_tkQ3aTu89YaqoFT4N6ebyWFxdOHl2SGUOIUQu4dXKMjLYwzDsdA5PaSRqkj2PVMAr5qQHBi6L8ESD16e7ceQwHKSbCHueeQYblE3S9Jiv52lmsi2gX7p5x07rOo5CJ6W4hHre45EBY3q1J3xVZt58lbkoO1Hin2t9GyGNxni0LjSszQ_ZUNEuqpufxvkWnQiTlSCUxVT_ArU6ja0jPfoz52zFw3bQC4nq4i26GHaSAOKtzkSGS328jOgvd--wCGk0TxLFDjmxXDeRl7rIp5XWXRmoVWMYobT3bVnNe5pMLJC4CLvv4dSqsKCrqqz1BYvRmXVgxmPy-vtD3ER1V4saWZumHY7Yd-s9R3zViwKvZlX75kfCFFVYCWacRWjRXNJPu_iisGnHYR3kTWR7XnH6KtMJOhPw_219pJGBFZgQzeqS0p18Q6v166itxiKJ10pFupJzSuv58iVo3ie_Tt23Oeqr2v8VbnuShzn_bd-bx8BCD0rR5zp6EqDWKx50O4S4N43jDniXS1xiCedzXXaJixtWYumiLmpPuzjxjCe7ZIWtDvy7H8FkQGQTazZTtiRiZp2by4ph9l2TgwZd4GpoKw1b82h4GU5uXWim3eDqjPj97sonrPmFdc3YuTGKzmLAxHd_wjyMg3lv6dUAsmFR3Zg6x1yJdX8M8W3cgoMaaSqcNEX9JORksOnI_RxNP05244c2Xb2ipXSL4Y6pX3F4yCUhJ4SB4MGQLjnUiW4TUEHhWy7X08Vwsyzj8YDP7XDda3Tc87aZsoNJhdzE0LT8wi6eCn0VhrS8mvQSKjceQwCNT-UhDtSdL6Li_eyR0cqI86EfbHNnqxM0ws1d333mtKN8zQakyULsh9xzEDTFp_AnUkVMEudv-kmYqgln3_V5RqRKTjtnjLcyYaxL6Ho89czqZYD9r6pWDOzGON-CaSqhIug0A0NYWMMIf5Jy4dmGjL2jLhBtFG4EXar7Ye14lD7m5p6UMWzoNSdrOe1_KG9TnqeHQ_fQqTX-WJjfvyJ8UHZLu8j7EoP1FJ4QmQaaYk4Sb7hSMDaHr5E3SdA07hk2E1Lw1_xN6z50FqgnXZxaVHC2pmuBnspwnTYrk-ljSaSy0D8OivpJztyZoFnh3P0qtnTlnfe2OzGyK3rAVOZIhPiogn337ag4BfFDw5J_D0_qnXCkIOuHoiadnmASB5ueXI3mvKdJMtGsy5UdjGE3kPIlbk-4_krMvHOzXgJ21tXSdZGHmkJ1js6Cg7tbM-A5qTaCeAZIimZLUKboFVXQUPQLw_Nz2d0HR7pjZkC7QQABUgFO7TTI-StoG6VQ6Su3rlLtXIG_TPRWcdGOmNvF4eB3ik7m4wZP_TIzVaXxpKCeOKbOWzONREmNACcHzcSerVdw8g3i4zFIf8G_oYbS1UJURt0l467ZNvll53PRpBDC63yv3hUUgXfNqsPeoutiyl9Mr40r5UdbtSEEp1qBRhbsWYpcgx4wAOwzW_F0HCHWLEVhhuTK_hQ5rVFhppuOf97BCFJCB7ZDPjTcDN1hQLqZvkb3gDbDuA_OFpzyVNJv6UEbbPac4TOaLFOEL8MKzGvTXVuwy1x3kWMZKD5ty4p_0UWckkEvTDyihZtEb2hxUSd8eLOWuHI1-GIpssKePs4b4caygHLrWvAmur1k1OU-MrcPeMJFZFh3cFqF5ITCdYCdbdDGxrATDLMtIuXXOZKp-HFeaY8agMcPHmAreQuA-Q-HiLuCapPnDqw-QnOBwNOrdpEGkTR900PCa4PZrL5A4s6gd_vrqkmXHFdWWRqs5lQCT_kJFZbKrfq-uZlpqH2RPksX-u8ho9WhMoM8Si4KudCPn_kKMHgya9puevc5OrIbyiKAGW5eVIXMeAf2BLaudLj3eHtyd7mkvb3ZERQOrGtyBtBh4NIniu7Kg95ZG6doiH53R23XoL8A7nSlUr2aPmLfUB4_7MxSDxi4tEk7KXtGbmu0BUbpdw_ri6w9fXfJSaq_SyaB1sslIKqGpIYCJ7u8dxWIDwuq79clvxcX0ox6deImo4VTmQKwA7UKlWRY3qTnITxoTuXuc3ZK8glRl7Ziy_x2HanaI0_8NwDsuzYzpco8AvAgUednKixBtQnI7-4w9BOW3d-qxX03M0ep5SqapQw13EGrgYaJ3-WQ-zILFb7HSHZ61AICG8gLikfvCmbSqQCB9v_tSBpBtJSdLOSsseiSuVPtxoUHu5tvCp2x1iskPKFN9JiM_BzYLZcgIzZ9Ee-NzhUeuAwvktAChMNOPJ-JHOr-UxpXMeOjlU0m3r958F5sDvC3TrHkENgL5sk_AFVwytwR2nniu_UAN9YmpXmmbyF7F0g3eATdk7GaqnX7kAcVReABFdZD3Wlz8iIhHfNGtKdkcsF4fTgw5_ecz5KozUJzt-B7xu00nJyNTVD4j9qFxPRQ4AV9kZHx4fCY7LvOSHqavJZW7NPNnx7rGgH4lmjxRbFARwjaz2VBnA9y1MzI5T57nfmgplX06T04DW-ahrIeifEGT7hwSW7IQJv80AV4sxeM8tGg_cNit4UXKEjEcn92l0wnNuXyM6g_v4kNauy01iIyPvsnbYa_HJY6TGt0OMZedvcF-_yhqBbQOOtyj7sG1cNupXD_e0Ebr3gY_G-178f2yK1FjpXEoI16jlFvtXYoSUAzJOMdcYwM8CUwHSSoJTTdllX82uAWOdxupv2zwgjDIfP_L9Dy5QEX761-AqUTm2trpbaEsJlwH2mIzbuy78yXcBtzF_Ve8U2A1wsvGHfakIXZH91WkS1zzI8SyUJJc7Q8BLSSfJazdYaa20IXaulTviTqnRcgstMPlUGPleEuQYBEPLuS5u-xfEkr_aOzRk4HbHykJtQqS-uRQ8X5wWjlY9w4WtGzZTliA4Jgm1hR8sXkxVJpj7tMes&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=17416845490826623000&adk=3047537735&idt=209&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8baf76c40b43c1b39094b603bae44d32d276ba402ddad99c670f491e8a349fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11495
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js Show response
pagead2.googlesyndication.com/bg/ Frame 5C0A 38 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c5b942bd3e64ff2eaff944993c252bcbb1ba01452c9779121f41670e7a0c45c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 12:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14304
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14734
x-xss-protection: 0
last-modified: Mon, 01 May 2023 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 May 2024 12:31:58 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8CC9 41 KB
15 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BRjjxGICjhx2j0cqsyKMKkheBMpeO10BZzUa2tQORrXuGE7kQNpIz_MgJH35XO7fLFSwdbP6I_5QnSxob-k4ZiC2aKj1kpXxP5O_e5KE7Rg1sfH0lKSJHvogzf35OJQdpXNXp4g9GedP75qMPewleyMTtk2TGlBb6RaOr8WoT4cSiwqpM&cry=1&dbm_d=AKAmf-BXTVutLKLFsQd_qCIchj7p0KHMEmL2Yqe7qwF-_ihTMkWuMZD8cyXYU1PrKY3RxiHUBbIvmKDZhUO1UlgxGD1IQ2sKcXnz0kQxEm76vdvDcxQQNOSSALQZ_GwGTLHAfpGM6CWLEfeWXkjwxqc62zWZebapHY1SXOqr0V4nHXo_QgUXQ9gOJnhjpn6Ire4lDqzTxEH-zR9j7TNpB9RjmORx1KuA_jLonlcnlkq5gEpA5kOJIc1SSaMgcWC6-d3qopL79qTHHY3Py3YBIMzoMlU7ZWWdfQzeP3UmQgFUFkkJ8vXJdqeeE_aLAes4aNwIacE2X1sEkmJXqMFLlGtFK5CsRA7sZiZtAXnaydWDsKRmYDukUORiYTkHToIh5vNNp0CTZ7cSzoWpADgpgGUPaFulDtpgo2a59RnbagoV9mADlva5wkUP7RSkmxR349Z2a05x0brzF_wEGntiUJbBR10Imsq6981Fu0GvHoPJQ4akpllTmLyfNPTz0g1YjmgshhkOexvPT6wzJt-dK0dwfsA7A7v3HG-TtfEhjAp-n_3pbCzxnhmWViw57rv8viVW8llKARLhagCXfasCbqTqUok6EAzHmQbPg7-end9ZnteL3n6iL_iyNCGX21SKu8E-Af7NJaFrLh6HwCuV-gF3oeKzZMBImdf7viHyb0X6LO39bL-WTEh2H9AoQ6aMsoGcv0V6KnAErk74VCwpkirrJAt4cf8Jh3QWVajYfrbAY3ycbMSbi2_ovzTz-fy-5bv6pSunsfa4C3P3U-nEOQxnnaDzRXlg7Ab0xFbA9ifLMaEc0eod7kARDZqPxepBDVMBH9wlD2o48tXPIak1g0bX_jCNX9hTcQ-Ssj4FHjrE8yN3NXascXBMCmaYOdJx7zHik0bZ4rrXykiyVamMZUE94nO1o0isnKtCUWiLfSUdJpLqnTJOT-Py9IMHNtW_u_f8OYRzLwZgH5XytUDGjb7kMQNrWw8s-g7b1EnNVrkZfizjnLbncd4tYl5GVVlywQM6z3SmV0m4kk6fncxoNhi4H4WDI3iN0p2xTGqXJLOnyPpL2xbfsZLh5SmmD_nRBplolioN3V1vNXh7NbrpzGh6-Z78KvMFahUdik2y6gjPf8CQtIqTHTnRtYa9qDcadK3IH4vGAFYaCZgdaPtu82F1anZtP53VGKNw9R-c4-pmuW1N4p0_kwLGK0-hDGn9EtsuG8V92Zy6nxDK2liVurNZs5MxbOeoE2KtcSPEgIWY-KqC78jR6nC-OGWJvrO4uEIewD9Msx39EXVaRPRuh5Ptri2GYDX1Xl5TekiKIuLnnlksWlzrW44u11odQz0eGVmAHg1qG_ycaxp7Ajyiz1FL5V0Pv9bFRVEFPa2IFRyoT5nu35jFAkNoe7anRWzfsmEu3bXmz9uj0Y9HWSZE3sz1rp--T65eEiixyJtqmc9hxc4yd4dB2UP42naP2EDmb9iqpPcQksgbAblGXeUgo_wgC1Prkpn4iOLxnuhUtCRrD_paQq0V6OFcevUfvGb47aaH7eIrxW89vQ4NrhFh0EHNeD0yx9sbLM9FXU21ATNDxPAeda_CrlGcGONDCpGn0SkYcQceg_ZoT075U582BXLmPkrEkZbQdeGl9NI1XpAdCnaAePb9BzZmVeyOFqbFxkzWQatLW1P4x7QK40vf6HXLm99mb9lviJsL9kBNAp3Wr9skgc1IY16qSZEnuxPtS0PhCxkNMH8OSf4EBPFSQP0pbC6TN-ZqTDN426hK7F3TL5aKY97F4CtOVado89P435wSPfv6De8TcFzydIkjWsXwFJhEbEreckLhpTsayS85yH3D67QC25VJBmtcSdt1vU50XcCxXGlc1PGjtxbRuNh8G1CtVGhlWzOwBkgH0ckyLJ8rjDdvjInbfzpjHYxd9ubqHv4dgFMQW9h93fe_e-3rdywdwHHicMoIrA9azuU6JebWsYY25UNN7ML41ipZk1oqvtoKFWvs5v-X8_8E01F5sQ513cWgKljCOmFwNbp7lU2Qk45a5uuDKVqTDp70dG6dqnuT66eG1wvJ61uFul9VjBIjNoE_NVyr3eoAvyTrnSSdKN5cP62Jf0pLNgH17FcsQjrCH2Lt8UXd2FuwLmLFb6H0f_lsNRDhpEa-VtJNLbJ1oancGGK1YUFHQfDq_O5bXJjQ0IRkEnuXlfUXpIdFYuLHWhaanctFbRH1w1-4CIHpwDQMcqhks-XIvKCzJfPxwX3nc5961W_c9e7dVDx3fYWh2qb9asb9Ds4xd0N15POi_jWH3dg04ul3fXI51QtQLE_DA-qCyBYGELqA1Qnrexbxi-J-0gQT6agiguw7X0rKBAInsKkFwdz08MawoA8iTuEGgqs5uK-HC47EpSbkXhmIwRHVeG0iNJ_Kd36nIwWn4j4JvD6MaD_d8czd_3J0ziLOmGC8Sz1-wLYFRaXEcrWW4lKJO2CkcN8GYc0CeyFMFowpSc5NmqjRB1-_ZjeAlhdm1OzluC7UbjSYrXAHDpmXPQD2a9mxMOPsPrV6cqS9Gr3-qM-WoHRI9KxlLZjO7QzrRVMdaFeh1cmTqE41rKKvqqdaNp_E7tLi8wbPC27b6j-z2aU3kbhQdBPXkaAc5kyGYqZB543vl7cTnG5qvWeHfF5UoS8Ib3AUq9g2bmHWjfrMdZrbOD0Uk2P2o7bruwsh1vb0V4IaxbvdkJHBHpcaULRxKZATb-xr6pYzX0vN6EeUpN5uBt8sCCw409pTmxUplj7G5F6nd16tksrY_KFnhihp_5b9RZyzu-MAC9-vA_ckbU9dXDWyPfammHNt9lvGPdSCjkjwtQh_gp_3dtIZ8IkXPbFBFZiT8H2Qb3ouUC_e3DDfvl0xRsl6dOR4-Z21S3szd3VXuAhHizde9ZW6BgdZT3yh2PV9dBm_Q5iY_8egBuXuFLVl0zrrrfXCeJy_y7ZIELBBVxSgs6xtEHOUh92MhMxaMqPmYNkfhjLWcHXiOxPWgSZr2BgwbvT7qifB8CMDwYgzISzFCEghI0-b__siiM52YmGzfoE9_tQg5lhLxhmWmFv0xo4DXCUjXyitDGns4kUETuSRSXG9QhJ1odZTmQUf9mVZmERfXZM4CVjeW8xA26Iq5P6-VA05-sXRprZuUfoAmxH7IPRkgrwF4K4y78iO6RJp-UdcP-_4Vd9X6uuDM_zcTL6c2sALE53qym2FS3Ev1B2WMywTqJT9JyiwTeH7P1FZIRMcUVQxpWQ9FNRi0MQpM5Ty6hxsM3kg8U-V5iIaECAknay2K4bO7iYoRJoGXqW5R7Uo_OcwyDNfJwWv9_j1eScaw_25VwjEzrwA54kCdtTt6SyTM2DA9Ga8qf4i7kgDs6CqgNLbRDJ31HqJlMtLMhXFs9cSel0RM1atLaOjOPy2fs_p3nJdqdWN1ihpSfXsZf7NkGefS5pr6BN6A1P0TI2uzn52Tbx5q1_jZgvGgv09VXQ4ij76PODUTqjRBQTeJUqxJBEHGsCF1us6zAf7uKSG0HPvPWrb29SJU85Z5nhHmFxJXPUMVKrawZwPKzris_f7COjDvGzRD6Ia4sThqMOswS3EFWgeRNf_7txiigMwyf-eToUxVHpmRheEYIk6D9z-n_o-uuEjKZuFe-YR6Rs7Bo1AZ5r0Zh-srF2nu9GcSjh_zUcWThPLui09cpx-TIxvBVV9X8oRhqiLyphixe9UnJBsO-TNlKV59zMeNPKg9cw3Mxv0JNDAHA&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=4364319810599599000&adk=1964084972&idt=227&cac=0&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Tue, 02 May 2023 09:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 198594
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 May 2024 09:20:28 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4EB2 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bt5BPxdktofwNEqqqyKPFHB0MJFlB08ELlkfLLWDSj_PvHzKdZN2QnqQlvGQ41MeqvBkNmOx4JqD47alVAn_J7liYlEayUfMsiaGVQPA0pRo5_0_7I5l6r1gOYbOKehpe25eTQEDST77XccmBTybxYxe4DYbj08tsmDrXWmW-fjCe4bGc&cry=1&dbm_d=AKAmf-CZbnmNCOaWiwJG1GntNYwJp_v4Xzxb04iTv0fGt-qGNkkU8PFiqV6O1YsNX_qwV7E2dYkwaSU3wL1gPVyBQS-f4uv9t4OkTZHweAcB6vXlH8GuR8UT9_dIS4zyTXQ1B_v6k06bwMRVUoMm8HXkPiFx9mcBxXjL0GHq0Lw4jhffo2Kuc9z9XFI9HDNr04opb29pQ9z5pKuPwDoIJ0ZeaRKivQH6HR4NRVzl4X258R4h7B81LsPHhTOa90PFXBX64PI4xgJFbPv7q4e9w83sXeXUoBc8J5rHXrW0oJ6J0m77e8ZA1NvH0s5rWZ0fh-2fs2vxtBDLDIg3kVqPW0GViXht1fZP5XMdfse5XGJX5JgyI7T6fRMV1BRVas-5asbnZHMB-KC3hN1E10If6EEkuxns41mmWjaHYMJusulpI6L2xEKO-S-TwC-3SX7pabqtoVsexXD8NYkrcmY4isqJJFI11AG02up7ajLUljXI2adsjQHn84CySPLNNNzWheXHcChQhlzXufhT3pPYHc97-8VUCMXpLE3HoMltMyxQ2gCFnWae-Tpyhpfv3gNkqEgWu9TcWiGPCu_ynEmrC7-TsoxNLJYBLZ566l4x9fHWOk81ymP5gjfoFZNlShPsVyxauCnIQJUsnJa1eaMQ1gk9SEy7SqG3M26DtxjA9HkzQvVDWpsPVuKt_q1lMFWqyNsd_riVD7LBRUK08lYSkQcCCg7UOOYebw25S7vbjKeMpksKUQp7nywqpXR7JJ7RLRcF3DHVhs-m8EfpCEwWmOYn4bqbaWvu9Y3Ju2MYrVYb_DCKEpVUVEE9v-CVnf6ffM47MUBl-GY7l32_tkQ3aTu89YaqoFT4N6ebyWFxdOHl2SGUOIUQu4dXKMjLYwzDsdA5PaSRqkj2PVMAr5qQHBi6L8ESD16e7ceQwHKSbCHueeQYblE3S9Jiv52lmsi2gX7p5x07rOo5CJ6W4hHre45EBY3q1J3xVZt58lbkoO1Hin2t9GyGNxni0LjSszQ_ZUNEuqpufxvkWnQiTlSCUxVT_ArU6ja0jPfoz52zFw3bQC4nq4i26GHaSAOKtzkSGS328jOgvd--wCGk0TxLFDjmxXDeRl7rIp5XWXRmoVWMYobT3bVnNe5pMLJC4CLvv4dSqsKCrqqz1BYvRmXVgxmPy-vtD3ER1V4saWZumHY7Yd-s9R3zViwKvZlX75kfCFFVYCWacRWjRXNJPu_iisGnHYR3kTWR7XnH6KtMJOhPw_219pJGBFZgQzeqS0p18Q6v166itxiKJ10pFupJzSuv58iVo3ie_Tt23Oeqr2v8VbnuShzn_bd-bx8BCD0rR5zp6EqDWKx50O4S4N43jDniXS1xiCedzXXaJixtWYumiLmpPuzjxjCe7ZIWtDvy7H8FkQGQTazZTtiRiZp2by4ph9l2TgwZd4GpoKw1b82h4GU5uXWim3eDqjPj97sonrPmFdc3YuTGKzmLAxHd_wjyMg3lv6dUAsmFR3Zg6x1yJdX8M8W3cgoMaaSqcNEX9JORksOnI_RxNP05244c2Xb2ipXSL4Y6pX3F4yCUhJ4SB4MGQLjnUiW4TUEHhWy7X08Vwsyzj8YDP7XDda3Tc87aZsoNJhdzE0LT8wi6eCn0VhrS8mvQSKjceQwCNT-UhDtSdL6Li_eyR0cqI86EfbHNnqxM0ws1d333mtKN8zQakyULsh9xzEDTFp_AnUkVMEudv-kmYqgln3_V5RqRKTjtnjLcyYaxL6Ho89czqZYD9r6pWDOzGON-CaSqhIug0A0NYWMMIf5Jy4dmGjL2jLhBtFG4EXar7Ye14lD7m5p6UMWzoNSdrOe1_KG9TnqeHQ_fQqTX-WJjfvyJ8UHZLu8j7EoP1FJ4QmQaaYk4Sb7hSMDaHr5E3SdA07hk2E1Lw1_xN6z50FqgnXZxaVHC2pmuBnspwnTYrk-ljSaSy0D8OivpJztyZoFnh3P0qtnTlnfe2OzGyK3rAVOZIhPiogn337ag4BfFDw5J_D0_qnXCkIOuHoiadnmASB5ueXI3mvKdJMtGsy5UdjGE3kPIlbk-4_krMvHOzXgJ21tXSdZGHmkJ1js6Cg7tbM-A5qTaCeAZIimZLUKboFVXQUPQLw_Nz2d0HR7pjZkC7QQABUgFO7TTI-StoG6VQ6Su3rlLtXIG_TPRWcdGOmNvF4eB3ik7m4wZP_TIzVaXxpKCeOKbOWzONREmNACcHzcSerVdw8g3i4zFIf8G_oYbS1UJURt0l467ZNvll53PRpBDC63yv3hUUgXfNqsPeoutiyl9Mr40r5UdbtSEEp1qBRhbsWYpcgx4wAOwzW_F0HCHWLEVhhuTK_hQ5rVFhppuOf97BCFJCB7ZDPjTcDN1hQLqZvkb3gDbDuA_OFpzyVNJv6UEbbPac4TOaLFOEL8MKzGvTXVuwy1x3kWMZKD5ty4p_0UWckkEvTDyihZtEb2hxUSd8eLOWuHI1-GIpssKePs4b4caygHLrWvAmur1k1OU-MrcPeMJFZFh3cFqF5ITCdYCdbdDGxrATDLMtIuXXOZKp-HFeaY8agMcPHmAreQuA-Q-HiLuCapPnDqw-QnOBwNOrdpEGkTR900PCa4PZrL5A4s6gd_vrqkmXHFdWWRqs5lQCT_kJFZbKrfq-uZlpqH2RPksX-u8ho9WhMoM8Si4KudCPn_kKMHgya9puevc5OrIbyiKAGW5eVIXMeAf2BLaudLj3eHtyd7mkvb3ZERQOrGtyBtBh4NIniu7Kg95ZG6doiH53R23XoL8A7nSlUr2aPmLfUB4_7MxSDxi4tEk7KXtGbmu0BUbpdw_ri6w9fXfJSaq_SyaB1sslIKqGpIYCJ7u8dxWIDwuq79clvxcX0ox6deImo4VTmQKwA7UKlWRY3qTnITxoTuXuc3ZK8glRl7Ziy_x2HanaI0_8NwDsuzYzpco8AvAgUednKixBtQnI7-4w9BOW3d-qxX03M0ep5SqapQw13EGrgYaJ3-WQ-zILFb7HSHZ61AICG8gLikfvCmbSqQCB9v_tSBpBtJSdLOSsseiSuVPtxoUHu5tvCp2x1iskPKFN9JiM_BzYLZcgIzZ9Ee-NzhUeuAwvktAChMNOPJ-JHOr-UxpXMeOjlU0m3r958F5sDvC3TrHkENgL5sk_AFVwytwR2nniu_UAN9YmpXmmbyF7F0g3eATdk7GaqnX7kAcVReABFdZD3Wlz8iIhHfNGtKdkcsF4fTgw5_ecz5KozUJzt-B7xu00nJyNTVD4j9qFxPRQ4AV9kZHx4fCY7LvOSHqavJZW7NPNnx7rGgH4lmjxRbFARwjaz2VBnA9y1MzI5T57nfmgplX06T04DW-ahrIeifEGT7hwSW7IQJv80AV4sxeM8tGg_cNit4UXKEjEcn92l0wnNuXyM6g_v4kNauy01iIyPvsnbYa_HJY6TGt0OMZedvcF-_yhqBbQOOtyj7sG1cNupXD_e0Ebr3gY_G-178f2yK1FjpXEoI16jlFvtXYoSUAzJOMdcYwM8CUwHSSoJTTdllX82uAWOdxupv2zwgjDIfP_L9Dy5QEX761-AqUTm2trpbaEsJlwH2mIzbuy78yXcBtzF_Ve8U2A1wsvGHfakIXZH91WkS1zzI8SyUJJc7Q8BLSSfJazdYaa20IXaulTviTqnRcgstMPlUGPleEuQYBEPLuS5u-xfEkr_aOzRk4HbHykJtQqS-uRQ8X5wWjlY9w4WtGzZTliA4Jgm1hR8sXkxVJpj7tMes&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fsharemods.com%2F&ds=l&xdt=1&iif=1&cor=17416845490826623000&adk=3047537735&idt=209&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Tue, 02 May 2023 09:20:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 198594
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 May 2024 09:20:28 GMT

GET
H/1.1 200
OK cm.php Show response
www.usemax.de/ Frame 6A9B 6 KB
4 KB 53ms
53ms Document
text/html 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/ad.php?w=99883&wf=7&wf_w=300&wf_h=250&umcid=7280&campaign_o=50005&iframe=1&subid=19686216648&cachebuster=1683217821935457&click_c_enc=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=C2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB&ae=1&num=1&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&sig=AOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw&client=ca-pub-7383171830614216&dbm_c=AKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw&cry=1&dbm_d=AKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA&adurl=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: 46e5525a3b1eeb43e6478c9367f7d804641939757872361c7e3613f126c03503

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 3229
Content-Type: text/html
Date: Thu, 04 May 2023 16:30:22 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Keep-Alive: timeout=3, max=69
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
Server: Apache/2.4
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 8CC9 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7178c926812c7fccd9f1b7f29e76e57f36984d757b3f60d5cd04460d1d2bb17b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK cm.php Show response
www.usemax.de/ Frame 0458 6 KB
4 KB 57ms
57ms Document
text/html 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/ad.php?w=99883&wf=7&wf_w=970&wf_h=250&umcid=7319&campaign_o=50005&iframe=1&subid=19686280044&cachebuster=1683217821935459&click_c_enc=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB&ae=1&num=1&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&sig=AOD64_0WMAJUAXcyzDGmBSfo55W44gYlag&client=ca-pub-7383171830614216&dbm_c=AKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc&cry=1&dbm_d=AKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw&adurl=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: ac4d795e99ac7f5ddf33d676869d743a3e0bc059ba8ba8cb8e59a31db693b2e9

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 3234
Content-Type: text/html
Date: Thu, 04 May 2023 16:30:22 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Keep-Alive: timeout=3, max=69
P3P: CP="NOI DEVa TAIa OUR BUS UNI"
Server: Apache/2.4
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 4EB2 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b72120a6f320ba00e8eb7e3cc4ddf47861bd920a5380eff4cf905166efddccf6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 03FF 0
0 141ms
140ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202305030101&jk=125135119191809&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

GET
H3 200 HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js Show response
pagead2.googlesyndication.com/bg/ Frame 3EFA 38 KB
14 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c5b942bd3e64ff2eaff944993c252bcbb1ba01452c9779121f41670e7a0c45c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 12:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14305
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14734
x-xss-protection: 0
last-modified: Mon, 01 May 2023 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 May 2024 12:31:58 GMT

GET
H/1.1 200
OK createjs_2019.11.15_min.js Show response
www.usemax.de/partner/junitedautoglas/display/27032023/ Frame 6A9B 236 KB
63 KB 47ms
46ms Script
application/javascript 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/createjs_2019.11.15_min.js
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Mar 2023 10:32:28 GMT
Server: Apache/2.4
ETag: "3b18a-5f7df4270f94a-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=68

GET
H/1.1 200
OK cisdk.js Show response
www.usemax.de/partner/junitedautoglas/display/27032023/ Frame 6A9B 1 KB
860 B 41ms
40ms Script
application/javascript 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/cisdk.js
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: 6685e0f1afbab6dcc8aedb0e5bb013314a144792e268cfbad3d18d947cd8d3cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Mar 2023 10:32:27 GMT
Server: Apache/2.4
ETag: "438-5f7df426c55be-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=68
Content-Length: 523

GET
H/1.1 200
OK index-300x250.js Show response
www.usemax.de/partner/junitedautoglas/display/27032023/Set1/300x250/ Frame 6A9B 46 KB
11 KB 85ms
44ms Script
application/javascript 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/Set1/300x250/index-300x250.js
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: fb116c355c5bf9ac070037ad85ccca22ef9644954f487dbf0d7acf2e6db8272d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Mar 2023 10:43:12 GMT
Server: Apache/2.4
ETag: "b6e2-5f7df68def119-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=67
Content-Length: 11072

GET
H/1.1 200
OK createjs_2019.11.15_min.js Show response
www.usemax.de/partner/junitedautoglas/display/27032023/ Frame 0458 236 KB
63 KB 124ms
55ms Script
application/javascript 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/createjs_2019.11.15_min.js
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Mar 2023 10:32:28 GMT
Server: Apache/2.4
ETag: "3b18a-5f7df4270f94a-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=70

GET
H/1.1 200
OK cisdk.js Show response
www.usemax.de/partner/junitedautoglas/display/27032023/ Frame 0458 1 KB
860 B 113ms
40ms Script
application/javascript 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/cisdk.js
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: 6685e0f1afbab6dcc8aedb0e5bb013314a144792e268cfbad3d18d947cd8d3cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Mar 2023 10:32:27 GMT
Server: Apache/2.4
ETag: "438-5f7df426c55be-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=66
Content-Length: 523

GET
H/1.1 200
OK index-970x250.js Show response
www.usemax.de/partner/junitedautoglas/display/27032023/Set2/970x250/ Frame 0458 42 KB
10 KB 123ms
42ms Script
application/javascript 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/Set2/970x250/index-970x250.js
Requested by: Host: www.usemax.de
URL: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: acaa64846824b2bf049dd3fd5626fbe339a7df2f69551a74d508c5656b83f033

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Mar 2023 11:04:53 GMT
Server: Apache/2.4
ETag: "a994-5f7dfb6625e9c-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=70
Content-Length: 10139

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C437 22 KB
8 KB 45ms
40ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 177155
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 02 May 2023 15:17:48 GMT
expires: Wed, 01 May 2024 15:17:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FAEF 22 KB
8 KB 45ms
40ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 177155
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 02 May 2023 15:17:48 GMT
expires: Wed, 01 May 2024 15:17:48 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 5494 51 KB
20 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cdn.onnetwork.tv
URL: https://cdn.onnetwork.tv/js/player86/player.js?s=1682523310

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 04 May 2023 14:35:44 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 6879
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Thu, 04 May 2023 16:35:44 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 5494 98 KB
39 KB 52ms
51ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js

Requested by

Host: cdn.onnetwork.tv
URL: https://cdn.onnetwork.tv/js/player86/player.js?s=1682523310

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1990236407f776030449989f9990db0d403c74ded73a278d67252bc1f103c5d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39416
x-xss-protection: 0
last-modified: Thu, 04 May 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 04 May 2023 16:30:23 GMT

GET
H2 200 bridge3.571.0_lt.html Show response
imasdk.googleapis.com/js/core/ Frame D8F5 707 KB
226 KB 44ms
41ms Document
text/html 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.571.0_lt.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4363b0dbb2e8ed664b429784d8cffb06ecaa595d07a281b2f8eafed0ca9aaffd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 484379
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 231231
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Sat, 29 Apr 2023 01:57:24 GMT
expires: Sun, 28 Apr 2024 01:57:24 GMT
last-modified: Sat, 29 Apr 2023 01:44:08 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 5494 44 KB
17 KB 176ms
57ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 04 May 2023 16:30:23 GMT

GET
H2 200 570814_5.jpg
cdnt.onnetwork.tv/poster/5/7/ Frame 5494 94 KB
94 KB 99ms
98ms Image
image/jpeg 217.182.102.223
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdnt.onnetwork.tv/poster/5/7/570814_5.jpg

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.182.102.223 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

18b20f40b1c2b85fd542c41541bc0fc8537c2395031ce89f0ba30fa149f1ffe7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 07 Feb 2022 09:30:47 GMT
server: XO.webservantpro
etag: "6200e6c7-1766c"
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=17280000
accept-ranges: bytes
content-length: 95852
expires: Mon, 20 Nov 2023 16:30:23 GMT

GET
H2 200 a_cnti.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 49ms
48ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cnti.png?ts=1683217823104&event=plimpression&d=9784&vs=0&aps=3&playerVisible=0&plist=2557&widget=808&initap=3&currap=3&ab=0&cbs=1&co=0&vc=0&pod=0&ppos=0&muted=1&mobile=0&lls=0&acount=0
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
last-modified: Thursday, 04-May-2023 16:30:23 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 a_cntg.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 49ms
49ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntg.png?ts=1683217823104&d=9784&wsc=ar&typ=embed&mobile=0&c=45
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
last-modified: Thursday, 04-May-2023 16:30:23 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 a_cntm.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 49ms
49ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntm.png?ts=1683217823104&i=570814&d=9784&wsc=ar&plist=2557&widget=808&initap=3&currap=3&ab=0&cbs=1&co=0&vc=0&pod=0&ppos=0&muted=1&mobile=0&lls=0&typ=embed&ap=3&vs=30
Requested by: Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
last-modified: Thursday, 04-May-2023 16:30:23 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 206 black2.mp4
cdn.onnetwork.tv/img/ Frame 5494 2 KB
2 KB 49ms
49ms Media
video/mp4 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onnetwork.tv/img/black2.mp4

Requested by

Host: sharemods.com
URL: https://sharemods.com/tdggwalircgi/LFS_S3_6T_setup.rar.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

188.165.21.156 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

XO.webservantpro /

Resource Hash

6212a4c6fd9be62d0795e3957471693cb344af6f21c2bbe0e957f3ed82520f1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sharemods.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Range: bytes=0-

Response headers

pragma: public
date: Thu, 04 May 2023 16:30:23 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 15 Nov 2022 12:58:10 GMT
server: XO.webservantpro
etag: "63738ce2-8be"
access-control-allow-methods: GET, POST, OPTIONS
content-type: video/mp4
access-control-allow-origin: *
Content-Range: bytes 0-2237/2238
cache-control: max-age=17280000, public
Content-Length: 2238
expires: Mon, 20 Nov 2023 16:30:23 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame E81D 0
176 B 163ms
55ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Thu, 04 May 2023 16:30:23 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H/1.1 200
OK index_300x250_atlas_1.png
www.usemax.de/partner/junitedautoglas/display/27032023/Set1/300x250/ Frame 6A9B 36 KB
36 KB 40ms
40ms Image
image/png 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/Set1/300x250/index_300x250_atlas_1.png
Requested by: Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: 4b8432f3b069c203f74d772e160fad4c4a2533e736267b1f4925ae30301f5de1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=300&subid=19686216648&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7280&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC2OKInd1TZKGMOfuA7_UP96OQ4A6-55awcPu9iY2UEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT8AU_QmrzxaVvplN-XOeR0VFXwCDzew4-M6o4d0NxmhPe30K5okRZzY6OrfIFKEPkcAzG5MPpEs6aGxdkOTo3GXDUlszxtN17Pk_mEelcQkz7H5JVxybyUggG_GvLEZP-Pd6JMb4gb-_kUqSBo0qJGMw5KRjnmfVHVuAjfwkGnR5J7uV8UumKUnbJY5B1-IACBaEVLOZS71wGHkcJyQFr9qPXthW601UmrZbULGiBJ_HEHR9_3LrtMJsx6MRPCNuV3_yWU9Z7aKnZkvF2zIa0tVCGpelV04hya56FPOtjg9IU-rRxSzj-98Ds6CYz8-g4h1fegkuKW4TcrhGtWVcAE3LKYtKAE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMK2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_2Kru0x-LVmBWroeKxipHcK-UJ8kw%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-AXTSJN2Yy1K3tasSHys_iKNeHfNIFkiYYFjK5B0Wc9uDf4SfibWkVxBHKvjRXp1kDu2np2AXH13PYaLdsnbR0JCgFkgfoI_9BemeUJ6HYBNpvECoe5DZtjcJ-bHsB4JbGL1WVAiV-NEqYPsc6G0i8UADp5oHRdRuRnac5QVQ2p0rqXGhw%26cry%3D1%26dbm_d%3DAKAmf-BkTffOwitRme8IoB8lwCBbGFCusmQBKAEdyNs-EvehO8usFG4fPQEeXNLTBB0dhSsGQlphxfumbzrhwBeKe2q_Z0AyXi0T5SJp_6lFuqLeDy3MXxq-CFDA7cyTalfFhT9iyLECd3_QwI2n4PM6fYol-IFOg-fPb3948sM8ijPCVll34mRCLwIQOtcC8eO9SviKGz7sUyjZ9bfHjbYOudN32_4exymYN9j210qTbpjIiC_oGj9LxJ0rIk4tC9e_kE_XQqVH5mjtBj_cKG3gWIT2hMlCFtlcePxZktKNn1qxQ5Vkfq5MAM7zQAP4Q_B2Xa8923pMWgliWnbCpfLUMYO9QCyoqHsIfu7gttSVAmr2vvn3kK5PcxbV-Q3sPuqmUq0YxWT5FKfr6tR2H1hNx5tGt1kALMwyUhYgAWFX4X0RbeViRfrKfGX39rnQdhHjHU6iLr8DpL5hkEhdmHOk7SH5ve67GBkX75-fleEMIorY1pcclguqRStr2e28djWB4gc_WSDc-yBjweTLC_XjOVqOjYlJ2FE4Y3rNKdV7i5SiikH2Ghmua4oY4rwMh1fftNHhPxxn9s-TypXGIqlk4awsBs1-fA%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Last-Modified: Mon, 27 Mar 2023 10:43:12 GMT
Server: Apache/2.4
ETag: "8f83-5f7df68dd6a75"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=69
Content-Length: 36739

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 5494 56 KB
56 KB 41ms
41ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: cdn.onnetwork.tv
URL: https://cdn.onnetwork.tv/css/roboto.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1287b4c6427119cabf899a5ea898f81e831a2742614813a3302f671690b399c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.onnetwork.tv/
Origin: https://sharemods.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 17:30:33 GMT
x-content-type-options: nosniff
age: 428390
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57116
x-xss-protection: 0
last-modified: Tue, 21 Sep 2021 23:13:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Apr 2024 17:30:33 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ Frame 5494 3 B
23 B 46ms
46ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&aip=1&a=605509841&t=pageview&_s=1&dl=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&dp=%2Fsharemods_com%2F9784&ul=en-us&de=UTF-8&dt=Player&sd=24-bit&sr=1600x1200&vp=1140x641&je=0&_u=AACAAAABAAAAACAAsD~&jid=574026479&gjid=1526081721&cid=151210928.1683217821&tid=UA-135296857-5&_gid=45536344.1683217821&_r=1&_slc=1&z=1888451443

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ Frame 5494 4 B
24 B 47ms
46ms XHR
text/plain 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&aip=1&a=605509841&t=pageview&_s=1&dl=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&dp=%2Far%2Fsharemods_com&ul=en-us&de=UTF-8&dt=Player&sd=24-bit&sr=1600x1200&vp=1140x641&je=0&_u=ACCAAEABAAAAACAAsD~&jid=1624627620&gjid=410456738&cid=151210928.1683217821&tid=UA-135233648-1&_gid=45536344.1683217821&_r=1&_slc=1&z=854632219

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
208 B 40ms
39ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 04 May 2023 16:30:23 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK index_970x250_atlas_1.png
www.usemax.de/partner/junitedautoglas/display/27032023/Set2/970x250/ Frame 0458 65 KB
65 KB 40ms
40ms Image
image/png 212.48.120.130
ARTFILES-AS Artfi...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.usemax.de/partner/junitedautoglas/display/27032023/Set2/970x250/index_970x250_atlas_1.png
Requested by: Host: 7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com
URL: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 212.48.120.130 Bad Segeberg, Germany, ASN8893 (ARTFILES-AS Artfiles New Media GmbH, DE),
Reverse DNS: lb.usemaxserver.de
Software: Apache/2.4 /
Resource Hash: 742c6e14375747747d8573656d7a5437072e085b9b883224bf38c290602e07bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.usemax.de/cm.php?w=99883&t=0&wf_h=250&wf_w=970&subid=19686280044&rd=&ref=https%3A%2F%2F7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&um_vars=0&iframe=1&campaign_o=50005&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&umcid=7319&click_enc_enc=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCLbc8nd1TZKOMOfuA7_UP96OQ4A77uaqwcMu_ws2MEWQQASCN5L0pYJWChYKYB6AB8bmJqinIAQmpArhJv7UzZ7I-qAMBqgT_AU_QfGZt7ijjokA6iY-WtWpmQio0_y9yGwPs1qysLXJToSA7-g_y0N2Ed8H1u5MIGM8-Ok1RGquf8auKyP43ewBf8lHvE2vY-uvENts0qFZ2_BopxCnvki3UWdhI-vcOLUZrzBcvCurmLmn6nNC1OUXFyX-oSqTVd-ZukHxdWs8JS6iFwsKxhurDAbaZQm5FywxDvx46ihoGYKxVAd29uzPdyfUc3TzuElYv7seYt5lO0Lxx7VQSFpwxdLNbKRj1bRos1LW6m69AR3229VVKwBeiR3kxQj-yvCFuwIwDfKrNqJkhgHzYu6aZ945J7uveYy7kfgTYDGuZe2LAmkh_ncAE7ebMr6AE4AQDkAYBoAZNgAfx8dmJBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE68ggbYWR4LXN1YnN5bi0xNzkzOTIxNDM1NTU0OTE5gAoDmAsByAsBgAwBsBPwj58T0BMA2BMKiBQB2BQB0BUB-BYBgBcB6BcB%26ae%3D1%26num%3D1%26cid%3DCAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB%26sig%3DAOD64_0WMAJUAXcyzDGmBSfo55W44gYlag%26client%3Dca-pub-7383171830614216%26dbm_c%3DAKAmf-Dw-3Zwrl-YctGglw2XvtqWwXeeA1ZVy-MA_rBqnI6KMOAzqoH0LLge4ZJavBnimWLvZw7l_3e7SY0Ds8SUHUEqrxuL1on9mGzFrvBLnGtvegXa3HRjJsTgGBuxscqlJwa4j0NWGW14MqGvTlOrvmsEmEbgUm29wNTpeFrrPOpfRdeToQc%26cry%3D1%26dbm_d%3DAKAmf-BkBvGgk8rKoSiMzDN-BfWfhwERjO5urGpvXrrrzaSw3I_ChH4mWoQcmODnoddn5hUhHY4Bj3A5bFrzegMdAHgsAnQXzZSojRH-iaT3FDZADJRafgdg7nRC72qfG-0jaNzNZVzeyzsOC2q93HM49ymea-1B_Km5CV5xIRIxeZAjLde00AEHcDXn7OlLKhKXmEiMAjT-UlR4oG3W6VP_0-rASOkP3-PELjTm-ss50OOTdp-enkB78eSsG4piAzPjh5VCBXO0iEhk5W3_v96Z5gCCshXnfDZA1hVjYgPdXiPKBG_UyNiVK1-kZQsNyJ8krJy-7-orz3tpNw-_zl0c36a6MJvg6QZgSL87y76J8WK0cbKov09jACAIfFUNQvlSPQ3iabzo_8jEi3b3daLy46fBQ4XVlJ3tjVSUsXHXGkJobYRDfnWG6OBVWxAl2VUv2ys-bCo5WnEeaINS97OZCD4ojYXFEGrLQ6dvXVzxlxMLjtVPx5bdE3IfKmDCzieF4L_mv45tKWotmmegh7o9KArKlpsMGYeCOaZhaSHx41KAbQX7VHT9F6sPMI--Hd3yKooA6mbeQjhl7Lq19bW5zlcQZMkgsw%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:23 GMT
Last-Modified: Mon, 27 Mar 2023 11:04:53 GMT
Server: Apache/2.4
ETag: "10256-5f7dfb6662766"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=68
Content-Length: 66134

POST
H2 200 node.php Show response
node.setupad.com/node/ 0
208 B 40ms
40ms XHR
text/html 159.89.25.223
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://node.setupad.com/node/node.php
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.89.25.223 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 04 May 2023 16:30:23 GMT
content-encoding: gzip
server: nginx/1.18.0 (Ubuntu)
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET, POST
content-type: text/html; charset=UTF-8

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 5C0A 0
10 B 39ms
39ms Image
text/plain 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?iGJBlQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js Show response
pagead2.googlesyndication.com/bg/ Frame C437 38 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c5b942bd3e64ff2eaff944993c252bcbb1ba01452c9779121f41670e7a0c45c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 12:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14305
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14734
x-xss-protection: 0
last-modified: Mon, 01 May 2023 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 May 2024 12:31:58 GMT

GET
H3 200 HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js Show response
pagead2.googlesyndication.com/bg/ Frame FAEF 38 KB
14 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/HFuUK9PmT_Lq_5RJk8JSvLsboBRSyXeRIfQWcOegxFw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c5b942bd3e64ff2eaff944993c252bcbb1ba01452c9779121f41670e7a0c45c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 12:31:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14305
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14734
x-xss-protection: 0
last-modified: Mon, 01 May 2023 14:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 May 2024 12:31:58 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ Frame 5494 218 KB
77 KB 48ms
47ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=G-9MKHEBGM3R&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0bf6f53d32156ac21f56369f49e810892d0b94056e22e21b94fbdeff212d9934

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79204
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 04 May 2023 16:30:23 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ Frame 5494 1 B
67 B 49ms
47ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-135233648-1&cid=151210928.1683217821&jid=1624627620&gjid=410456738&_gid=45536344.1683217821&_u=ACCAAEABAAAAACAAsD~&z=96961019

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sharemods.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 04 May 2023 16:30:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ Frame 5494 0
252 B 135ms
47ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-9MKHEBGM3R&gtm=45je3510&_p=605509841&gcs=G10-&cid=151210928.1683217821&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1683217823&sct=1&seg=0&dl=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&dr=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&dt=Player&en=page_view&_fv=1&_ss=1&_ee=1&ep.anonymize_ip=true
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=G-9MKHEBGM3R&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://sharemods.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C437 0
20 B 147ms
146ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_Nc4nt1TZJ22MMzt3wP94JqQCQAAAAA4AeAEAg&bg=!aGulaz_NAAYV_mUANf47ADkAdvg8Wge9h2Z3vuQmgOdbMyQ6G7lKiagcLaoM0Cv0-Iz_LruObcMslnFf1fap9H0GRjdNF0MbJvYCAAAAplIAAAADaAEHCgA9tcgFFWUI_QzX4KZHlZhjj3bXXpCVU5p-BVUucHrpSQqxM46Z3z24af7PhT9C7-7J4msQJbEflDEp-pr1VpkDPo9XFA8_W0XQ5VSOBM0v2_ZfbJIMjnRJp1dkx2dMBuRiJkCAgPlbtiR1q_Xz4VJcmApdqzuerxdQbIF5_5x6aUpF0VO__iL-R9wvsbMM1JHgG72hHs9dPpajmWqY2uok8fxDsAscRNZt-4J_--u6sIOWDMKGFhMRLnss0xvCwiaWavjmIvD2HVqvyKBrz51-iq9o6qVUIwz8sRiSEhZLpUUnqPD8ZMLDvHKUYCrMtBWqy8kknGiHRBwyJqeyIYnR_uLXpSxWNvv-ljHDKqENPI0pqoAH636B_l_0EA5cZTOIc9-KETy-oVR9EkZK-Yhe3_EDFXdYQkqlpBXWyRfiyvBw6PpWpT6DIYqrw-zf_tdsZG8XWsgOj7Z-_zpnO3HSPw8i1xx_JnGW7pRokmpEsmskPgsWXfLxipZXjS19HvlusCuRJLLcPP5nQWNxh9IlWdo9Iv7U3fi6Cn5zWAXKfBCEViUUcamWixoZIdtSL6Ca4jQNYWypH6Vn7etKzzBNkiFx3MPb6ZLhf8T_JTKtluPKoQiQYvAppDndD2Bx7C5uZx01qg6W2sVAVuUkm6Dzzdjs7nYieAUw41EghdMf0esqg6U-jS9EUwgunzxB-oXgl3w385IUSg3Vn-w776PFk5JBBsBtjM5J9m27TtZuV7uCdlYD9YD5qSH6ePb-CF7eqW6C3XCp_9KR80Z-k1r86k-R0_2uUUWBPVS4z089MJzu82e5euWQm-1siq0Isag8B7jr5RMvI90FfmRk5gJkIhjdRxueFDkqOdFwJOVa8KmWNK-JpavBobcC46Xpny2t3g0XHgdn-SbjiIlaWVfpANAMy1CP-UC3mzTMtbNtZk9TeDgJTcz4oq1TgR6tKh5xEbNelYQ0hH_aIIZKd2pnAWdTBDdK-Y8eJRvfPAV8o1SURrNFx2WhlqKZkPRT2hsYGtf5Y-Qy_yY-uoYfXZVLwy4k49SsPfUr7WMrYwHiP_mP12tu9Qg9xzoY0F_6AEkv0Z99PHmZGX-RzfRJjbflcdgn_Shk_kG5himM_C9dQFPt1XEtQ9dKGD57E0p9CuZXv7kaY-nVgm6Et9EBSzkQoS7mCk82DcikHZNrvGpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FAEF 0
20 B 146ms
146ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9zLynt1TZNu_MMW4lQeH8LMoAAAAADgB4AQC&bg=!GBulG0_NAAYV_mUANf47ADkAdvg8WvA9wsv8pUJ29VepX2cdel3UiCXbS5ImpNC5FtdoXMU3AyHGPTHoZEC2-1e4gDE_KQ7OIFkCAAAAnFIAAAADaAEHmQMjGb1MwXAMOQAsq7NSdtHaZ6ShzU_1IuDNOG_CMZZYjFcqonvyKm5wj7L9xbjwDE5RaFbsZGy6ypz6uRB_LZiUSspvnTQZLUQnNhIQqkw7iPftoNrgKhWyYYofqbUiJsopg4iN7thINs1S0edSHkRHceyja8FpbF0Pgk_MaqreV22tJVMAgLSeMzZb5HVheIRj5mXIw03RVNd4PZIXujxHecc3Y1cCFxsrqXcOOK_S_f8ErvPngarTOnpf-zPNZcoCyd19JKKydsLR8eip3LBwYi0prQhmVw8YKgA6hnPaWPlMkP2BxQyznTZ-1rdbQ82fY7W7qCDmGE39576K-RjnMVSvNGj0JvZTZ7zAUFH4MrUJVVgFELFyoD845guty98MQSK1csmL8pJbnc_YindYjO9INx42D__D1v1gKFKcbR0GE2QI5wqRK9tBkvJDjSKAr-R4ju1OAmmurWGXYIJTV54h6MN-iu1u-0fSaHaiXK3EvvGUwbUpQqkRtTuKxajAb8g2FZC7w6jV0DdGcbkSU321tZ-ITv3Laj33twM4uaV9qQKVJk0PmbyUjWq9XKTIlRLkecc8kVEOOROTqLV9WXuzCOl42a5DBCMpWWB8VboR1yCd073H9y7k6TBPmVjz4hQOXxTIBEPOhZW84cXaUAOJ143B7p9C6YEvAWnCJYgmA6G_ogSerA3mzuTEDIofM7t3mqWnttwW0rDYjTEN5VoLal-erhu35MpFXBzHW1MflSigYlB2i65TYpnj92BrJfdIUrQmzRYJ332Q9JdgAuxvdEoHGAbzS0OcDki64CnmVZYpKlrvNynQSGwfcUxoOdRYBjU4drTIEZeC6X4zWoNc0hORS26pb7iR8_HIgARFwuEe5aulMo-Q2BEVKv5H9csKqjjDmsqp0EdDhYqubdKd9WMaHGL3ZdQz1aNO30XFvr2ZDvFk1OHl1CUTPy4vuiPE18QN0jLN3MNscfgYsTo1viu74I3EBp-g52yWtbv0QMhhGUQlxdZCNHcJcWl03Z7QTWegLH6GvTlYp74jRPgWtgU8Ri0i709c8emMVg90N7w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 9C8F 42 B
64 B 146ms
146ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstZqgv_sbtGzh9FQ_lhvk40b12F9AtH-ZX4uHOyPtXE22Cv180DipSFzYNtHRSwCa-AXPEj3rSECrmMcBdjWbhzHhKXSC4Tt3p56YznuHGtIdN9C8Wk-TXRcy3lRM2NFsCofeR9vg&sai=AMfl-YRMuz0sn8Ngu-fOuL9_wV1WszjuWI-TncDNdKwVpa1Y82AQruRWd3BBZtqNNn_HljF1rB8jAXnjb3Rx5n41VnA7HrFH28OBsms6gLpg1J9LEfvq6_vbmlv_mJGbQp6YFAsNLewT1Nh-wUec&sig=Cg0ArKJSzNiXQQyNJx4NEAE&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&id=ampim&o=310,339&d=980,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=344&tls=1344&g=100&h=100&tt=1344&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8CC9 42 B
174 B 191ms
190ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu5tPMRoszoJsehgsgF1kgU0hbncnNPXfjjEGZ2rAVRN-WIXLL6yw8F5zjbybRPKvxx5ph0Z_NF2XoaKsSE-qr-2K9bZmDGX95fxH-dXXCFKsKAXiYVv0v3rvqKGUQmLFpuQq2sDQ&sai=AMfl-YSi7BgCIRr0_fAEc-DJnpCzusRFAV3u6HkxPiPhcInmAX_oqfE7fZtZ_r9zGp7-G7aBvIn-B5WCXKOGPa3CU79-HSqctgNmr8zKmCatsGynjzbgWAyCtF9yEgYZLUsE-M2nie7vzQfF0eu4&sig=Cg0ArKJSzAI3rqxvH1IREAE&cid=CAQSSwBygQiDlNRmy1G1FlfJjZ5DZi5BYbzO-Af_72ZiBDehrcW--1eHuK7CYwIw65OWjoeC6o4Tb3hMel6p_ANWVPTxgf_be-kvO1IwZhgB&id=lidar2&mcvt=1000&p=867,650,1121,950&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20230503&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=605329121&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1683217822394&rpt=532&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 271ms
271ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202305030101&jk=125135119191809&bg=!j4yljNjNAAYV_mUANf47ADkAdvg8WnTgGvGFgW8clmpipv4dWq8tOd7OqRzQYfOf4DrfzaWIHa4azpq2ltQexhlFlVHnJZ0OoqoCAAACOlIAAAACaAEHCgAkRJkLF3KXT_IsvOPu1HhvqA3KA-UY9_IYsjpq8O-sE0zeuZpWmQLfBQCOI_Xzdo8Quoe811ADRBzbdZaxMqSN_CecNC-68-6DgAiNer6LFPDLdR2EOx45Ou1ks3cn8sHG3ns-jeHSeosJIz7skLBodB9BFdaRRA_jbCaCAzX2NUWZDjhk73S1lUC4SAl-mrblYORYMymAwDPhF9JM_7U6_qXjn2rJlqYamvqfVQvnOw-kv1LiAHohGAm1gqYrJo1m8X-s-DLpUGpXh2_R1tm_wfrzm1K63gT3AT-ElElimuQw6nynWq_Z7rGLWcdqaZR2Z09BxF1Oe0F7qNYTb4ghH8w4eLzBoli48B4VvRlpLp2mTrcQ0J3wsSv2KlALrpwAGrLtJlq4JeIVv8WtZsJAswy9uBQps4-LayUYx6PMPZtYLJRUc8e6tdjRM5QMeTNZfnTm2CFp_-jzvjQ6tfEFK9Y75sHPRSOC9gqsmJgGiKMD9c2l7UJOehlilFn1J_KMJWgrKKK__jau0Nl7SG8FzWxFJjIHoU24FHi23hUhhP3eSG1IGFkLQQP_SOVE5Cqq6glngzQug2jdKks6tJEomiHRIM1EML2VinmUpnGhM79OsLL1QHNxz42JKTyNYMvCxcxPmD1llT7w-03lBRM_SYaDkRZ6ZfxAt744lrkLk0_mxFRwVWow-EVen-xHVHsXFENMd63qsr5iFRKfpRRL8o3HNbLMr6GSySpq6FdJM4d9SEG8iKIbL_oKUWmxG5h9A0PcCc0ICyNWhfo9lhlyRgk1Am1a_o3XMu-oz6arBTONqUrDUrbfme7BnkWzfe9sl7zWTH3nb9WWN_ItC5C8xvfEgbiWSDktwJJdL6SPV5qZntVZYO3uAyjK8ftFT2LN6DMmd_Uz4z9Ttznb_B8YN8t6oaWZn-yyM3EgZ2Ih-e2zbybCHxkHnXxDVbe4Sll2lJPni-NJ23jLJvM93DP2gQWh2NNwFOaUAmxGVWvB_qHzSZv5tUqE5SUMO1j5ixywNuEHoZcC
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

GET
H2 200 a_cntg.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 72ms
72ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntg.png?ts=1683217824087&d=9784&wsc=ar&typ=embed&mobile=0&c=23
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:24 GMT
last-modified: Thursday, 04-May-2023 16:30:24 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CC9 0
20 B 140ms
140ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=737591103681&version=m202301230201&ct=77&x=1&cor=4364319810599599000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EB2 0
20 B 141ms
141ms Ping
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9945202429115&version=m202301230201&ct=77&x=1&cor=17416845490826623000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://7c4ae95f8079a23d4fc5a1785d2b5064.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame F6BC 52 KB
17 KB 134ms
39ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 36550
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 04 May 2023 16:30:24 GMT
ETag: W/"623de86a-cf34"
Expires: Mon, 17 Apr 2023 07:14:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1531, 206691
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230079-FRA
X-Timer: S1683217825.903524,VS0,VE0

GET
H2

200

visitormatch Show response
bh.contextweb.com/ Frame 0F9C
Redirect Chain

https://bh.contextweb.com/visitormatch
https://bh.contextweb.com/visitormatch?reat=1

27 B
463 B

115ms
114ms

Document
text/html

198.148.27.139
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bh.contextweb.com/visitormatch?reat=1

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

ec2f44e7dbd2ebb1268ac7e7a0602ec2106bc7fd9da17b9012db81be55cbd485

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: de-DE
content-type: text/html;charset=iso-8859-1
cw-server: bh-deployment-6c7cb7447-csz4j
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control: private, max-age=0, no-cache, no-store
content-language: de-DE
cw-server: bh-deployment-6c7cb7447-csz4j
expires: -1
location: /visitormatch?reat=1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server: Jetty(10.0.14)
strict-transport-security: max-age=15768000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame E060 281 B
554 B 187ms
40ms Document
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 04 May 2023 16:30:24 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ Frame BC9E 0
0 42ms
42ms Document
text/plain 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1683217821534

Requested by

Host: stpd.cloud
URL: https://stpd.cloud/saas/3928

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 sync-all.html Show response
adxbid.info/ Frame 86CE 7 KB
3 KB 170ms
74ms Document
text/html 2606:4700:e6::ac40:c012
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c012 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cccba065a0e962f62ca114793d18ada30e87cf7a48900c1e7486e8e4c57a05b9

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c2220cdaf063679-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZXLPufLx%2BNBsKR8a18CTi5wY0Ymtz%2BY6XffF3VSGXkrvTSGzrxhCiOq3mUMpji1s%2BxYKzBqyj%2BsOzRtcz45eW9UJCTwH9kekTmssb1KDTkepSvlj4VuzDZNV0jlTiGdAvTGjUqPWHKQTig%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8DCE 16 KB
6 KB 149ms
43ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Requested by: Host: stpd.cloud
URL: https://stpd.cloud/saas/3928
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://sharemods.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=84354
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Thu, 04 May 2023 16:30:24 GMT
expires: Fri, 05 May 2023 15:56:18 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F6BC 0
857 B 85ms
85ms Script
text/html 185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

186.62.91.34.bc.googleusercontent.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:25 GMT
AN-X-Request-Uuid: a41ea026-7ae9-404f-b52d-a9c57417f122
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 8DCE 5 KB
6 KB 144ms
46ms Script
text/html 185.64.189.115
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=54123112&p=156191&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.115 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: d262d3f99a9b9a473a6e2b6e83792a4ba595e0ab5d42dc2c12c564c33a632458

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 getuid
eb2.3lift.com/ Frame 86CE 37 B
140 B 137ms
40ms Image
image/gif 76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/getuid?limit=50&redir=https%3A%2F%2Frtb.adxpremium.services%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E060 34 KB
10 KB 41ms
40ms Script
text/html 104.109.78.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-109-78-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 2ef5da5c4a7460500e4136d5b93f36f606b66ba3791a74605a210fc50df6250d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:25 GMT
Content-Encoding: gzip
Last-Modified: Wed, 03 May 2023 20:38:33 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=14996
Connection: keep-alive
Content-Length: 10021
Expires: Thu, 04 May 2023 20:40:21 GMT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3EF2
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:b8426453-dda1-4800-94bb-454f36c5c69c&gdpr=0&gdpr_consent=

42 B
327 B

76ms
48ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:b8426453-dda1-4800-94bb-454f36c5c69c&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 04 May 2023 16:30:25 GMT
Expires: Thu, 04 May 2023 16:30:24 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 830 785530e master cdg-pixel-x31 config_version:"unknown"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:b8426453-dda1-4800-94bb-454f36c5c69c&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 8F13
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5124322326269732543

42 B
194 B

49ms
48ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5124322326269732543
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:25 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Thu, 04 May 2023 16:30:25 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5124322326269732543
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 6A79
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
95 B

96ms
48ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Thu, 04 May 2023 16:30:24 GMT
expires: Thu, 04 May 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 994196
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame A407
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6942275522999782914

42 B
274 B

48ms
47ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6942275522999782914
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=6942275522999782914
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 55F8
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zGJx954yJfXXYnahmDBppsNiJ6DXNCenyWNMGVPP

42 B
343 B

50ms
49ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zGJx954yJfXXYnahmDBppsNiJ6DXNCenyWNMGVPP
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:25 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Thu, 04 May 2023 16:30:25 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zGJx954yJfXXYnahmDBppsNiJ6DXNCenyWNMGVPP
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 6C70
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4016745348421611929&gdpr=0&gdpr_consent=

42 B
315 B

165ms
47ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4016745348421611929&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:23 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

AN-X-Request-Uuid: a70179dc-ef2a-4e9a-9272-3c45f4ba1d69
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Thu, 04 May 2023 16:30:25 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4016745348421611929&gdpr=0&gdpr_consent=
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 960.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1

200
OK

dcm Show response
aax-eu.amazon-adsystem.com/s/ Frame 10AD
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=B034106F-FCCA-47C8-8E07-95A24CF481DC&redir=true&gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=B034106F-FCCA-47C8-8E07-95A24CF481DC&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

223ms
222ms

Document
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=B034106F-FCCA-47C8-8E07-95A24CF481DC&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 04 May 2023 16:30:25 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 1FNDGG1XXQEQBYA0JD6Q

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 04 May 2023 16:30:25 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=B034106F-FCCA-47C8-8E07-95A24CF481DC&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 5HMCBDDGJ5XNK5TQCDJT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 8B43
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7229365510427768982&gdpr=0&gdpr_consent=

42 B
298 B

111ms
47ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7229365510427768982&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Date: Thu, 04 May 2023 16:30:25 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7229365510427768982&gdpr=0&gdpr_consent=
Server: nginx
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7A12
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=VoJCl8w3UtFGYzoFkblkWFD_B2k&gdpr=0&gdpr_consent=

42 B
300 B

45ms
45ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=VoJCl8w3UtFGYzoFkblkWFD_B2k&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Thu, 04 May 2023 16:30:25 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=VoJCl8w3UtFGYzoFkblkWFD_B2k&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 18DB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZFPdoQAHkwCakQAp&gdpr=1&gdpr_consent=&_test=ZFPdoQAHkwCakQAp

0
74 B

45ms
45ms

Document
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZFPdoQAHkwCakQAp&gdpr=1&gdpr_consent=&_test=ZFPdoQAHkwCakQAp
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Thu, 04 May 2023 16:30:25 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=ZFPdoQAHkwCakQAp&gdpr=1&gdpr_consent=&_test=ZFPdoQAHkwCakQAp
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-fra-eddf8230052-FRA
x-timer: S1683217825.430708,VS0,VE0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 0311
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEZllrN0lwN3NBQUNEM3FrcEZ6Zw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADfYk7Ip7sAACD3qkpFzg&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=377690752920895004&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AADfYk7Ip7sAACD3qkpFzg&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D377690752920895004%26gdpr%3D0%26gdpr_consent...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=377690752920895004&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AADfYk7I...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADfYk7Ip7sAACD3qkpFzg&gdpr=0&gdpr_consent=

42 B
278 B

48ms
48ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADfYk7Ip7sAACD3qkpFzg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:26 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Thu, 04 May 2023 16:30:26 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADfYk7Ip7sAACD3qkpFzg&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 6BC9
Redirect Chain

https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=B034106F-FCCA-47C8-8E07-95A24CF481DC&gdpr=0&gdpr_consent=

42 B
286 B

49ms
46ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=B034106F-FCCA-47C8-8E07-95A24CF481DC&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 04 May 2023 16:30:25 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=B034106F-FCCA-47C8-8E07-95A24CF481DC&gdpr=0&gdpr_consent=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame A610 43 B
370 B 200ms
49ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Thu, 04 May 2023 16:30:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 4D21
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
416 B

238ms
220ms

Document
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7c2220d248ea996e-FRA
content-length: 43
content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:25 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7c2220d00e43996e-FRA
content-type: text/html
date: Thu, 04 May 2023 16:30:25 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 347

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 14C5 43 B
278 B 258ms
58ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Thu, 04 May 2023 16:30:25 GMT
Vary: Accept-Encoding
X-adserver-worker: docker9-bcda8dc6f484@version_1.551
X-core-time: 0ms
X-server-arch: v2

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F06F
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
225 B

100ms
46ms

Document
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Thu, 04 May 2023 16:30:25 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2 200 bridge Show response
cm.adgrx.com/ Frame B8FE 43 B
283 B 631ms
92ms Document
image/gif 173.231.181.122
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 173.231.181.122 Secaucus, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 43
content-type: image/gif
date: Thu, 04 May 2023 16:30:25 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: ams-delivery-3

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8DCE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=sDQQb_zKR8iOB5WiTPSB3A%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

4 KB
4 KB

41ms
41ms

Image
text/html

23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=84353
accept-ranges: bytes
content-length: 5554
expires: Fri, 05 May 2023 15:56:18 GMT

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame 8DCE 49 B
266 B 207ms
56ms Image
image/gif 54.77.31.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=B034106F-FCCA-47C8-8E07-95A24CF481DC&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.31.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-31-84.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.12.247
content-length: 49
expires: 0

GET
H2

204

ids
idsync.frontend.weborama.fr/ Frame 8DCE
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=3645970919
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=B034106F-FCCA-47C8-8E07-95A24CF481DC

0
284 B

257ms
48ms

Image
text/plain

34.111.131.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=B034106F-FCCA-47C8-8E07-95A24CF481DC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 34.111.131.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 239.131.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:24 GMT
via: 1.1 google
last-modified: Thu, 04 May 2023 16:30:25 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

location: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=B034106F-FCCA-47C8-8E07-95A24CF481DC
date: Thu, 04 May 2023 16:30:23 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1

200

p
a.audrte.com/ Frame 8DCE
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=B034106F-FCCA-47C8-8E07-95A24CF481DC
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZDltZ0ItcFNrNnhSVDJ2Um9BOFZSZzFZZw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=5845823431900177768&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

117ms
117ms

Image
image/png

3.215.146.42
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: HTTP/1.1
Server: 3.215.146.42 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-146-42.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Thu, 04 May 2023 16:30:26 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Thu, 04 May 2023 16:30:25 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QjAzNDEwNkYtRkNDQS00N0M4LThFMDctOTVBMjRDRjQ4MURD&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

156ms
51ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDQ_uLtr8whiC35ZlgivvFY&google_cver=1

42 B
527 B

155ms
49ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDQ_uLtr8whiC35ZlgivvFY&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDQ_uLtr8whiC35ZlgivvFY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame 8DCE 43 B
612 B 209ms
59ms Image
image/gif 34.91.62.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.91.62.186 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Wed, 03 May 2023 16:30:25 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5845823431900177768

42 B
243 B

66ms
48ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5845823431900177768
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:23 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=5845823431900177768
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 8DCE 70 B
265 B 210ms
60ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=B034106F-FCCA-47C8-8E07-95A24CF481DC&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=B034106F-FCCA-47C8-8E07-95A24CF481DC&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-N284ll5E2uVmSTZkGKbaGQ8nCl9GMHE-~A&gdpr=0

0
260 B

300ms
43ms

Image
text/plain

198.47.127.20
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-N284ll5E2uVmSTZkGKbaGQ8nCl9GMHE-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 198.47.127.20 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:24 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-N284ll5E2uVmSTZkGKbaGQ8nCl9GMHE-~A&gdpr=0
date: Thu, 04 May 2023 16:30:25 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 B034106F-FCCA-47C8-8E07-95A24CF481DC
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 8DCE 43 B
426 B 258ms
61ms Image
image/gif 2a05:d018:d29:3602:a6ef:9034:ef93:4d3e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/B034106F-FCCA-47C8-8E07-95A24CF481DC?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:a6ef:9034:ef93:4d3e Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=9f4e31cb-9a69-4617-ba10-886a9e61323d
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=9f4e31cb-9a69-4617-ba10-886a9e61323d
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=e0d77653-3e60-41d5-b1a6-ae2a63ec72dd&user_group=1&ssp=pubmatic&bsw_param=9f4e31cb-9a69-4617-ba10-886a9e61323d
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=9f4e31cb-9a69-4617-ba10-886a9e61323d&gdpr=&gdpr_consent=&gdpr_pd=

1 B
244 B

45ms
45ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=9f4e31cb-9a69-4617-ba10-886a9e61323d&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=9f4e31cb-9a69-4617-ba10-886a9e61323d&gdpr=&gdpr_consent=&gdpr_pd=
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 8DCE 0
187 B 192ms
42ms Image
text/plain 98.98.134.243
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame 8DCE 0
104 B 391ms
80ms Image
text/plain 2a02:fa8:8806:16::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=B034106F-FCCA-47C8-8E07-95A24CF481DC&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=4016745348421611929

42 B
95 B

46ms
46ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=4016745348421611929
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Thu, 04 May 2023 16:30:25 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9e87f432-98b2-4509-82c9-bfa5a486ff42
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=4016745348421611929
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7787447577142982261&gdpr=0&gdpr_consent=&us_privacy=

1 B
176 B

46ms
45ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7787447577142982261&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7787447577142982261&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 04 May 2023 16:30:24 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 8DCE
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2699f306-af3e-4eda-905b-db5c410f2e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

45ms
45ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2699f306-af3e-4eda-905b-db5c410f2e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156191
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 04 May 2023 16:30:24 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:2699f306-af3e-4eda-905b-db5c410f2e8e&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Thu, 04 May 2023 16:30:25 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 200 a_cnti.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 50ms
50ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cnti.png?ts=1683217825120&event=plstarttry&d=9784&vs=0&aps=3&playerVisible=2&plist=2557&widget=808&initap=3&currap=3&ab=0&cbs=1&co=0&vc=0&pod=0&ppos=0&muted=1&mobile=0&lls=0&acount=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Thursday, 04-May-2023 16:30:25 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 a_cnti.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 51ms
50ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cnti.png?ts=1683217825128&event=adsearch&d=9784&vs=0&aps=3&playerVisible=2&plist=2557&widget=808&initap=3&currap=3&ab=0&cbs=1&co=0&vc=0&pod=0&ppos=0&muted=1&mobile=0&lls=0&acount=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Thursday, 04-May-2023 16:30:25 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 5494 107 B
165 B 50ms
49ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=sharemods.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H/1.1

200
OK

setuid
user-sync.adxpremium.services/ Frame 86CE
Redirect Chain

https://as.ck-ie.com/prebid.gif?limit=50&redir=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dsmartyads%26uid%3D%5BUID%5D
https://user-sync.adxpremium.services/setuid?bidder=smartyads&uid=3146ecaea408b383918a32037566b861b1ac80efd76ed38a3dd58e55122f6cb6

86 B
564 B

174ms
51ms

Image
image/png

135.125.163.79
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://user-sync.adxpremium.services/setuid?bidder=smartyads&uid=3146ecaea408b383918a32037566b861b1ac80efd76ed38a3dd58e55122f6cb6
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Server: 135.125.163.79 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3190286.ip-135-125-163.eu
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
content-length: 86
content-type: image/png

Redirect headers

Location: https://user-sync.adxpremium.services/setuid?bidder=smartyads&uid=3146ecaea408b383918a32037566b861b1ac80efd76ed38a3dd58e55122f6cb6
Pragma: no-cache
Date: Thu, 04 May 2023 16:30:25 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Transfer-Encoding: chunked
Expires: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame E060
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=XoYnYXtAS8CGzaAHqElONA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XoYnYXtAS8CGzaAHqElONA

43 B
479 B

130ms
129ms

Image
image/gif

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XoYnYXtAS8CGzaAHqElONA

Protocol

HTTP/1.1

Server

209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:25 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: V1DCRBQ9G6W8XJ1VDXVZ
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=XoYnYXtAS8CGzaAHqElONA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame E060
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=HHI9Da7-RS-F0bAjHB4ZDw&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=HHI9Da7-RS-F0bAjHB4ZDw

43 B
720 B

211ms
211ms

Image
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=HHI9Da7-RS-F0bAjHB4ZDw

Protocol

HTTP/1.1

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 04 May 2023 16:30:25 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: GJXH83HMWFE70282PZXG
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=HHI9Da7-RS-F0bAjHB4ZDw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame E060
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/0HUUHfDSW3QOHwNDrzb_3Q?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-roS.HYtE2oLCfGV6Ak4wtHzJ08.TjHUzH9I5Iw--~A

0
239 B

86ms
43ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-roS.HYtE2oLCfGV6Ak4wtHzJ08.TjHUzH9I5Iw--~A
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 04 May 2023 16:30:25 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-roS.HYtE2oLCfGV6Ak4wtHzJ08.TjHUzH9I5Iw--~A
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E060
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEg5Q0ZKQUUtRi1CWEdX
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPqVcCXk7nx7HJWxMREokto&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg5Q0ZKQUUtRi1CWEdX&google_push=

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg5Q0ZKQUUtRi1CWEdX&google_push=

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEg5Q0ZKQUUtRi1CWEdX&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E060
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWRjMWZmYjQwOTgzOGYwYWE2ZThkMGJkNjJiMDM4N2RkMTQ1ZTEyMA

170 B
188 B

53ms
50ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWRjMWZmYjQwOTgzOGYwYWE2ZThkMGJkNjJiMDM4N2RkMTQ1ZTEyMA

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MWRjMWZmYjQwOTgzOGYwYWE2ZThkMGJkNjJiMDM4N2RkMTQ1ZTEyMA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame E060
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEL8JmJsuNtlhTCq35TlcHwM&google_cver=1

0
239 B

166ms
40ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEL8JmJsuNtlhTCq35TlcHwM&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEL8JmJsuNtlhTCq35TlcHwM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame E060 70 B
264 B 185ms
60ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame E060
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LH9CFJAE-F-BXGW

0
650 B

286ms
185ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LH9CFJAE-F-BXGW
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:24 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: C44C71F2D17B41E6B746DD4FAEF86288 Ref B: DUS30EDGE0916 Ref C: 2023-05-04T16:30:25Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX64LCSIjhOH9TtZQt2Mw==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LH9CFJAE-F-BXGW
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H2 204 csi
csi.gstatic.com/ Frame D8F5 0
234 B 256ms
88ms Ping
image/gif 2a00:1450:4003:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lh9cfkos&c=4675255633920&slotId=2337627816960&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.571.0_lt.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4003:80e::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame D8F5 124 B
598 B 166ms
57ms XHR
text/xml 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F147246189%2C21696195204%2Fsharemods.com_instream&description_url=https%3A%2F%2Fsharemods.com%2F&tfcd=0&npa=0&sz=400x300%7C640x480&min_ad_duration=5000&max_ad_duration=120000&gdfp_req=1&output=xml_vast4&unviewed_position_start=1&env=vp&correlator=3825800744963182&sdkv=h.3.571.0&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&mpt=onnetwork%2Fvplayer&mpv=8.6.1&gdpr_consent=tcunavailable&sdki=445&ptt=20&adk=3108524239&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.571.0&sid=931F72C1-E085-419E-BFE3-F33D4BC52204&a3p=EhwKDWNyd2RjbnRybC5uZXQYs-XmvP4wSABSAghkEhkKCnB1YmNpZC5vcmcYqubmvP4wSABSAghqEhsKDmVzcC5jcml0ZW8uY29tEgAYwujmvP4wSAAS7gEKCHJ0YmhvdXNlEtgBNW1keXhUSGozWWozWjZUVFdwN2JWTlJBS05Jc1NwOHpMUUtEOC9UN2pNV3FlaWJjL3hsZWtRNXhPM1ZnZHpkdjJzZEg1NWFsRVB5clpJNS8yeTRmY2JMUkdnTWNBejdvZUlaN2xialNoY29FcC8vUElTcWdjR0NrRldObEx5SmxRWHpQbXpTV0V1MW1abjVIMjhHMUMxNmhEVlZ5RFVrZHFicGxRV3ZiZ0NzM1MrN2pYVW0xTUxoMnJ5c2oxc1d1V1p2ZktFQS9ObXpjcXJEbS9oTDlMdz09GMTo5rz-MEgAEhkKCnVpZGFwaS5jb20Ys-XmvP4wSABSAghkEj4KBW9wZW54EixleUpwSWpvaVEybHlTVEEyTkdGUmNFYzBVRE5JWkRCWU4yZFRaejA5SW4wPRjG6-a8_jBIABIbCgxpZDUtc3luYy5jb20YqefmvP4wSABSAghq&nel=0&eid=44765701%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&ref=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&url=https%3A%2F%2Fsharemods.com%2Ftdggwalircgi%2FLFS_S3_6T_setup.rar.html&dlt=1683217821555&idt=1846&dt=1683217825272&cookie=ID%3D48c4e102809d1236%3AT%3D1683217821%3AS%3DALNI_MbNYbpX9Z2mQchlVOwtyrXnw1-DiA&gpic=UID%3D00000bf5492ffd1d%3AT%3D1683217821%3ART%3D1683217821%3AS%3DALNI_MZT8fFZXqBDLUg2x_qpQS-wk6Md4w&scor=585296690016442&ged=ve4_td3_tt2_pd3_la3000_er1934.230.1934.230_vi0.0.1200.1600_vp0_eb16619

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.571.0_lt.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de9727942565b2603765eceb0a311d44cf38cdd731db72acf0f207e776f491b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame D8F5 0
54 B 95ms
89ms Ping
image/gif 2a00:1450:4003:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lh9cfm5q&c=4675255633920&slotId=2337627816960&ghmsh_eids=44765701%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&vast_v=4.1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.571.0_lt.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4003:80e::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a_cntr.png Show response
cdn.onnetwork.tv/cnt/ Frame D8F5 126 B
368 B 53ms
49ms Fetch
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onnetwork.tv/cnt/a_cntr.png?ts=16832178250&vmvp=0&w=9784&vs=1197&vc=27330&mobile=0&aps=3&pv=2&ac=0&plist=2557&widget=808&ab=0&co=0&pod=0&muted=1&initap=3&adcount=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.571.0_lt.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Fri, 08 Nov 2019 15:04:48 GMT
server: XO.webservantpro
accept-ranges: bytes
content-length: 126
content-type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5494 0
0 141ms
141ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?error=303&vis=1&lid=7&sdkv=h.3.571.0&e=44765701%2C44772139%2C44777649%2C44781409%2C44781753%2C44782991&id=ima_html5&c=1248657863513076&domain=sharemods.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 04 May 2023 16:30:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a_cnti.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 49ms
49ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cnti.png?ts=1683217825450&event=adnotpresent&d=9784&vs=0&aps=3&playerVisible=2&plist=2557&widget=808&initap=3&currap=3&ab=0&cbs=1&co=0&vc=0&pod=0&ppos=0&muted=1&mobile=0&lls=0&acount=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Thursday, 04-May-2023 16:30:25 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 a_cntn.png
cdn.onnetwork.tv/cnt/ Frame 5494 126 B
331 B 49ms
49ms Image
image/png 188.165.21.156
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onnetwork.tv/cnt/a_cntn.png?ts=1683217825450&d=9784&mobile=0&bp=0&ap=3&lin=1&muted=1&fna=1&ab=0&co=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 188.165.21.156 , France, ASN16276 (OVH, FR),
Reverse DNS: vh11b.eris-w13.of.pl
Software: XO.webservantpro /
Resource Hash: a607b3c3e0d09d7f339e0035f16f99bf93637dee0eb27b2b9c447701fefa2ace

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://sharemods.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Thu, 04 May 2023 16:30:25 GMT
last-modified: Thursday, 04-May-2023 16:30:25 GMT
server: XO.webservantpro
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 126

GET
H2 200 sync Show response
vid.vidoomy.com/ Frame A9FF 49 KB
18 KB 240ms
39ms Document
text/html 2a02:6ea0:c700::11
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.vidoomy.com/sync?limit=50&redirect=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dvidoomy%26uid%3D%7B%7BVID%7D%7D
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::11 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: ce33815b4c0f7c15686c773ff8b0e5092b36696a6c758ef499dc32e5a8f01e9a

Request headers

Referer: https://adxbid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
content-encoding: gzip
content-type: text/html
date: Thu, 04 May 2023 16:30:25 GMT
etag: W/"64243ed7-c28e"
last-modified: Wed, 29 Mar 2023 13:36:23 GMT
server: CDN77-Turbo
vary: Accept-Encoding
x-77-cache: HIT
x-77-nzt: AcO1rydwLuX/gycAAA
x-77-nzt-ray: 25b02131fbddbacaa1dd53646b6e3135
x-77-pop: frankfurtDE
x-accel-date: 1683207710
x-accel-expires: @1684244510
x-age: 10115
x-cache: HIT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame F6BC 0
857 B 45ms
45ms Script
text/html 185.83.142.19
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.83.142.19 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS